Proton VPN vs Xeovo

Compare Proton VPN and Xeovo on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: ExpressVPN

Proton VPN

Switzerland· VPN Services

Needs review

Shortlist Proton VPN when you want a Swiss Proton AG VPN with open-source clients, publicly linked Securitum no-logs infrastructure audits, Secure Core/Stealth, a real free tier, and optional Business SSO/SCIM inside the Proton suite. Skip when you need anonymous numbered accounts without email (prefer Mullvad) or first-class remote port forwarding/DDNS (prefer AirVPN).

Swiss-operated (Proton AG)Open-source clientsSecuritum no-logs auditsSecure Core double-hopFree unlimited-data tierBusiness SSO / SCIM

View listing Visit Website

Xeovo

Finland· VPN Services

Needs review

Shortlist Xeovo when you need a Finnish EU operator with WireGuard/OpenVPN plus a real stealth-proxy toolkit (AmneziaWG, multi-protocol obfuscation, Hysteria 2) and cash/crypto payment options. Skip when you require independent no-logs audits, port forwarding, dedicated IPs, or streaming reliability—prefer Mullvad or Proton VPN instead.

Finnish Xeovo OyWireGuard + OpenVPNStealth proxies + AmneziaWGCash & crypto paymentsAnnual transparency reports

View listing Visit Website

Highlighted rows differ between the two products.

Proton VPN vs Xeovo: Snapshot
Feature	Proton VPN	Xeovo
Country of origin	Switzerland	Finland
Category	VPN Services	VPN Services
Open source	Yes	No
Self-hosted	No	No
Headquarters	Switzerland	Finland
Legal entity	Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva); EU rep Proton Europe sàrl (Luxembourg)	Xeovo Oy (reg. no. 3233901-7), Rautiontie 5G 30, 00640 Helsinki, Finland
Governing law	Switzerland (vendor privacy/legal framework)	Finnish courts for unresolved disputes (terms of service)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	VPN/account infrastructure: Proton-owned/controlled servers; account data stated in CH/DE/NO; Secure Core owned in CH/IS/SE; global VPN exits with full-disk encryption. Support/payments processors include US-group Zendesk, Stripe, Chargebee, PayPal (and HubSpot for sales forms) per privacy policy—not the VPN tunnel path.	No public infrastructure/subprocessor register. Privacy policy claims stored personal data is not transferred outside the EEA. VPN and stealth exit nodes on status.xeovo.com include EU/EEA locations plus Australia, Brazil, Canada, Japan, Singapore, South Korea, and multiple US cities. Payment rails include global card networks, PayPal, and crypto; Xeovo states it does not store full card data.
Summary	Swiss Proton AG VPN with open-source clients, Securitum-audited no-logs infrastructure, Secure Core/Stealth, free unlimited-data tier, and Business SSO/SCIM packaging.	Finland-based Xeovo Oy VPN with WireGuard/OpenVPN plus stealth proxies (Shadowsocks, AmneziaWG, VLESS/VMess/Trojan, Hysteria) for censorship resistance, no-logs policy claims, and privacy-friendly payments.
Tags	privacy vpn no-logs open-source swiss free-tier business	privacy vpn no-logs finland wireguard censorship-bypass stealth-proxy

At a glance: Proton VPN vs Xeovo
At a glance	Proton VPN	Xeovo
HQ / entity	Proton AG, Plan-les-Ouates (Geneva), Switzerland	Not listed
Governance	Primary shareholder: non-profit Proton Foundation (vendor claim)	Not listed
Protocols	WireGuard, OpenVPN, IKEv2, Stealth	WireGuard, OpenVPN, AmneziaWG, Shadowsocks, VLESS/VMess, Trojan, Hysteria 2
Network (vendor)	20,000+ servers, 140+ countries (re-check live)	Not listed
Free tier	1 device, unlimited data, limited countries, no ads	Not listed
Paid consumer devices	Up to 10 simultaneous (typical Plus packaging)	Not listed
Open source	Official clients yes; not a self-host server product	No (uses open protocols; service not OSS)
Business	SSO, SCIM, dedicated IPs/gateways, DPA published	Not listed
HQ	Not listed	Helsinki, Finland (Xeovo Oy)
Legal entity	Not listed	Xeovo Oy, reg. 3233901-7
Timeline	Not listed	Public product history from April 2016
Network	Not listed	~27 countries / ~60 servers (vendor); live status map
Self-host	Not listed	No (SaaS VPN)
Commercial model	Not listed	Prepaid subscription; 5 devices; 30-day refund (limits apply)

Key capabilities: Proton VPN vs Xeovo
Key capabilities	Proton VPN	Xeovo
Swiss-operated (Proton AG)	Yes	Not listed
Open-source clients	Yes	Not listed
Securitum no-logs audits	Yes	Not listed
Secure Core double-hop	Yes	Not listed
Free unlimited-data tier	Yes	Not listed
Business SSO / SCIM	Yes	Not listed
Finnish Xeovo Oy	Not listed	Yes
WireGuard + OpenVPN	Not listed	Yes
Stealth proxies + AmneziaWG	Not listed	Yes
Cash & crypto payments	Not listed	Yes
Annual transparency reports	Not listed	Yes

Proton VPN

Audited no-logs on Proton-owned VPN infrastructure
Strict no-logs policy for VPN session activity (no traffic content, destination, or session metadata that identifies a user to a server, per published Securitum infrastructure reviews). Account data lives on Proton-controlled servers in Switzerland, Germany, or Norway; Secure Core machines are Proton-owned in CH/IS/SE. Suits privacy officers who need public audit PDFs, not NDA-only claims.
Secure Core double-hop via CH, IS, or SE
Paid Secure Core routes traffic through hardened Proton-owned entry servers in Switzerland, Iceland, or Sweden before the exit country—extra hop against network-level attacks if an exit were compromised. Adds latency; best for high-threat models, not every streaming session.
Stealth protocol and free-tier censorship tools
Stealth obfuscates the tunnel (TLS-over-TCP style) to reduce DPI/VPN-block detection and is available on Free as well as paid apps. Free plan: one device, unlimited data, no ads, limited country set, kill switch; paid unlocks multi-device, streaming profiles, Secure Core, and full NetShield packaging.
Open-source clients across major platforms
Official apps for Windows, macOS, Linux, Android, iOS, and browser extensions are open source on GitHub (ProtonVPN org) with third-party app security reviews published over time. Server-side VPN stack is not a public full OSS product—inspect clients and audit reports, not the entire backend.
NetShield DNS filtering and multi-protocol stack
NetShield is Proton's DNS-based blocker for ads, trackers, and malware domains (feature depth varies by plan). Protocols include WireGuard, OpenVPN, IKEv2, and Stealth; kill switch and leak protections are first-class client features for untrusted Wi-Fi.
Business org controls: SSO, SCIM, dedicated IPs
Proton VPN for Business adds organization admin, private gateways, dedicated servers/IPs, enforced 2FA, SSO, and SCIM provisioning (docs cover Okta/Google examples). Fits SMB remote access and policy control—not a numbered-account anonymity product.

Xeovo

WireGuard and OpenVPN with published crypto details
Official features page documents WireGuard (ChaCha20/Poly1305, Curve25519; ports 51280/53/80/443, AmneziaWG configs) and OpenVPN (AES-256-GCM, TLS 1.3, TCP 443 and UDP 1196). Suits teams that want modern defaults without proprietary tunnels—still validate leaks on your OS stack.
Stealth proxies for DPI and censorship resistance
Shadowsocks (+ v2ray plugin), VLESS/VMess (WS+TLS), Trojan (TLS/WS+TLS), AmneziaWG, and Hub-announced Hysteria 2.0 for networks that block plain VPN. Subscription generators target tested third-party clients; no SOCKS5. Availability claims for restricted countries are vendor status-matrix based.
Config generator, custom DNS, optional ad/tracker block lists
Built-in generators produce VPN and stealth subscription configs. WireGuard/AmneziaWG/OpenVPN can use custom DNS or Xeovo’s ad/tracker-blocking DNS (lists such as pgl.yoyo.org, AdAway, oisd). Useful for power users; block lists may break some sites.
Compact multi-region map with live P2P labels
Marketing cites ~27 countries / ~60 servers with quality-over-quantity positioning. status.xeovo.com shows per-node health and which VPN/stealth locations allow P2P. Five concurrent devices, unlimited bandwidth marketing, IPv6, WireGuard kill-switch—no port forwarding or dedicated IPs.
Privacy-oriented payments and optional email accounts
Accepts cash, Monero, Bitcoin, and Litecoin alongside cards and PayPal. Registration needs a username/password; email is optional for recovery and billing notices. Prepaid plans with a one-time 30-day money-back window (crypto refunds excluded per terms).

Assurance & compliance: Proton VPN vs Xeovo
Assurance & compliance	Proton VPN	Xeovo
Independent no-logs / security audit	Verified Multi-year Securitum infrastructure no-logs audits published with downloadable reports (see no-logs audit blog). Client app security reviews also published over time.	Not found Privacy policy claims detailed no-logs; annual Hub transparency reports are first-party only. No public third-party audit PDF located.
ISO 27001	Vendor claimed Proton announces ISO 27001 (May 2024) and links a certificate from the Trust Center; re-validate scope/certificate for your ISMS.	Not found
SOC 2 / SOC 3	Vendor claimed Trust Center and company blog assert SOC 2 Type II; obtain the report under your vendor process if required.	Not found
GDPR / EU data protection	Vendor claimed Swiss operator claims GDPR alignment; EU representative in Luxembourg; Swiss FADP also applies.	Vendor claimed Finnish controller Xeovo Oy; privacy policy cites GDPR and Finnish DPA (tietosuoja.fi); claims no transfer of stored personal data outside EEA.
US CLOUD Act exposure (indicative)	Partial No known US parent (Proton AG / Foundation). VPN designed no-logs on Proton paths. US-group processors for support/payments (Zendesk, Stripe, Chargebee, PayPal; HubSpot sales) raise indicative exposure for account identity data. Not legal advice.	Partial EU entity / no known US parent and claimed EEA storage for account data, but no public hosting/subprocessor list and public US exit locations. Residual exposure medium. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Public DPA published at proton.me/legal/dpa; confirm countersignature/process for your business SKU.	Not found No public B2B DPA download or subprocessor schedule found; privacy policy is consumer-oriented.
EU AI Act	Not applicable VPN connectivity product; separate Lumo AI offering is out of scope for this VPN entry.	Not applicable Consumer VPN/stealth-proxy service, not an AI system offering under typical AI Act scoping.

Considerations & known limitations: Proton VPN vs Xeovo
Considerations & known limitations	Proton VPN	Xeovo
US SaaS for support and payments	Medium Privacy policy lists Zendesk, Stripe, Chargebee, PayPal (and HubSpot for sales) as processors. This is not VPN traffic logging, but billing/support identity can leave the Swiss-only path—map to your transfer assessment.	Not listed
Global exit nodes outside EU/CH	Medium Large multi-country network means traffic can exit outside the EU depending on server choice. Strict residency policies need operational controls (allowed countries, Secure Core preferences), not HQ alone.	Not listed
Free tier capacity and country limits	Low Free is one device and a limited country pool; shared free capacity can mean slower peaks. Not a full substitute for paid multi-device org rollout.	Not listed
Account identity vs numbered anonymity	Low Standard Proton account (email or external address options) is not the same threat model as cash/number-only VPN accounts. Cash/Bitcoin payment options exist for paid plans but account recovery fields may still apply.	Not listed
ISO/SOC scope verification	Low ISO 27001 and SOC 2 Type II are vendor-asserted on Trust Center; procurement should confirm certificate/attestation scope covers the VPN services in use.	Not listed
No public independent no-logs audit	Not listed	High High-sensitivity buyers must treat no-logs and transparency reports as first-party claims. Demand external evidence or shortlist an audited peer.
Infrastructure and subprocessors not published	Not listed	Medium Without a DC/payment/email/hosting register, residual transfer and CLOUD Act analysis stays incomplete even with Finnish HQ and EEA storage claims for account data.
Optional US and other non-EU exit nodes	Not listed	Medium Status map includes multiple US cities and other non-EU locations. Choose EU exits deliberately when residency of tunnel egress matters.
No port forwarding or dedicated IPs; streaming weak	Not listed	Medium FAQ denies port forwarding and dedicated/residential IPs; major streaming services likely blocked. Hard blockers for some use cases.
Five concurrent devices; personal accounts	Not listed	Low Five simultaneous connections and terms against multi-person account sharing constrain household or team rollouts.

Fit

Proton VPN

Best fit when

Privacy-conscious individuals who want Swiss jurisdiction, open-source apps, and audited no-logs packaging
Users already on Proton Mail/Drive/Pass who want one account for VPN plus suite
People under network censorship who need Stealth (including on Free) and Secure Core on paid plans
SMBs needing managed VPN with SSO/SCIM, dedicated IPs/gateways, and a published DPA
Orgs that require downloadable third-party no-logs infrastructure reports rather than NDA-only claims

Poor fit when

Teams that require anonymous numbered accounts with no email (Mullvad-style)
Workloads whose primary need is multi-port remote forwarding and Dynamic DNS (AirVPN-style)
Policies that forbid any US-group SaaS for billing or support (Zendesk/Stripe/Chargebee/PayPal listed)
Buyers who need a fully self-hosted VPN control plane rather than Proton SaaS

Consider instead when

When: You need maximum account anonymity (no email identity)
Consider: Mullvad
Numbered accounts and cash/crypto-friendly privacy posture; less suite/Business packaging.
When: You need remote port forwarding and Dynamic DNS as core features
Consider: AirVPN
Technical inbound reachability; different product emphasis than Proton Free/Plus.
When: You want a large consumer network with different brand/jurisdiction tradeoffs
Consider: NordVPN or catalog peers such as CyberGhost
Re-check ownership, audit publication model, and streaming for your regions.
When: You need enterprise zero-trust mesh rather than a privacy VPN
Consider: Tailscale, NetBird, or self-hosted WireGuard
Different product class from consumer/privacy VPN.

Xeovo

Best fit when

Users under active DPI/censorship who need Shadowsocks, AmneziaWG, VLESS/VMess/Trojan, or Hysteria—not only plain WireGuard
Buyers who want a Finnish EU legal entity and GDPR-framed privacy policy with claimed EEA storage for account data
Privacy-oriented individuals who value optional email, cash/Monero/BTC/LTC payments, and prepaid subscriptions
Power users comfortable with config generators and third-party stealth clients rather than a single mega-app
Teams fine with a compact ~27-country map and live status/P2P labels instead of thousands of cities

Poor fit when

Procurement that requires independent no-logs audits, ISO 27001/SOC 2 evidence, and a public B2B DPA with subprocessors
Users who need port forwarding, dedicated/residential IPs, or reliable access to major streaming catalogues
Organisations standardising only on audited multi-hop or RAM-only infrastructure claims Xeovo does not publish
Households seeking a free tier or free trial (only prepaid + limited money-back)
Anyone who will treat vendor no-logs claims as verified without third-party evidence

Consider instead when

When: You need stronger anonymous-account culture and long-standing independent reputation
Consider: Mullvad
Better default when stealth protocols are secondary to audited privacy ops
When: You want a larger EU brand suite, free tier options, and deeper corporate security programme material
Consider: Proton VPN
Prefer for broader product integration and procurement packaging
When: You want simple Dutch consumer apps and lifetime packaging more than censorship tooling
Consider: GOOSE VPN
Different protocol story; fewer stealth-focused features

Open questions for due diligence

Proton VPN

Which current Securitum no-logs PDF applies to the server regions and features you will enable?
For Business, which subprocessors apply to your SKU and will Proton countersign the published DPA without material carve-outs?
Can org policy force EU/CH-only or Secure Core-only exits for all managed devices?
Do ISO 27001 / SOC 2 Type II reports' scope statements explicitly cover Proton VPN infrastructure used by your tenants?
If policy bans US payment processors, which payment methods (e.g. Bitcoin) meet your residual-risk tolerance?

Xeovo

Will Xeovo publish or provide under NDA a current infrastructure and subprocessor list (DCs, payment processors, email, CDN for stealth)?
Is an independent no-logs or application security audit planned or available on request?
For B2B: will Xeovo Oy sign a GDPR DPA with a named subprocessor schedule?
What exact retention periods apply to payment metadata, tickets, and WireGuard/proxy keys after account deletion?
Which official first-party apps (if any) ship kill-switch and DNS controls vs config import only per platform?