Business VPN & Zero Trust Access
Proton VPN for Business
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Proton AG · proton.me
Compare with Cloudflare Zero Trust → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Proton VPN for Business at a glance
- Vendor
- Proton AG
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Proton VPN for Business 3/5, the mean of 6 judges. Proton VPN for Business is a gateway VPN from Proton AG in Geneva: clients egress through shared servers or leased dedicated IPs and private gateways in 20+ countries, on WireGuard or OpenVPN, under single sign-on, SCIM and enforced two-factor. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 5 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Proton VPN for Business is a gateway VPN from Proton AG in Geneva: clients egress through shared servers or leased dedicated IPs and private gateways in 20+ countries, on WireGuard or OpenVPN, under single sign-on, SCIM and enforced two-factor. Its strongest showing is pricing transparency, scored 7 to 8: four tiers are public, from VPN Essentials at €6.99/user per month (minimum 2 users) to Workspace Standard at €12.99/user per month, with dedicated IPs at +€39.99/month per IP. Identity and policy clustered at 6, credited for SCIM-mirrored groups and instant revocation. Visibility and audit is weakest, clustered at 5: monitoring is opt-in and off by default, retention periods are not published, and the SIEM connector names no tool. The judges differed on access and connectivity (4 to 6) — the DevOps engineer marked down the exit-based model of whitelisting a dedicated IP at the perimeter rather than connectors into your own network — and on sovereignty (5 to 7), where the same unanswered question of where account data and logs are hosted was weighed differently.
Speaks for it
- Pricing transparency scored 7 to 8, with four public per-user tiers and the dedicated IP add-on priced at +€39.99/month per IP.
- Identity and policy clustered at 6 on single sign-on with Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 provider, SCIM automatic group sync and instant revocation.
- A documented Microsoft Intune rollout for the Windows client with always-on enforcement, judged deployable by a non-specialist team.
- Open-source apps in public repositories, ISO 27001 and SOC 2 Type II stated, and a bug bounty with legal safe harbor under a published disclosure policy.
- Subprocessors listed by name with location and transfer guarantees, under Proton AG in Geneva with an EU representative in Luxembourg.
Held against it
- Activity monitoring is opt-in and off by default, so the audit trail exists only if it was switched on before an incident.
- Access is granted per gateway, dedicated IP or shared server rather than per application, with no public information on connectors behind a customer firewall or site-to-site links into cloud networks.
- No audit report or auditor summary is published, and we found no public information on a status page, incident history or documented control-plane failover.
- The terms state the SLA section does not apply to the Dedicated IP feature of Proton VPN Business and Enterprise subscriptions.
- We found no public information on device posture checks such as disk encryption or EDR status gating a connection.
Best for
- You need a fixed IP to whitelist at supplier portals or other IP-sensitive services, priced publicly at +€39.99/month per IP.
- Your team already runs Okta or Microsoft Entra ID and wants leavers deprovisioned automatically through SCIM.
- You want a Swiss contracting entity with a published data processing agreement and a named subprocessor list with transfer guarantees.
- A small IT team needs a scripted Intune rollout with always-on enforcement it can run without specialists.
Avoid if
- You need connectors into your own networks without inbound firewall rules, or site-to-site links between sites or into cloud networks.
- You need audit logging on by default, with named SIEM destinations and published retention periods, for compliance evidence.
- Your business depends on the dedicated IP feature being covered by an SLA.
- You need access controlled per application rather than per gateway, dedicated IP or shared server.
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3 of 5 |
| Identity, access policy & device posture | 3 of 5 |
| Logs, audit trail & incident response | 2.5 of 5 |
| Deployment, API & administration | 2.5 of 5 |
| Architecture, reliability & security assurance | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3.5 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
This is a gateway VPN: shared servers plus dedicated servers and static IPs in 20-plus countries (the captured pages give different figures for the server network, from 13,000 in 120-plus countries to 20,000 in 140-plus), WireGuard or OpenVPN, split tunnelling, a kill switch, and an enforceable always-on mode — and a dedicated IP is exactly what my supplier-portal whitelist needs. Access can be restricted by user, group or role to specific servers, apps or SaaS tools, and external users get time-limited, role-based access. I found no public information on site-to-site links between my two plants, cloud-network connectors, or a connector that reaches the ERP and file server without inbound firewall rules, which is what would really replace my weekend firewall upgrades. 1 13 14 6 7 19
The DevOps Engineer
Clients egress through shared servers or dedicated IPs across many named countries, with WireGuard, split tunnelling, always-on, a kill switch and an Intune-scripted Windows rollout. The gateway model works by whitelisting a dedicated IP at the company perimeter, and we found no public information on connectors reaching servers without inbound firewall rules, site-to-site links into cloud networks, or per-application access — so I would be opening ports on every Hetzner box instead of running a mesh. 1 6 7 13 14 19
The MSP Technician
WireGuard, OpenVPN, AES-256 and ChaCha20 are documented, with split tunnelling, always-on enforced per organisation, kill switch and dedicated IPs in 20+ countries that teams use as gateways to whitelist company resources, plus a shared network of 20,000+ servers in 140+ countries. The model is exit-based rather than a gateway on the client's own network: we found no public information on site-to-site links to cloud networks, connectors behind a customer firewall, peer-to-peer connectivity or clientless browser access for contractors. 1 6 13 14 19 7
The Operations Manager
This is a gateway VPN that fits my freelancer pattern: dedicated static IPs in more than twenty countries, WireGuard and OpenVPN plus a custom protocol option, split tunnelling, a kill switch, and an always-on mode an administrator can enforce, with user groups limited to particular gateways and shared servers. Access per application is described at the level of restricting servers, apps or SaaS tools by user, group or role. I found no public information on connectors into our own firewalled systems, links to cloud networks, clientless browser access, or clients beyond the named Windows, iOS and Android apps. 1 7 13 14 15 19
The Information Security Officer
Dedicated static IPs and private gateways are offered in more than twenty named countries, WireGuard and OpenVPN are documented alongside split tunnelling, always-on enforcement deployable through Intune, and time-limited access for external users. Access appears to be granted per gateway, dedicated IP or shared server rather than per application, and we found no public information on connectors into our own networks without inbound firewall rules, site-to-site links to cloud networks, or clientless browser access. 1 3 13 14 19
The Skeptic
This is a managed-gateway VPN: shared servers across 140+ countries plus dedicated gateways and static IPs leased per address, on WireGuard or OpenVPN, with split tunnelling, always-on, a kill switch, time-limited role-based contractor access and custom DNS — though the captured pages give different figures for the size of the server network. Clients are evidenced for Windows (with a step-by-step Intune deployment), Android and iOS; we found no public information on site-to-site links, connectors into AWS, Azure or Kubernetes, peer-to-peer paths, or gateway failover. The zero trust page describes per-user policy steps, but the mechanism evidenced is IP whitelisting and gateway assignment rather than per-application access. 1 2 3 5 13 14 19
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Single sign-on with Microsoft Entra ID, Okta, Google Workspace and any SAML 2.0 provider, SCIM provisioning with identity-provider group changes mirrored automatically, and automated deprovisioning are documented — a leaver loses access the same day, which is precisely my requirement. Two-factor authentication can be enforced for admins or all users, user groups can be restricted to named Gateways and shared servers, and least-privilege segmentation via dedicated IPs is claimed. I found no public information on device posture checks such as operating-system version, disk encryption, or EDR and MDM status gating a connection. 1 3 5 15 16 14
The DevOps Engineer
Single sign-on with Okta, Microsoft Entra ID, Google Workspace and SAML 2.0, SCIM mirroring IdP groups automatically, enforced two-factor with reporting, per-gateway and per-server group policies, admin roles on groups and instant revocation are all documented. We found no public information on device posture checks from EDR or MDM tools, just-in-time access with approval, or policies kept as code and applied with Terraform. 1 3 5 7 15 16
The MSP Technician
SSO with Okta, Microsoft Entra ID, Google Workspace and any SAML 2.0 provider, SCIM provisioning from Okta and Entra mirrored automatically, enforced two-factor authentication with uptake reporting, and groups with access customised per gateway cover most of what I need when a client phones about a leaver. Time-limited, role-based contractor access is claimed, but we found no public information on device posture checks such as disk encryption or EDR status gating a connection. 1 3 5 15 16
The Operations Manager
Single sign-on with Okta, Microsoft Entra ID, Google Workspace or any SAML provider, SCIM that mirrors identity-provider groups automatically, enforced two-factor with a count of who has enabled it, and time-limited role-based access for external users with instant revocation — that covers access ending when a freelancer's contract ends. Administrators get granular roles inherited through groups. I found no public information on device posture checks such as disk encryption or EDR status gating access, or an approval step for just-in-time grants. 1 3 15 16
The Information Security Officer
Single sign-on with Entra ID, Okta, Google Workspace or any SAML provider, SCIM with automatic group sync, enforceable two-factor with reporting, user groups with per-gateway access control and group-inherited admin roles, plus time-limited external access with instant revocation. What decides the score for me is device posture: we found no public information on checks such as operating system version, disk encryption or EDR state gating a connection — the only related wording is a reference to policies based on identity, device and network conditions. 1 3 15 16
The Skeptic
Identity is genuine: SSO with Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 provider, SCIM that mirrors IdP groups automatically so a leaver loses access, organization-wide two-factor enforcement with reporting, groups whose gateway and server access can be tuned separately, and instant revocation. We found no public information on device posture checks from EDR or MDM tools, just-in-time approval workflows, or session re-authentication; the only device line is a marketing phrase about "identity, device, and network conditions". 1 3 4 5 15 16
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Connection and gateway monitoring shows who connected, on what device, to which server and gateway, and the activity monitor logs failed sign-ins and account, organization and gateway events per user, searchable by name, email and time range, exportable as CSV on the Professional plans; the vendor also states plainly that it records no online activity, browsing history, IP addresses or session lengths. What is missing for me: the retention period for these activity logs is not stated on any captured page, and the SIEM connector is referenced as a documentation item and a Professional-tier feature without naming the tools it feeds, so I cannot yet promise my auditor where the trail lands. 18 6 3 1 2 9
The DevOps Engineer
The activity and gateway monitors log who connected to which gateway, when and on what device, with a real-time connection view, instant revocation, CSV export and a strong statement of what is not logged. Monitoring is opt-in and off by default, retention is not stated, and the SIEM integration is named without tools, schema or streaming detail. 1 2 3 6 7 9 18
The MSP Technician
The gateway monitor records sign-in attempts, timestamps, devices and server connections per user, the activity monitor logs device name, app version and IP with CSV export, and a real-time connection view with instant revocation exists alongside a clear no-logs statement. Activity monitoring is opt-in and off by default with no data collected when off, retention periods are not published, and SIEM integration is named without naming any SIEM tool — so what I can show a client after an incident depends on having switched logging on first. 2 3 6 7 18
The Operations Manager
The activity monitor logs sign-in events and account changes per user with device, app version and server IP, searchable by name or email, filterable by time and exportable as CSV, while the gateway monitor shows who is connected to which gateway and on what device; the vendor is explicit that no online activity, IP addresses or session lengths are recorded by default. Monitoring is opt-in and collects nothing while off, retention periods are not stated, and a SIEM connector appears only as an integration on the top plan without named destinations. 2 3 7 14 18
The Information Security Officer
The activity monitor logs user, event type, timestamp, device name and IP with search, filtering and CSV export, a gateway monitor records sign-in attempts and server connections per user, sessions are visible in real time and can be revoked instantly, and SIEM integration is listed on the higher plans. But the monitor is opt-in and off by default, retention periods are not published, the SIEM targets are not named and there is no documented log schema — for NIS2 evidence I need logging that is on by default and reaches our SIEM. 2 3 6 7 18
The Skeptic
The activity monitor is opt-in and off by default, and when off no event data is collected — decent for privacy, but the audit trail exists only if someone turned it on before the incident. When enabled it logs user, event with timestamp, device name and app version, and the VPN server's IP, searchable and exportable as CSV; a gateway monitor logs sign-in attempts and server connections per user, and a SIEM connector is offered without any SIEM named. We found no public information on retention periods, alerting, or an admin configuration-change audit log, though the vendor is explicit that browsing history, IP addresses and session lengths are never recorded. 2 3 6 7 9 18
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
Intune deployment is documented in real depth — a Win32 package with a PowerShell install command, an automatic-install dependency toggle, and always-on enforcement on Windows 10 build 19041 and higher — which is exactly the silent, self-connecting rollout my three-person team wants. A central admin console, admin roles assignable to groups on the Professional plans, 24/7 chat, phone and screen sharing from six users, and a dedicated account manager included on all tiers round out the picture. The API appears only as "API integrations" on the enterprise page rather than a documented REST reference, and I found no public information on centrally managed client updates, Terraform or a self-hosted edition; the MSP portal exists but the documented pilot covers Proton Pass, not the VPN. 19 3 15 7 5 20
The DevOps Engineer
A central admin console, MDM and Group Policy deployment including a scripted always-on rollout, admin roles, 24/7 support with phone and screen sharing at six or more users, and an MSP pilot with per-seat pricing are evidenced. The API appears only as the phrase "API integrations", and we found no public information on a documented REST API, a Terraform provider or a self-hosted edition. 4 5 6 7 11 15 19 20
The MSP Technician
A central admin dashboard, deployment via MDM, Group Policy or direct download with a detailed Intune always-on walkthrough, admin roles assignable to groups, and 24/7 support with phone from six users are all documented. The multi-tenant MSP portal is what I want, but the pilot we can see covers Proton Pass only and is reached through the sales team, and the API appears only as an unexplained 'API integrations' phrase with no documentation we could quote. 3 5 6 7 15 19 20
The Operations Manager
A three-step setup, one central dashboard the vendor says a single IT manager can run, install via MDM, Group Policy or direct download with published Intune scripts for Windows, group-level admin roles, and 24/7 chat plus phone support from six users — this is something a non-specialist can roll out. API support appears only as "API integrations" without published documentation. I found no public information on configuration as code or a self-hosted edition, and the MSP portal pilot is for the password manager, not the VPN. 4 6 7 13 15 19 20
The Information Security Officer
A central admin dashboard, admin roles assignable to groups with automatic inheritance, client deployment documented down to Intune install scripts and always-on enforcement, a CLI and API integrations, and a multi-tenant MSP pilot portal with per-seat and per-license pricing components. We found no public information on a Terraform provider or configuration as code, and the API appears as a named integration rather than as published documentation. 3 5 15 19 20
The Skeptic
Day-to-day running is covered: a central admin dashboard, admin roles a group can inherit, a documented Intune deployment for the Windows client with always-on enforcement, a command-line interface on the higher plan, and 24/7 support with live chat on all plans and phone at six or more users. "API integrations" appears in one enterprise sentence with no documented REST API behind it; we found no public information on Terraform, webhooks or centrally managed client updates. An MSP portal exists, but the pilot evidence covers Proton Pass subscriptions, not this product. 2 5 7 15 19 20
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
All apps are open source with a public VPN repository, independently audited, ISO 27001 certified and SOC 2 Type II audited, the WireGuard protocol and AES-256 or ChaCha20 ciphers are named, every connection uses a unique key, and there is a proper disclosure programme with legal safe harbour, a bug bounty, anonymous and PGP-encrypted submissions, and a five-business-day acknowledgement. I found no public information on a published architecture showing what the control plane and gateways can see, a public status page with incident history, or documented high-availability failover. I also note the terms state their SLA section does not apply to the dedicated-IP feature of Business and Enterprise subscriptions — the very piece I would depend on. 11 2 6 21 22 8 14
The DevOps Engineer
Open-source apps in public repositories, independent audits, ISO 27001, SOC 2 Type II, a bug bounty with safe harbor and a disclosure policy with five-business-day acknowledgement are all published. We found no public information on an architecture describing what the vendor's servers can see, control-plane failover, what happens to connections when the service is down, or a public status page with incident history. 2 5 6 8 11 14 21 22
The MSP Technician
Open-source apps with public repositories, independent audits stated, ISO 27001, SOC 2 Type II, a published vulnerability disclosure policy with safe harbor, a bug bounty, and named encryption including WireGuard, ChaCha20, Curve25519 with forward secrecy give a solid assurance story. We found no public information on control-plane high availability, behaviour during outages or a published audit report, and the SLA surfaces only through its exclusions, which carve out the dedicated IP feature of the Business and Enterprise plans. 2 6 8 11 21 22
The Operations Manager
Open-source apps with public repositories, ISO 27001 and SOC 2 Type II stated, a bug bounty with legal safe harbor and a published disclosure policy with response timelines, plus WireGuard, ChaCha20, Curve25519 and forward secrecy — that is real, checkable assurance for a company our size. I found no public information on a published architecture or whitepaper, audit reports from the auditor, control-plane failover, a status page or incident history. One caution from the terms: the SLA section states it does not apply to the dedicated IP feature of the business and enterprise subscriptions. 6 8 11 22
The Information Security Officer
All apps are open source with public repositories, independent security audits, ISO 27001 certification and SOC 2 Type II verification are published, and there is a bug bounty with legal safe harbour and a disclosure policy with acknowledgement and embargo times. For a regulated buyer the gaps are material: no audit report or auditor summary is published, we found no public information on control-plane high availability or behaviour during an outage, no status page or incident history, and the SLA excludes the dedicated IP feature of the business and enterprise subscriptions. 2 8 11 21 22
The Skeptic
More assurance substance than most: open-source apps in public repositories, a bug bounty with legal safe harbor, a published disclosure policy with five-business-day acknowledgement and a 120-day embargo, named ciphers with forward secrecy, ISO 27001 and SOC 2 Type II. But the audits are announced rather than published — no report or auditor summary is evidenced — and we found no public information on an architecture document showing what the coordination servers and gateways can see, a status page, or control-plane failover and whether existing connections survive a Proton outage. The SLA section of the terms explicitly excludes the Dedicated IP feature of the Business and Enterprise subscriptions — the part a business actually buys. 2 6 8 11 21 22
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
Proton AG in Geneva is the contracting entity under Swiss law, supervised by the non-profit Proton Foundation, with a designated EU representative in Luxembourg and a data processing agreement available; the privacy policy lists each subprocessor with its purpose, location and transfer safeguards — Chargebee, Stripe, PayPal and Zendesk in the United States, Atlassian across the EU, US and UK, support in Macedonia and Taiwan. Disclosure of user data requires a binding request from competent Swiss authorities, which I find reassuring. But I found no public information on where account data and the activity logs are actually hosted, and the gateway locations across and outside Europe are simply part of how the product works. 9 5 8 12
The DevOps Engineer
Proton AG in Geneva under Swiss law with a Luxembourg EU representative, a published data processing agreement, subprocessors listed with purposes, locations and transfer guarantees, and ISO 27001 and SOC 2 stated. Payments run through US processors under standard contractual clauses, and the captured pages do not state where account data and logs are processed beyond the Swiss entity. 5 6 8 9 11 12
The MSP Technician
Proton AG in Geneva under the supervision of the non-profit Proton Foundation, an EU representative in Luxembourg, a published data processing agreement, disclosure only on a binding Swiss authority request, and a subprocessor list with locations and transfer safeguards put this ahead of a typical US vendor. Where the control plane and connection logs are actually hosted is not stated, and payment and support subprocessors run through the United States, Singapore, Taiwan and Macedonia. 5 8 9 12
The Operations Manager
The contracting and operating entity is Proton AG in Geneva under Swiss law, with a designated EU representative in Luxembourg, a published data processing agreement, GDPR compliance and ISO 27001 and SOC 2 Type II stated, and every subprocessor listed by name with location and transfer guarantees — payment and support run through US processors under standard contractual clauses. For me the open question is where account data and identities are actually hosted, which the captured pages do not state. 6 8 9 12
The Information Security Officer
Proton AG in Geneva is the contracting entity, an EU representative is named in Luxembourg, a data processing agreement exists, GDPR compliance is stated, and subprocessors are listed with their locations and transfer guarantees for payment and support processors. However, we found no public information on where account identities, configuration and connection logs are hosted, and support and payment processing run through processors in the United States, Macedonia and Taiwan under contractual safeguards. 5 6 9 12
The Skeptic
Proton AG in Geneva under the non-profit Proton Foundation, an EU representative in Luxembourg, a published data processing agreement, ISO 27001 and SOC 2, disclosure only on a binding request from Swiss authorities, and a subprocessor list with locations and transfer guarantees: support through Zendesk and Atlassian in the United States, payments through Chargebee, Stripe and PayPal, each with stated safeguards. What no captured page answers is where the control plane, account data and logs are hosted; we found no public information on hosting location or any self-hosted edition. The chain is named end to end — the vault's address is not. 6 8 9 11 12
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
Four business tiers are public with a price per user — VPN Essentials at €6.99/user per month, VPN Professional at €9.99/user per month, VPN and Pass Professional at €10.99/user per month, Workspace Standard at €12.99/user per month — with minimum seats, billing examples, a 22% yearly discount, a 30-day money-back guarantee, a 30-day cancellation notice, early-termination terms and reverse-charge VAT handling for business plans. The dedicated IP my supplier portal needs is priced openly at +€39.99/month per IP, and single sign-on with SCIM arrives on Professional, so I can compute my real annual cost from public pages alone. Only Enterprise is "Let's talk" and the Lumo add-on carries a free trial but no price, which keeps this just short of fully computable. 7 8
The DevOps Engineer
Four business plans are priced per user with minimum seats, dedicated IPs at "+€39.99/month per IP", a 22% yearly discount, reverse-charge VAT handling for business plans, a 30-day money-back guarantee and a 30-day cancellation notice, with SIEM and CLI gated to the higher plan. Enterprise is contact-sales and the MSP pilot's fee schedule is defined per agreement rather than a public rate card. 7 8 18 20
The MSP Technician
Every VPN tier carries a public per-user price with minimum users, dedicated IPs are priced at '+€39.99/month per IP', and the yearly discount, trial, 30-day money-back, cancellation notice and business reverse-charge VAT treatment are all public — enough to quote a client without calling the vendor. Only the Enterprise plan and MSP pricing, defined per agreement as a program fee plus a price per admin seat and per managed licence, stay behind the sales team. 7 8 20
The Operations Manager
Per-user prices are public for every named plan with minimum users, the dedicated IP add-on is priced at +€39.99/month per IP, and a 22% yearly discount, VAT and reverse-charge handling for business plans, a 30-day money-back guarantee and a 30-day cancellation notice are all stated — I can budget fifty seats and our gateways without a sales call. The Enterprise tier is "Let's talk" and the AI add-on carries no stated price, and the plan pages show per-user monthly figures alongside billed totals without stating which billing cycle each total covers. 7 8 20
The Information Security Officer
Every published tier carries a per-user price with its minimum seats — €6.99, €9.99 and €10.99 per user per month for the VPN plans, €12.99 for Workspace Standard — the dedicated IP add-on is priced at +€39.99/month per IP, and the yearly discount, 30-day money-back guarantee, cancellation notice, billing cycles, early-termination terms and business VAT reverse-charge handling are all stated. Only the Enterprise tier is unpriced and left to sales, and the MSP pilot names its fee components without figures. 7 8
The Skeptic
Four tiers are public with per-user prices and minimum seats — VPN Essentials at €6.99/user per month from 2 users, VPN Professional at €9.99/user per month, VPN and Pass Professional at €10.99/user per month from 3, Workspace Standard at €12.99/user per month — plus dedicated IPs at +€39.99/month per IP, 22% off yearly, a 30-day money-back guarantee, reverse-charge VAT handling for business plans, 30-day cancellation notice and early-termination terms. Unpriced: the Lumo AI add-on ("Add-on with free trial"), Enterprise ("Let's talk"), and MSP program fees outside the pilot where they are waived. A buyer can compute most of the annual cost from public pages alone — not all of it. 7 8 20
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Proton VPN for Business
Is Proton VPN for Business European?
Yes, though not from the EU. whats-best.ai classifies Proton VPN for Business as UK / wider Europe.
Where does Proton VPN for Business store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Proton VPN for Business have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Proton VPN for Business?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Proton VPN for Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 5 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (product page) proton.me Checked 5 Nov 2026 Details →
- 2 Features page proton.me Checked 5 Nov 2026 Details →
- 3 Features page (access management) proton.me Checked 5 Nov 2026 Details →
- 4 Features page (zero trust network access) proton.me Checked 5 Nov 2026 Details →
- 5 Features page (enterprise) proton.me Checked 5 Nov 2026 Details →
- 6 Compliance page proton.me Checked 5 Nov 2026 Details →
- 7 Pricing page proton.me Checked 5 Nov 2026 Details →
- 8 Terms of service (names the operating company) proton.me Checked 5 Nov 2026 Details →
- 9 Privacy policy proton.me Checked 5 Nov 2026 Details →
- 10 Data processing agreement (dpa) proton.me Checked 5 Nov 2026 Details →
- 11 Security / trust page proton.me Checked 5 Nov 2026 Details →
- 12 GDPR page proton.me Checked 5 Nov 2026 Details →
- 13 Access model & connectivity — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 14 Access model & connectivity — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 15 Identity, access policy & device posture — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 16 Identity, access policy & device posture — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 17 Logs, audit trail & incident response — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 18 Logs, audit trail & incident response — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 19 Deployment, API & administration — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 20 Deployment, API & administration — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 21 Architecture, reliability & security assurance — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 22 Architecture, reliability & security assurance — found from sitemap proton.me Checked 5 Nov 2026 Details →