# Proton VPN for Business — Business VPN & Zero Trust Access

Proton VPN for Business by Proton AG holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-05. Provenance: UK / wider Europe; sovereignty: not determined.

- Vendor: Proton AG (https://proton.me/business/vpn)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): UK / wider Europe
- Canonical page: https://whats-best.ai/software/business-vpn/proton-vpn-business
- Alternatives: https://whats-best.ai/software/business-vpn/proton-vpn-business/alternatives ([markdown](https://whats-best.ai/software/business-vpn/proton-vpn-business/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-05 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Proton AG
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

Proton VPN for Business is a gateway VPN from Proton AG in Geneva: clients egress through shared servers or leased dedicated IPs and private gateways in 20+ countries, on WireGuard or OpenVPN, under single sign-on, SCIM and enforced two-factor. Its strongest showing is pricing transparency, scored 7 to 8: four tiers are public, from VPN Essentials at €6.99/user per month (minimum 2 users) to Workspace Standard at €12.99/user per month, with dedicated IPs at +€39.99/month per IP. Identity and policy clustered at 6, credited for SCIM-mirrored groups and instant revocation. Visibility and audit is weakest, clustered at 5: monitoring is opt-in and off by default, retention periods are not published, and the SIEM connector names no tool. The judges differed on access and connectivity (4 to 6) — the DevOps engineer marked down the exit-based model of whitelisting a dedicated IP at the perimeter rather than connectors into your own network — and on sovereignty (5 to 7), where the same unanswered question of where account data and logs are hosted was weighed differently.

**Speaks for it:**
- Pricing transparency scored 7 to 8, with four public per-user tiers and the dedicated IP add-on priced at +€39.99/month per IP.
- Identity and policy clustered at 6 on single sign-on with Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 provider, SCIM automatic group sync and instant revocation.
- A documented Microsoft Intune rollout for the Windows client with always-on enforcement, judged deployable by a non-specialist team.
- Open-source apps in public repositories, ISO 27001 and SOC 2 Type II stated, and a bug bounty with legal safe harbor under a published disclosure policy.
- Subprocessors listed by name with location and transfer guarantees, under Proton AG in Geneva with an EU representative in Luxembourg.

**Held against it:**
- Activity monitoring is opt-in and off by default, so the audit trail exists only if it was switched on before an incident.
- Access is granted per gateway, dedicated IP or shared server rather than per application, with no public information on connectors behind a customer firewall or site-to-site links into cloud networks.
- No audit report or auditor summary is published, and we found no public information on a status page, incident history or documented control-plane failover.
- The terms state the SLA section does not apply to the Dedicated IP feature of Proton VPN Business and Enterprise subscriptions.
- We found no public information on device posture checks such as disk encryption or EDR status gating a connection.

**Best for:**
- You need a fixed IP to whitelist at supplier portals or other IP-sensitive services, priced publicly at +€39.99/month per IP.
- Your team already runs Okta or Microsoft Entra ID and wants leavers deprovisioned automatically through SCIM.
- You want a Swiss contracting entity with a published data processing agreement and a named subprocessor list with transfer guarantees.
- A small IT team needs a scripted Intune rollout with always-on enforcement it can run without specialists.

**Avoid if:**
- You need connectors into your own networks without inbound firewall rules, or site-to-site links between sites or into cloud networks.
- You need audit logging on by default, with named SIEM destinations and published retention periods, for compliance evidence.
- Your business depends on the dedicated IP feature being covered by an SLA.
- You need access controlled per application rather than per gateway, dedicated IP or shared server.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3/5 | 2/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Identity, access policy & device posture | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Logs, audit trail & incident response | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Deployment, API & administration | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 |
| Architecture, reliability & security assurance | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 3/5 |
| European sovereignty | 2.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3/5 |
| Pricing transparency | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 |
| **Weighted verdict** | **3/5** | **2.5/5** | **3/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Anonymous reports: yes [S21]
- Certifications: yes · yes · yes · yes [S3]
- Data disclosure: binding request from Swiss authorities [S9]
- DPA: yes [S12]
- E2ee disclosure: no [S9]
- Frameworks: HIPAA · CCPA · GDPR [S1]
- GDPR: yes [S6]
- GDPR: yes · yes [S9]
- GDPR: yes [S12]
- GDPR HIPAA: yes · yes [S7]
- ISO 27001: yes [S6]
- ISO 27001: yes [S11]
- Open source: yes · yes [S11]
- Open source audited: yes · yes [S2]
- Researcher safe harbor: yes [S11]
- Security report email: security@proton.me [S21]
- Security report pgp encryption: yes [S21]
- SOC 2: yes [S6]
- SOC 2 audit open source: yes · yes · Switzerland · yes [S14]
- SOC 2 reference: customer case study references SOC2 certification process [S1]
- SOC 2 type2: yes [S11]
- Standards: GDPR · HIPAA · CJIS · PCI · SOC 2 · ISO 27001 [S2]
- Swiss law: yes [S6]
- Third party vulnerability sharing: Vulnerability reports may be shared with affected vendors; researcher identities not shared without permission [S21]
- Vulnerability acknowledgement days: 5 [S21]
- Vulnerability disclosure embargo days: 120 [S21]

**Data**
- Account creation: no [S9]
- Analytics: yes · yes · no [S9]
- Authentication logging: yes · yes [S9]
- Credit card retention: name · last 4 digits · no [S9]
- Ip logging: no [S9]
- Location tracking: no [S9]
- Paid accounts always active: yes [S8]
- Payment: credit card · PayPal · Stripe · Bitcoin · name and last 4 digits of credit card only · Chargebee [S9]
- User rights: access · edit · delete · export [S9]

**Hosting**
- Company address: Switzerland · Proton AG [S3]
- Company address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S20]
- Contracting entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S5]
- Legal jurisdiction: Switzerland [S12]
- Regional gateways: yes [S14]
- Swiss privacy no logs: Switzerland · yes [S13]
- Swiss protection: Switzerland [S11]

**Integrations**
- API: API integrations [S5]
- Github repos: Mail · Calendar · VPN · Pass · Drive · Lumo [S11]
- Intune dependency auto install: Intune app dependency: automatically install existing Proton VPN Windows app [S19]
- Intune win32 app install command: PowerShell install script executed via Intune Win32 app package [S19]
- Pgp email clients: Outlook · Apple Mail · Thunderbird · yes [S12]
- Sentinel: Proton Sentinel advanced account protection included in Professional and VPN/Pass plans [S7]
- SSO SCIM providers: yes · yes · yes · Okta · Microsoft Entra ID [S5]

**Legal**
- Company name and address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · Switzerland [S19]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S1]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S6]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S7]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S11]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S15]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S16]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S2]
- Entity address: Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · Proton AG [S4]
- Entity address: Proton AG · Geneva, Switzerland [S12]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S14]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S22]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S13]
- Entity agreement: Entity binding on agreement; organization responsible for users' acceptance and enforcement measures [S8]
- Entity name: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S21]
- EU representative: Proton Europe sàrl · rue de Grünewald 94, L-1912 Luxembourg [S9]
- Governing law: courts of the Canton of Geneva · Switzerland [S8]
- Last modified: 12th May 2026 [S9]
- Minimum age: 13 · yes [S8]
- Modifications: yes [S9]
- Operating entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · Switzerland [S9]
- Ownership: non-profit Proton Foundation based in Switzerland [S8]
- Proton entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S18]
- Swiss privacy: Switzerland [S2]
- Terms last modified: 2026-10-09 [S8]
- Wallet operator: independent terms of use · Proton Financial AG · subsidiary of Proton AG [S8]

**Pricing**
- Anonymous payments: cash · Bitcoin [S9]
- Billing cycles: yes · monthly · yearly · bi-yearly [S8]
- Business plan scope: plans at proton.me/business/plans · "Workspace" plans [S8]
- Business plans tax: no · yes [S8]
- Credit expiry: 24 [S8]
- Dedicated ip addon: 39.99 [S7]
- Downgrade to free: optional automatic downgrade to free; delinquent restricted state if over free limits [S8]
- Early termination: remainder of payment due for agreed term [S8]
- Enterprise: Enterprise custom plan with dedicated account manager, contact sales [S7]
- Essentials: VPN Essentials · 2 · 6.99 [S7]
- Essentials billing: 2 · 167.76 [S7]
- Free trial: yes [S6]
- Moneyback: 30 · money-back guarantee [S2]
- Moneyback: 30 [S7]
- Msp agreement components: program fee · price per admin seat · price per managed license · potentially maximum number of admin seats [S20]
- Msp fee waived during pilot: yes [S20]
- Price change renewal: yes [S8]
- Professional: VPN Professional · 2 · 9.99 [S7]
- Professional billing: 2 · 719.64 [S7]
- Proration: yes [S8]
- Refund 30 days: cash or bank transfers not refundable · one refund per user · direct purchases only · processed within 30 days · 30 [S8]
- Trial business: business users on Business plans · yes · yes [S8]
- Vpn cancellation notice: Proton VPN Essentials · Proton VPN Business · Proton VPN Enterprise · 30 [S8]
- Vpn pass billing: 3 · 875.52 [S7]
- Vpn pass professional: VPN and Pass Professional · 3 · 10.99 [S7]
- Workspace billing: 12 months · 155.88 [S7]

**Product**
- 2FA enforcement: yes [S1]
- 2FA enforcement: administrators and/or all users · yes [S16]
- 2FA reminders: verified email address · yes [S16]
- 2FA reporting: yes [S16]
- Access policies: advanced access policies and IP whitelisting [S1]
- Access policy workflow: Define access policies · Authenticate users · Establish secure access · Monitor and manage [S3]
- Access revocation: yes [S3]
- Account event visibility: yes [S18]
- Activity monitor details toggle: Device · IP · ISP · Location [S18]
- Activity monitor event types: Accounts · Organization · VPN Gateways [S18]
- Activity monitor export CSV: yes [S18]
- Activity monitor logged fields: User · Event type with timestamp · Device name and app version · IP address · ISP (optional) · Location (optional) [S18]
- Activity monitor opt in: no [S18]
- Activity monitor plans: VPN Professional · VPN and Pass Professional · Workspace [S18]
- Activity monitor search filter: time range · name · email address [S18]
- Admin dashboard: yes [S3]
- Admin panel: yes [S2]
- Admin role inheritance: current and future members of a group automatically gain the role's accesses and permissions [S15]
- Admin roles plans: VPN Professional · VPN and Pass Professional · Workspace bundle · yes [S15]
- Admin simplicity: Single IT manager can manage from one control panel [S4]
- Alias deletion limit: yes · 1 [S8]
- Alternative routing: yes · yes [S9]
- Alwayson deployment methods: Windows app (install script) · platform script [S19]
- Alwayson plan requirement: yes · qualifying Proton VPN Business plan [S19]
- Alwayson platform script limitations: No built-in detection and retry · harder to track installs across organization [S19]
- Alwayson windows requirements: Windows 10 build 19041+ · 64-bit · 1 [S19]

**Subprocessors**
- Atlassian: Atlassian Pty Ltd · customer support data storage · European Union · United States · United Kingdom · Adequacy decision · Standard Contractual Clauses · Certifications [S9]
- Chargebee: Chargebee, Inc. · payment data · United States · Standard Contractual Clauses · Data Processing Agreement [S9]
- Group: ProtonLabs DOOEL Skopje · customer support requests · Macedonia [S9]
- Group taiwan: ProtonLabs Taiwan Co., Ltd · customer support requests · Taiwan (R.O.C) [S9]
- Hubspot: Hubspot, Inc. · Sales team contact form data processing [S9]
- Paypal: PayPal group · payment data · United States · Singapore · Standard Contractual Clauses · Data Processing Agreement [S9]
- Stripe: Stripe, Inc. · payment data · United States · Standard Contractual Clauses · Data Processing Agreement [S9]
- Zendesk: Zendesk, Inc. · customer support data · United States · Standard Contractual Clauses · Binding Corporate Rules · Certifications [S9]

**Support**
- Account manager: yes [S7]
- Availability: customer support [S5]
- Bug bounty: yes [S11]
- Business priority: 6 · yes [S11]
- Channels: yes · yes [S7]
- General contact email: contact@proton.me [S19]
- General contact email: contact@proton.me [S20]
- Hours: yes · 24/7 [S7]
- Intune alwayson deployment: Microsoft Intune · Always-on VPN · Windows · yes [S19]
- Legal contact email: legal@proton.me [S19]
- Live chat processor: Zendesk Inc [S9]
- Msp setup via sales team: sales team [S20]
- Partnerships contact email: partners@proton.me [S19]
- Related vpn business docs: Always-on VPN: Enforce VPN use across your organization · How to request web filtering for your organization · SIEM connector integration · Proton VPN and MDM [S18]
- SLA exclusions: factors outside Company's control · user/third-party actions · user equipment · suspension/termination · announced scheduled maintenance · Dedicated IP of Proton VPN Business and Enterprise [S8]
- Vulnerability disclosure: yes [S11]

129 more facts on the canonical page: https://whats-best.ai/software/business-vpn/proton-vpn-business

## Questions

### Is Proton VPN for Business European?

Yes, though not from the EU. whats-best.ai classifies Proton VPN for Business as UK / wider Europe.

### Where does Proton VPN for Business store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Proton VPN for Business have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to Proton VPN for Business?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Proton VPN for Business alternatives](https://whats-best.ai/software/business-vpn/proton-vpn-business/alternatives).

## Head-to-head

- [Proton VPN for Business vs Cloudflare Zero Trust](https://whats-best.ai/compare/cloudflare-zero-trust-vs-proton-vpn-business.md)

## What this page leaves out

- 5 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.

## Sources

- [S1] Vendor homepage (product page): https://proton.me/business/vpn (checked 2026-11-05)
- [S2] Features page: https://proton.me/business/vpn/features (checked 2026-11-05)
- [S3] Features page (access management): https://proton.me/business/vpn/access-management (checked 2026-11-05)
- [S4] Features page (zero trust network access): https://proton.me/business/vpn/ztna (checked 2026-11-05)
- [S5] Features page (enterprise): https://proton.me/business/vpn/enterprise (checked 2026-11-05)
- [S6] Compliance page: https://proton.me/business/vpn/compliance (checked 2026-11-05)
- [S7] Pricing page: https://proton.me/business/vpn/pricing (checked 2026-11-05)
- [S8] Terms of service (names the operating company): https://proton.me/legal/terms (checked 2026-11-05)
- [S9] Privacy policy: https://proton.me/legal/privacy (checked 2026-11-05)
- [S10] Data processing agreement (dpa): https://proton.me/legal/dpa (checked 2026-11-05)
- [S11] Security / trust page: https://proton.me/business/trust (checked 2026-11-05)
- [S12] GDPR page: https://proton.me/business/gdpr (checked 2026-11-05)
- [S13] Access model & connectivity — found from sitemap: https://proton.me/business/vpn/dedicated-ip (checked 2026-11-05)
- [S14] Access model & connectivity — found from sitemap: https://proton.me/business/vpn/remote-access-vpn (checked 2026-11-05)
- [S15] Identity, access policy & device posture — found from sitemap: https://proton.me/support/vpn-groups (checked 2026-11-05)
- [S16] Identity, access policy & device posture — found from sitemap: https://proton.me/support/vpn-require-2fa (checked 2026-11-05)
- [S17] Logs, audit trail & incident response — found from sitemap: https://proton.me/support/vpn-siem (checked 2026-11-05)
- [S18] Logs, audit trail & incident response — found from sitemap: https://proton.me/support/vpn-activity-monitor (checked 2026-11-05)
- [S19] Deployment, API & administration — found from sitemap: https://proton.me/support/mdm-always-on-vpn-intune-windows (checked 2026-11-05)
- [S20] Deployment, API & administration — found from sitemap: https://proton.me/support/getting-started-msp-pilot (checked 2026-11-05)
- [S21] Architecture, reliability & security assurance — found from sitemap: https://proton.me/security/vulnerability-disclosure (checked 2026-11-05)
- [S22] Architecture, reliability & security assurance — found from sitemap: https://proton.me/security/response-center (checked 2026-11-05)

---

Cite as: whats-best.ai, "Proton VPN for Business — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/proton-vpn-business

Corrections: https://whats-best.ai/correct/1595?target=page