Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Proton VPN

VERIFIED
Founded 2014 · protonvpn.com ↗

CERN-founded Swiss VPN (Proton AG, Geneva), owned by non-profit Proton Foundation; 15,000+ servers, audited no-logs, open-source apps, free tier.

In short

Proton VPN, in the VPN category, is an EU-owned service with Switzerland as its hosting location and no identified CLOUD Act exposure.

Assessment notes

Proton VPN, operated by Proton AG in Plan-les-Ouates, Geneva, is owned primarily by the non-profit Proton Foundation (Swiss-registered, CHE-418.863.304). Founders Andy Yen, Jason Stockman, and Dingchao Lu (CERN alumni) donated their shares in 2024, structurally protecting Proton from US-PE acquisition; account data is encrypted and stored exclusively in Switzerland, Germany, or Norway, Proton owns and operates its Secure Core servers and most Swiss/German nodes, the no-logs policy has been independently audited and published, transparency reports and warrant canary are public, all apps are open-source. Swiss-jurisdiction, non-profit-owned, with a public DPA (proton.me/legal/dpa), no CLOUD Act exposure: the US support/payment sub-processors (Zendesk, Stripe, PayPal, Chargebee) are ancillary and off the service-data path, never touching user traffic or encrypted data (Proton runs its own infrastructure), so under a data-at-rest definition CLOUD Act exposure is none, and the strongest ownership and transparency signal set in this category.

CLOUD ACT
OWNERSHIP
SUB-PROCS
7 · 4 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
  • Card-free payment available
    Accepts Bitcoin and cash by mail alongside cards.
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Proton VPN

Proton VPN is part of the Proton privacy-tech group operated by Proton AG (Plan-les-Ouates, Geneva, Switzerland) and is the structurally strongest VPN listing in this directory by procurement-grade criteria. Founded in 2014 by Andy Yen, Jason Stockman, and Dingchao Lu (scientists who met at CERN), Proton has run a privacy-by-default product portfolio (Mail, VPN, Drive, Calendar, Pass) for over a decade. In 2024, the founders and first employee donated their controlling shares to the newly-established Proton Foundation, a non-profit registered in Geneva (CHE-418.863.304) which now serves as the primary shareholder of Proton AG. The foundation structure permanently protects Proton from venture-capital acquisition or US private-equity takeover, a unique ownership architecture in the EU/CH privacy-tech landscape.

Compliance posture is gold-standard. Switzerland holds an EU adequacy decision under Art. 45 GDPR, so transfers between EU and CH require no SCCs. The privacy policy (last updated 30 July 2025) commits that account data is encrypted and stored exclusively in Switzerland, Germany, or Norway; Proton owns and operates its Secure Core servers and most Swiss/German VPN nodes; all servers feature full-disk encryption with no stored logs or user data. The no-logs policy has been independently audited and published (a differentiator vs nearly every other VPN brand that claims no-logs without an audit), and Proton publishes a public transparency report plus a warrant canary documenting law-enforcement requests. All consumer apps are 100% open-source.

The product covers 15,000+ servers across 140+ countries, supports up to 10 simultaneous device connections on paid plans, and offers Secure Core (multi-hop through Swiss / Icelandic / Swedish fortified servers), NetShield ad/tracker/malware blocking, port forwarding, P2P/BitTorrent-friendly servers, streaming-unblock servers, and Tor-over-VPN. The free tier is uncommonly generous: one device, medium speed, servers in 10 randomly-selected countries, no data limits, no artificial speed throttling, no ads, and full privacy guarantees. VPN Plus is the paid entry tier with multi-currency (CHF / EUR / USD); spring-sale 1-year discounts up to 65% have been advertised. Best fit: privacy-maximalist consumers, journalists, activists, EU SMBs, and any organisation needing the strongest possible ownership-and-jurisdiction guarantees in a VPN provider.

SUB-PROCESSORS

Sub-processor map · 7

Source ↗
  • Chargebee, Inc. US
    United States

    Payment data processing; ancillary

  • PayPal group US
    United States

    Payment data processing; ancillary

  • Stripe, Inc. US
    United States

    Payment data processing; ancillary

  • Zendesk, Inc. US
    United States

    Customer support data processing; ancillary

  • Atlassian Pty Ltd non-US
    Australia

    Customer support data storage

  • ProtonLabs DOOEL Skopje non-US
    North Macedonia

    Customer support / direct communications (Proton group entity)

  • ProtonLabs Taiwan Co., Ltd non-US
    Taiwan

    Customer support / direct communications (Proton group entity)

4 of 7 sub-processors are US-incorporated. These are ancillary processors that do not hold protected customer data, so they do not change the assessment. CLOUD Act exposure is rated none.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-11).
FEATURES

Capability matrix

Servers 20000 servers
Countries 140 countries
Simultaneous devices 10 devices
Protocols WireGuard OpenVPN IKEv2
Kill switch Yes
Audited no-logs Yes
Port forwarding Yes
Platforms iOS macOS Windows Android Linux
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
PRICING

Pricing & tiers

FREEMIUM
from €5/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

  • Data Processing Addendum (DPA)
    proton.me/legal…
    Open ↗
  • Sub-processors list
    protonvpn.com/privacy-policy…
    Open ↗
  • Terms of Service
    protonvpn.com/terms-and-conditions…
    Open ↗
ALTERNATIVES

Alternatives in this category

AirVPN
Italy · Founded 2010
EU-SOVEREIGN

Italian hacktivist-founded VPN (Perugia, 2010), no-logs, port forwarding, but no longer serves Italian residents (Piracy Shield).

Public DPA Sub-processors Open source
FROM
€7/mo
CLOUD ACT
NONE
AzireVPN
Sweden · Founded 2012
EU-HOSTED

Swedish privacy VPN (Stockholm, est. 2012): Blind Operator, RAM-only, audited no-logs; acquired by Malwarebytes (US) 7 Nov 2024.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
CyberGhost
Romania · Founded 2011
EU-BASED

Romanian-operated VPN (CyberGhost S.R.L., 2011) under Kape Technologies (UK; ex-Crossrider) → Unikmind/Teddy Sagi (IM) since 2023; listed as a warning.

Public DPA Sub-processors Open source
FROM
€2/mo
CLOUD ACT
MINOR