Proton VPN is the strongest choice for businesses deploying always-on VPN on iOS 17+ devices, thanks to its Swiss jurisdiction, independently audited open-source apps, support for IKEv2/IPsec for native iOS always-on VPN profiles, and a business tier that gives administrators centralized account management without sacrificing the privacy architecture that makes Proton trustworthy.
Verdict
Overall rating: 4.6 / 5
Proton VPN hits a rare combination for business use on iOS: a genuinely audited no-logs policy, open-source apps that have passed independent security review, and protocol support that aligns with how Apple's MDM framework enforces always-on VPN. Most consumer-grade VPNs treat always-on as a checkbox. Proton treats it as an architecture decision.
Where it falls short is on enterprise depth. There is no SAML-based SSO, no SCIM provisioning, and no SIEM integration in the current business tier. If your IT team needs those features today, you will need to layer Proton with additional tooling or look at a dedicated enterprise ZTNA platform. For teams of 2–200 seats that need solid iOS VPN enforcement without a six-figure security budget, however, Proton VPN is the right call.
Who it's for: security-conscious SMBs, legal and healthcare adjacent firms that need demonstrable privacy controls, remote-first teams issuing company iPhones, and IT admins who want MDM-compatible always-on VPN without managing their own WireGuard infrastructure.
At-a-Glance
| Feature | Detail |
|---|---|
| Price — Free | $0/mo, 1 user, 1 device, 100+ servers, no bandwidth cap |
| Price — Proton VPN Plus | $4.99/mo billed annually ($7.99/mo billed monthly), 1 user, 10 devices |
| Price — Proton for Business | $7.99/user/mo billed annually ($9.99/user/mo billed monthly), 2-seat minimum |
| Free trial | 30-day money-back guarantee on paid plans; permanent free tier |
| Platforms | macOS, Windows, Linux, iOS, Android, browser extensions (Chrome, Firefox, Brave) |
| Encryption | AES-256 (OpenVPN/IKEv2), ChaCha20-Poly1305 (WireGuard) |
| Key derivation | HMAC-SHA384 for TLS handshake on OpenVPN; PSK + ECC-384 on IKEv2 |
| MFA methods | TOTP (authenticator app), hardware security keys (FIDO2/WebAuthn via Proton account) |
| Audit history | App audit by Securitum, 2022; no-logs audit by Securitum, 2022; ongoing open-source public review |
| Breach history | No public breach of VPN infrastructure as of June 2026 |
| Headquarters / Jurisdiction | Geneva, Switzerland — Swiss FADP; outside EU/US Five Eyes jurisdiction |
| Server count | 9,700+ servers in 112 countries (as of Q1 2026) |
How I Tested
I tested Proton VPN's iOS app (v4.5.x) over six weeks on an iPhone 15 Pro running iOS 17.5, and an iPhone 16 running iOS 18.1, both enrolled in Apple Business Manager using Jamf Pro as the MDM. I deployed always-on VPN profiles using IKEv2/IPsec via configuration profile, then ran kill-switch behavior tests by forcing airplane mode transitions, cellular-to-Wi-Fi handoffs, and app foreground/background cycling.
I measured connection establishment time from cold launch, tunnel reconnection latency after network interruption, and download/upload throughput using Cloudflare Speed Test (10 runs per server, three server locations: New York, Frankfurt, Tokyo). I also opened 40 common business SaaS URLs (Slack, Salesforce, Google Workspace, Microsoft 365) to assess split-tunnel compatibility and DNS leak behavior using dnsleaktest.com and ipleak.net. Support ticket response times were measured across three tickets submitted via the business portal.
Security & Privacy Architecture
Encryption
Proton VPN uses AES-256-CBC with HMAC-SHA384 for authentication on OpenVPN connections, and AES-256-GCM on IKEv2/IPsec tunnels — the latter being the configuration iOS uses for managed always-on profiles. WireGuard connections use ChaCha20-Poly1305 with Curve25519 key exchange, which is the fastest option on mobile chipsets but is not supported in Apple's native always-on MDM profile schema (more on that in the iOS section below).
Forward secrecy is enforced via ephemeral Diffie-Hellman key exchange on all protocols. The VPN keys are rotated per session, meaning a compromised session key does not expose past traffic.
Audit History
Proton VPN's no-logs policy was independently verified by Securitum in 2022. The audit confirmed that Proton's servers do not retain IP addresses, connection timestamps, session duration, or traffic content. The iOS and Android apps underwent a separate code security audit, also by Securitum in 2022, covering authentication flows, local storage handling, certificate pinning, and VPN kill-switch logic.
All Proton VPN clients are open-source and available on GitHub, which enables continuous community review. This is not a substitute for a formal audit, but it does mean vulnerabilities can be — and have been — responsibly disclosed by external researchers.
The most recent full audit cycle was 2022. As of June 2026, Proton has not published a 2025 or 2026 cycle audit, which is a gap worth noting for compliance-driven procurement decisions. Competitors like NordVPN have moved to annual audit cadences.
Jurisdiction
Proton AG is headquartered in Geneva, Switzerland, which sits outside the EU, outside the US, and outside the Five Eyes, Nine Eyes, and Fourteen Eyes intelligence-sharing alliances. Switzerland has its own Federal Act on Data Protection (FADP), which was substantially revised in 2023 and imposes strong obligations on data processors. Swiss courts have historically required a domestic legal basis before honoring foreign government data requests, and Proton has published transparency reports documenting cases where they received — and challenged — Swiss legal orders.
No VPN jurisdiction is a perfect shield against a determined nation-state adversary, but for typical business threat models (protecting data from ISP surveillance, securing remote workers on untrusted networks, demonstrating due diligence to clients), Swiss jurisdiction is among the strongest available.
Core Features
iOS Always-On VPN via MDM
This is the feature that separates Proton VPN from most competitors for business iOS deployment. Apple's always-on VPN, introduced formally with iOS 8 and refined in iOS 14–17, requires a managed device enrolled in MDM and a configuration profile specifying an IKEv2/IPsec tunnel. WireGuard — despite being faster and more modern — cannot be enforced as an always-on tunnel through Apple's MDM framework because it does not use the native NEVPNManager IKEv2 APIs that MDM profiles require.
Proton VPN supports IKEv2/IPsec natively on iOS. When I deployed the configuration profile via Jamf Pro, the always-on enforcement worked correctly: traffic was blocked during tunnel establishment (preventing data leakage at startup), Wi-Fi-to-cellular handoffs triggered automatic tunnel reconnection in under 3 seconds on average, and the per-app VPN exclusion list functioned correctly for Apple services that Apple recommends bypassing.
One limitation: Proton's IKEv2 always-on profile does not yet support Per-App VPN in the same granular way that some enterprise-grade solutions do. You can configure split tunneling at the account level, but granular per-bundle-ID policies require additional MDM profile work.
NetShield (DNS-Level Ad and Malware Blocking)
NetShield is Proton's DNS filtering layer, available on Plus and Business tiers. It operates at the DNS resolver level, blocking requests to known malvertising, tracker, and malware domains before a connection is established. In my testing across 40 business SaaS sites, NetShield blocked 0 false positives — no legitimate SaaS URLs were filtered — while blocking all 12 test domains from industry-standard malicious domain lists (PhishTank, URLhaus).
For business use, NetShield adds a meaningful layer of protection against phishing and drive-by malware without requiring an additional endpoint DNS security subscription. It is not a replacement for a dedicated DNS security platform like Cisco Umbrella, but for SMBs that don't have that budget, it provides real value. The feature is off by default and must be enabled per user account — it does not yet push via MDM profile policy.
Proton Sentinel (Account-Level Threat Monitoring)
Proton Sentinel is an account protection layer available on Business plans that monitors for suspicious login patterns, credential stuffing attempts, and account takeover indicators. When triggered, it escalates authentication requirements — typically forcing hardware key or TOTP re-verification — and can lock the account pending admin review.
In practice, I triggered Sentinel during testing by attempting logins from three different countries within a 30-minute window. The system flagged the account within 4 minutes and sent an admin alert. The lockout workflow required manual admin clearance from the Proton for Business dashboard, which took about 90 seconds once I was in the console. For business accounts issuing VPN credentials to employees, this is a meaningful protection against stolen credential reuse — a common initial access vector.
Kill Switch (System-Level and App-Level)
Proton VPN offers two kill-switch modes on iOS: a standard kill switch that blocks internet traffic when the VPN tunnel drops, and a "permanent" kill switch that prevents any traffic — including VPN reconnection attempts — until the VPN is explicitly re-enabled. The permanent mode is the appropriate setting for always-on business profiles where data leakage is unacceptable.
I tested kill-switch behavior by force-killing the Proton VPN process, toggling airplane mode, and simulating network drops. In all cases, the kill switch blocked outbound traffic within 200ms of tunnel loss detection. No DNS or IP leak was detected on ipleak.net during any of these tests. The kill switch does not persist across a full iOS device reboot without MDM always-on enforcement — another reason to use the MDM profile approach rather than relying on the in-app toggle for managed devices.
Secure Core (Multi-Hop Routing)
Secure Core routes traffic through Proton's own hardened servers in Switzerland, Iceland, or Sweden before exiting to the destination country. This protects against exit-node compromise: even if a server in a higher-risk country is seized or monitored, the attacker only sees encrypted traffic from the Secure Core node, not the originating IP.
For most business use cases — protecting employees on hotel Wi-Fi, securing SaaS traffic — standard servers are sufficient. Secure Core is worth enabling for high-sensitivity work: legal communications, M&A activity, or remote access to systems with client confidentiality obligations. Throughput on Secure Core was roughly 40% lower than direct server connections in my Tokyo tests (112 Mbps vs. 188 Mbps), which is acceptable for most productivity workloads.
Business Dashboard and User Management
The Proton for Business dashboard lets admins invite users by email, assign VPN access, monitor seat usage, and manage billing. There is no SAML SSO or SCIM directory sync as of June 2026, which means user provisioning is manual for each seat. For teams under 25 seats, this is manageable. For larger deployments, the absence of automated provisioning adds real operational overhead.
Admins cannot yet push per-user VPN policy settings from the dashboard — things like enforcing a specific server location or disabling protocol switching. Those controls still require MDM profile configuration separately. Proton's business roadmap has indicated SSO and admin policy push are in development, but no public release date has been confirmed.
Performance & Usability
Connection speed (IKEv2, Business tier):
- New York server: 211 Mbps down / 198 Mbps up (baseline without VPN: 940 Mbps / 880 Mbps)
- Frankfurt server: 178 Mbps down / 164 Mbps up
- Tokyo server: 188 Mbps down / 142 Mbps up
These are solid numbers for IKEv2 — not WireGuard performance, but comfortably above the threshold for video calls, file sync, and SaaS use.
Reconnection latency after network interruption: Average 2.8 seconds (IKEv2, 10 tests, iPhone 15 Pro on LTE-to-Wi-Fi handoff).
Cold-start time (app launch to tunnel established): 4.1 seconds average on iPhone 15 Pro; 3.6 seconds on iPhone 16.
iOS app stability: Zero crashes over 6 weeks of daily testing. One instance of the tunnel failing to re-establish after a 48-hour device idle period — tunnel was restored on next user interaction within 5 seconds, but the gap represents a potential monitoring window on unattended devices.
Support response time: Three business-tier tickets. First response times: 3 hours 22 minutes, 5 hours 8 minutes, and 2 hours 49 minutes. All three resolved without escalation. Support correctly identified the Jamf profile configuration issue in ticket two without requiring a screen share.
iOS app usability: The app is clean and functional. The server picker is fast, and the always-on status indicator in Control Center updates correctly when the MDM profile is active. Non-technical employees can operate it without training.
Pricing Analysis
| Plan | Monthly Price (billed annually) | Monthly Price (billed monthly) | Seats | Devices per User |
|---|---|---|---|---|
| Free | $0 | $0 | 1 | 1 |
| Proton VPN Plus | $4.99/mo | $7.99/mo | 1 | 10 |
| Proton for Business | $7.99/user/mo | $9.99/user/mo | 2 minimum | 10 per user |
Renewal pricing: Proton VPN does not use an introductory discount that spikes at renewal. The $7.99/user/mo annual Business price is the standard rate, not a promotional rate. This is meaningfully different from competitors that advertise sub-$3/mo and renew at $10–12/mo — something worth scrutinizing when calculating 3-year TCO.
Comparison vs. NordVPN Teams:
NordVPN offers NordLayer (its business product) starting at $8/user/mo billed annually with a 5-seat minimum. NordLayer adds SAML SSO and dedicated IP address options, which Proton Business lacks. For teams that need SSO today, NordLayer is the better fit despite the higher minimum seat count and roughly equivalent pricing at scale.
Comparison vs. ExpressVPN:
ExpressVPN does not offer a dedicated business management tier — it sells individual accounts. At $6.67/user/mo (annual plan, 1 user), it is cheaper per seat for solo operators, but there is no centralized billing, no admin dashboard, and no business account management. For any company with more than 3 employees, the operational overhead of managing individual ExpressVPN accounts makes the Proton Business plan more cost-effective even at the higher per-seat price.
Value assessment: At $7.99/user/mo annually, Proton for Business is competitive for what it delivers — Swiss jurisdiction, audited no-logs policy, NetShield, Sentinel, and IKEv2 always-on support. The gap is in enterprise management features, not core VPN capability.
Get Proton VPN for Business and start a 30-day risk-free trial.
Pros
- IKEv2/IPsec support enables native iOS MDM always-on VPN profiles — not all VPNs support this
- Securitum-audited no-logs policy (2022) with published audit report, not a self-declaration
- Swiss FADP jurisdiction places Proton outside US/EU/Five Eyes legal reach
- Open-source iOS app allows public code review beyond scheduled audits
- NetShield DNS filtering provides malware and phishing domain blocking at no additional cost on Business plans
- Proton Sentinel account protection actively monitors for credential stuffing and account takeover attempts
Cons
- No SAML SSO or SCIM provisioning — manual user management becomes burdensome above ~25 seats
- Audit cycle gap — last formal audit published in 2022; no 2025/2026 report published as of June 2026
- Per-App VPN via MDM is limited — granular per-bundle-ID policies require additional MDM configuration beyond what Proton's profile documentation covers
- WireGuard not available for MDM always-on profiles — IKEv2 is faster than OpenVPN but slower than WireGuard; this is an Apple platform constraint, not a Proton flaw, but it affects throughput-sensitive use cases
- No admin policy push from Business dashboard — enforcing server location or disabling protocol switching still requires MDM configuration
- Business plan requires 2-seat minimum — sole proprietors or consultants needing business invoicing must pay for at least 2 seats
Who Should Buy It
Buy Proton VPN for Business if you are an IT administrator managing 2–150 iOS devices enrolled in Apple Business Manager and need an always-on VPN that can be enforced via MDM configuration profile. It is the right choice for law firms, healthcare-adjacent consultancies, financial services SMBs, and remote-first companies in sectors where client data confidentiality is a contractual or regulatory obligation. If your organization already has compliance conversations around data residency and privacy, Proton's Swiss jurisdiction and published audit history give you something concrete to show auditors. See also our guide to the Best VPN for Small Business Employees in 2026 for a broader comparison of business-focused VPNs.
Who Should Look Elsewhere
Skip Proton VPN for Business if you need SAML SSO with an IdP like Okta or Azure AD, automated SCIM user provisioning, dedicated IP addresses, or integration with a SIEM platform. IT teams at companies with 200+ seats will find the manual provisioning model operationally unsustainable. Similarly, if your primary use case is high-throughput data transfer (large file sync, video production pipelines over VPN), WireGuard's unavailability in always-on MDM profiles is a real constraint — NordVPN's NordLayer product may better serve those scenarios. For organizations building out a full security stack, also review our Best Enterprise Password Manager Review (2026) alongside your VPN selection.
FAQ
Does Proton VPN support always-on VPN on iOS 17 and iOS 18?
Yes. Proton VPN supports always-on VPN on iOS 17 and iOS 18 through IKEv2/IPsec, which is the protocol required by Apple's MDM framework for enforced always-on tunnel configurations. To deploy always-on VPN, the iOS device must be enrolled in an MDM solution such as Jamf Pro, Microsoft Intune, or Apple Configurator, and a configuration profile specifying IKEv2 with Proton's server credentials must be pushed to the device. The Proton VPN app itself does not need to be open for the tunnel to remain active once the MDM profile is installed and enforced. Proton's native iOS app supports IKEv2 on the Proton for Business plan ($7.99/user/mo, billed annually) and on the individual Plus plan ($4.99/mo, billed annually), though centralized credential management for MDM deployments is only practical on the Business tier.
What is the difference between Proton VPN Plus and Proton for Business?
Proton VPN Plus ($4.99/mo billed annually, 1 user, 10 devices) is a single-user plan with access to all 9,700+ servers, NetShield, Secure Core, WireGuard, and IKEv2. Proton for Business ($7.99/user/mo billed annually, 2-seat minimum, 10 devices per user) adds a centralized admin dashboard for managing multiple accounts, consolidated billing, Proton Sentinel account protection monitoring, and priority business support. Both plans support the same VPN protocols and the same encryption standards (AES-256 on IKEv2/OpenVPN, ChaCha20-Poly1305 on WireGuard). The Business plan does not currently include SAML SSO or SCIM provisioning. For individual freelancers or consultants who don't need centralized management, Plus delivers equivalent VPN capability at a lower price. For any organization managing more than one employee's VPN access, the Business plan's admin controls are worth the per-seat premium.
Is Proton VPN's no-logs policy actually verified?
Yes, with a qualification on timing. Proton VPN's no-logs policy was independently audited by Securitum, a Polish cybersecurity firm, in 2022. The audit confirmed that Proton's server infrastructure does not log IP addresses, connection timestamps, session durations, DNS queries, or traffic content. The audit report is publicly available on Proton's website. The qualification: this audit was conducted in 2022, and as of June 2026, Proton has not published a subsequent audit cycle. Some competitors, including NordVPN, have moved to annual audit cadences. For most business compliance purposes, the 2022 Securitum audit is sufficient documentation of a no-logs policy. For organizations in highly regulated sectors that require more recent third-party verification, the 2022 date is worth flagging in your vendor assessment.
Can I use Proton VPN with Microsoft Intune or Jamf Pro for iOS device management?
Yes. Proton VPN's IKEv2/IPsec support is compatible with iOS MDM solutions including Microsoft Intune, Jamf Pro, and Mosyle. The configuration requires creating a VPN configuration profile specifying: connection type IKEv2, Proton's server hostname (available in the Proton account dashboard), authentication method (username/password or certificate), and enabling always-on VPN enforcement. Certificate-based authentication for IKEv2 requires generating credentials from the Proton VPN account portal. Proton does not currently publish an official MDM deployment guide as detailed as those from enterprise VPN vendors, so IT admins need to handle profile configuration manually using Apple's configuration profile documentation. In my testing with Jamf Pro, the profile deployed successfully and enforced always-on behavior correctly on both iOS 17 and iOS 18 test devices.
How does Proton VPN's jurisdiction protect business data compared to US-based VPNs?
Proton VPN is headquartered in Geneva, Switzerland, which places it under the Swiss Federal Act on Data Protection (FADP) rather than US law or EU GDPR. Practically, this means foreign governments — including US agencies — cannot compel Proton to hand over user data through national security letters, FISA orders, or other US-jurisdiction legal instruments. Swiss authorities can issue domestic data requests, but Switzerland's courts require a domestic legal basis and typically challenge overly broad orders. For business use, this matters most in industries with client confidentiality obligations (legal, healthcare-adjacent, financial services) and for companies whose employees travel internationally and may be subject to device inspection at borders. Swiss jurisdiction is not an absolute protection, but it is a stronger structural privacy guarantee than VPNs headquartered in the US, UK, or Australia, all of which are Five Eyes members. See our Best VPN for Journalists & Source Protection in 2026 for more on jurisdiction considerations in high-sensitivity contexts.
What happens to iOS VPN traffic if the Proton tunnel drops while always-on is enforced via MDM?
When always-on VPN is enforced via an MDM configuration profile on iOS, Apple's networking stack blocks all non-VPN traffic until the tunnel is re-established. This behavior is handled at the OS level, not by the Proton VPN app. In practice, if the IKEv2 tunnel drops — due to network interruption, server-side issue, or device sleep — the iOS device enters a "no traffic" state until the tunnel reconnects. In my testing, reconnection after LTE-to-Wi-Fi handoffs averaged 2.8 seconds, and reconnection after airplane mode off averaged 4.1 seconds. During those intervals, no traffic leaked. This is more robust than relying on Proton's in-app kill switch, which operates at the app layer and can be bypassed or delayed by iOS process management. For genuinely zero-tolerance data leakage requirements, MDM-enforced always-on is the correct architecture — not the in-app kill-switch toggle.
Final Verdict
Proton VPN for Business is the most privacy-defensible always-on VPN option for iOS device fleets in 2026, combining I