Business VPN software compared

A finance team needs its accounting vendor to see requests from one fixed address, and a dozen contractors need access to a few internal tools without sharing a password. Both problems point to a business VPN: a service that encrypts remote access, lets an administrator control who gets in, and can give the company an IP address that outside services can recognize. The five products on this page meet all three of those tests, and we checked every price and claim on the vendor's own website.

What the three tests mean

We required each product to show proof of three capabilities. The first is encrypted remote access, meaning traffic between a worker's device and the company's resources is encrypted by the service. The second is central user management, so an administrator can add and remove people from one place instead of handing out shared logins. The third is dedicated or static IP addresses, so that partners and cloud services can allow traffic from a known address.

The third test removed the most products. Many team VPNs and mesh networking tools offer encryption and user lists but no fixed address that belongs to the customer. Where a vendor's own pages did not show a static or dedicated IP, we left the product out. Tailscale and NetBird, for example, were left out because their pricing pages did not mention static or dedicated IP addresses. That says nothing about their quality as networking tools. It only means they do not clear this category's third test on the evidence we could check.

The five products at a glance

NordLayer, GoodAccess, Proton VPN for Business and Windscribe ScribeForce publish per-user prices. Cloudflare One does not publish prices and is sold through sales. Their approaches differ more than their price lists suggest.

NordLayer and GoodAccess are closest to a traditional business VPN with a cloud control panel. Proton adds identity provider connections and a large location list. Windscribe is the cheapest per seat and the plainest. Cloudflare is a broad zero trust platform in which a dedicated IP is one add-on among many, and it is aimed at larger companies.

What each one costs

NordLayer lists Lite at $8, Core at $11 and Premium at $14 per user a month, each with a five-user minimum, and the figures shown carry the annual-plan discount. Its Enterprise offer starts at $6 per user for teams of 200 or more. The dedicated IP server is not included in Lite, and Core and Premium require it at $40 a month.

GoodAccess charges $7 per user a month for Essential and $11 for Premium when billed annually, or $9 and $14 when billed monthly. Both have a five-user minimum. A dedicated gateway with a static IP is $49 a month, and Enterprise requires at least 50 users. It offers a 14-day trial.

Proton VPN for Business shows $6.99 per user a month for VPN Essentials and $9.99 for VPN Professional, both on annual billing with a two-user minimum. Its pricing page does not give a dedicated IP price and shows the text +$XX.YY where the figure should be. Windscribe charges $5 per seat a month with a five-seat minimum, and shared static IPs cost between $2 and $8 a month.

Cloudflare's plans page shows no prices. Its documentation says dedicated egress IPs are available only as an add-on to Zero Trust Enterprise plans, so budget through a sales conversation.

A worked example for ten users

The dedicated IP is where the totals diverge, because it is usually a flat charge for the company and not a per-user fee. Take a ten-person team that needs one fixed address and uses annual billing where a vendor shows it.

On NordLayer Core, ten users cost $110 a month and the required dedicated IP server adds $40, for $150. On GoodAccess Essential, ten users cost $70 and a dedicated gateway adds $49, for $119. On Windscribe, ten seats cost $50 and a shared static IP adds $2 to $8, for $52 to $58. Proton VPN Essentials would cost $69.90 a month for ten users before any dedicated IP, and that IP price is not published.

These totals use list prices from the vendors' own pages and leave out tax. NordLayer says VAT, sales tax and other taxes are calculated on top of its USD prices. All figures here are in US dollars, and a buyer outside the US may see different taxes, currencies or locations.

Shared and dedicated are different things

Windscribe prices its add-on as shared static IPs and says a wide range of shared and dedicated static IPs is available in key regions, without a separate dedicated price. Ask whether your address would be exclusive to you. Its own FAQ says the shared static IPs are needed only when internal tools require IP allowlisting, and that cloud services such as Google Drive or Microsoft 365 work with dynamic IPs.

NordLayer's page says a single dedicated IP is enough to protect an entire company and that the same address can be assigned to several team members. Cloudflare describes its dedicated egress IPs as static addresses assigned exclusively to one account, each with an IPv4 address and an IPv6 range tied to one data center. Ask any vendor whether the address is exclusive, where it sits, and what happens if that location fails.

Encryption claims you can check

Encryption is easy to claim and harder to compare. Proton says OpenVPN and IKEv2 connections use AES-256, and WireGuard connections use ChaCha20. NordLayer says it uses AES-256 and ChaCha20. Windscribe says AES-256 with OpenVPN, WireGuard and IKEv2. Cloudflare says its client encrypts and routes device traffic using WireGuard or MASQUE.

ChaCha20 is not a weaker alternative. WireGuard's protocol page lists ChaCha20 for symmetric encryption, Poly1305 for authentication and Curve25519 for key exchange. The practical question for a buyer is less about the cipher name than about who operates the gateways and how quickly the vendor patches them.

GoodAccess is the thinnest source on this point. Its site refers to a secure and private tunnel and to strong encryption but does not name a cipher on the pages we read. Ask for the cipher list in writing before you sign.

Why patching history matters

The US Cybersecurity and Infrastructure Security Agency issued Emergency Directive 24-01 on January 19, 2024, over vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure. The directive covered an authentication bypass, CVE-2023-46805, and a command injection flaw, CVE-2024-21887. A later supplemental direction told federal agencies to disconnect affected products by February 2, 2024.

That episode involved a product that organizations ran themselves. It shows why a VPN gateway facing the internet is a high-value target and why patch speed matters. A hosted service moves that patching work to the vendor, which is one reason the five products here are cloud managed. It also means you depend on the vendor's practices, so ask how and when customers are told about security fixes.

For IPsec deployments in particular, the National Institute of Standards and Technology published Guide to IPsec VPNs in June 2020. It explains how IPsec protects traffic at the network layer and how to configure IPsec and the Internet Key Exchange under different circumstances. It is a useful checklist if your IT team will connect offices to a hosted VPN.

Certifications and what they cover

NordLayer states that its systems are ISO 27001 certified and have passed a SOC 2 Type 2 audit. GoodAccess shows SOC 2 compliant and ISO 27001 certified badges on its site. We did not find a SOC 2 or ISO 27001 statement from Windscribe, Cloudflare or Proton on the pages we read, so their security fields on the product pages are left blank.

A badge on a marketing page is not a report. Ask for the current SOC 2 report under a nondisclosure agreement, check its audit period, and read the exceptions section.

User management in practice

Every product here has a way to add and remove people, but the depth differs. Windscribe lets an admin add or remove users from one dashboard, revoke access immediately and reassign the freed seat. It allows up to 500 users.

Proton says a single IT manager can handle everything from one control panel, and connects to Okta, Google Workspace, Microsoft Entra ID or any SAML 2.0 provider. NordLayer lists Entra ID provisioning and Okta support, plus OneLogin, JumpCloud and Google Workspace. GoodAccess says members can be invited by hand or provisioned from an identity provider with SSO and SCIM. Cloudflare's documentation lists seat management, SCIM provisioning and user logs.

If your company uses an identity provider already, the offboarding test matters most. Remove a test user in your directory and time how long the VPN takes to cut that person off.

Contract terms to read

NordLayer's pricing page says cancelling turns off automatic renewal at the end of the current period, with no refund for unused time. It also offers a 14-day money-back guarantee on the initial purchase. GoodAccess says annual plans can be upgraded at any time, but downgrades only take effect at renewal, and wire transfer is available for annual payments only.

Minimum seat counts are a quiet cost for very small teams. Four of the five products set a floor of two to five users, and GoodAccess and NordLayer both set five. A solo contractor who needs a fixed IP will pay for five seats on those two.

How to choose

A team of five to twenty that needs an allowlisted address and wants a plain control panel should compare NordLayer and GoodAccess first, using the ten-user totals above as a starting point. A team that already runs Okta or Entra ID and values a long location list can trial Proton, after getting the dedicated IP price in writing. A team with a tight budget and one internal server to reach can consider Windscribe, accepting that the IP is shared.

A larger company that wants a VPN, web filtering and device checks under one contract belongs in a sales conversation with Cloudflare. Ask for the dedicated egress IP price and the Enterprise plan terms before comparing it with the others.

What to test during a trial

• Connect from a home network, a hotel network and a phone hotspot, and confirm the same fixed address appears each time.
• Add the company IP to a partner's allowlist and confirm a test login succeeds only from the VPN.
• Remove a test user from your identity provider and time how long access takes to end.
• Ask each vendor for the cipher list, the most recent SOC 2 report and the dedicated IP price in writing.
• Check the billed total on the checkout page against the per-user price, since list prices and billed totals can differ.