Bottom Line: The FTC Safeguards Rule does not require a financial firm to buy a VPN. It requires encryption of customer information in transit over external networks and multi-factor sign-in for anyone using an information system, and a VPN can support both. A VPN alone does not make a firm compliant. The plans below differ on dedicated IP, single sign-on and multi-factor controls.
What this page is for
This page is for an owner or compliance lead at a small financial firm choosing a business VPN. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. Other regulated fields have different rules; see best VPN for law firms, best VPN for healthcare and best VPN for MSPs.
We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The rules are linked under Resources. This is general information, not legal advice.
Does the Safeguards Rule require a VPN?
No. Section 314.4(c)(3) asks for encryption of customer information in transit over external networks, and a VPN is one way to do that for staff on home or public networks. Section 314.4(c)(5) asks for multi-factor authentication for any individual accessing any information system. Neither names a product. A VPN alone does not make a firm compliant, because the Rule is a written programme with a designated Qualified Individual, a risk assessment, vendor oversight and more.
What a VPN covers and what it does not
| Safeguards Rule item | What it asks | Does a VPN help? |
|---|---|---|
| Encryption in transit, 314.4(c)(3) | Encrypt customer information over external networks | Yes, for traffic through the VPN |
| Encryption at rest, 314.4(c)(3) | Encrypt stored customer information | No. This is disk and database encryption |
| Multi-factor sign-in, 314.4(c)(5) | MFA for any individual accessing any information system | Only if the plan enforces MFA or connects to your SSO |
| Access control, 314.4(c)(1) | Only authorized users, limited to what they need | Partly: an admin console that adds and removes people and restricts which systems each can reach |
| Monitoring, 314.4(c)(8) | Log and monitor authorized users’ activity | Partly: connection logs can feed it |
| Vendor oversight, 314.4(f) | Choose capable providers, contract for safeguards, review them | No. This is your process for any vendor, including the VPN company |
Is a consumer VPN enough for a small firm?
A fair question: a firm of three to ten people may wonder whether a consumer plan covering that many devices would be enough. It can cover encryption in transit, which is the part a VPN does. The Rule sets no seat floor, and a firm under 5,000 consumers is exempt from four parts of 314.4. It is not exempt from multi-factor sign-in, access control or vendor oversight, and that is where a per-person consumer plan is thin: it has no admin console to remove a leaver’s access, and its terms are not written for a firm’s vendor contract. If you hold customer information, a business plan gives you more to show a regulator.
Private funds and deal teams
An investment adviser to private funds follows a different text from the Safeguards Rule. The SEC’s Regulation S-P[1] covers broker-dealers, investment companies, funding portals, transfer agents and investment advisers registered with the SEC. The SEC’s release notes that the private fund vehicles themselves, such as funds relying on section 3(c)(1) or 3(c)(7) of the Investment Company Act, are not subject to it. The registered adviser is. Whether a particular adviser or fund is covered is a question for counsel.
The SEC adopted amendments on 16 May 2024[2]. They require a covered firm to keep written policies for an incident response program “reasonably designed to detect, respond to, and recover from unauthorized access”, and to notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, as soon as practicable and not later than 30 days after the firm becomes aware of the incident (with limited exceptions). The release also requires policies reasonably designed to make sure service providers protect customer information and tell the firm of a breach as soon as possible, and no later than 72 hours after they become aware of it.
| Item | What the SEC says | Does a VPN help? |
|---|---|---|
| Written safeguards and incident response | Policies and procedures for an incident response program | No. This is your written programme |
| Customer notice | When sensitive customer information is, or is likely to have been, accessed without authorization: as soon as practicable, not later than 30 days after awareness | No. This is a process |
| Service provider oversight | Policies reasonably designed to make sure providers protect customer information and report a breach within 72 hours | No. It is how you manage any vendor; whether a VPN company counts depends on its access to customer information |
| Staff reaching deal documents or investor records from hotel or airport Wi-Fi | The amendments do not name a VPN | Partly: a VPN encrypts the connection, and the data room or system has its own controls |
The compliance dates were staggered. The SEC’s compliance outreach page gives 3 June 2026 for smaller firms, which is 24 months after Federal Register publication. On the same count, larger entities’ 18 months ends on 3 December 2025; for a registered adviser, “larger” means $1.5 billion or more in assets under management, per the release. Check which applies to you.
Neither the amendments nor the SEC’s release name a VPN or require one. They require safeguards and an incident response programme. A VPN alone does not make an adviser compliant with Regulation S-P. Deal teams that travel are a reasonable reason to buy a business plan with an admin console and MFA, and the tool to ask about is the same set below.
Controls you can buy, and which plan has them
The controls a firm can switch on are dedicated IP or allow-listing (so a system accepts connections only from the firm’s fixed address), single sign-on (SSO, so access follows your staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Each vendor below says what its plans include, read on 8 October 2026.
| Provider | Dedicated IP or static IP | SSO | Price shown per user per month |
|---|---|---|---|
| NordLayer | Core and above | Listed | $11 (Core), yearly billing |
| Proton VPN for Business | Professional | Professional | From $9.99, appears to assume a multi-year term |
| GoodAccess | Every plan | Premium and Enterprise | $11 (Premium), yearly billing |
| Twingate | Enterprise add-on | Teams (Google); Business (Okta, Entra ID) | $5 (Teams), $10 (Business) |
GoodAccess and Twingate have no review page on VPN.com, so they are not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.
What to ask a VPN company before customer information goes through it
Section 314.4(f) means treating the VPN company as a service provider. In practice, ask:
- Which security reports or certifications do you hold, and can I see them? Ask for the report, not just the badge, and check its date.
- Is there a written agreement that requires you to keep customer information safe, and who signs it? The Rule asks for safeguards by contract.
- Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan at the vendors above.
- What does the vendor log, and for how long? Your own duty to monitor and log does not end with the vendor’s promise.
Final Verdict
| If this is your situation | Start with |
|---|---|
| You want a dedicated IP, SSO and MFA on a small-firm budget | NordLayer Core or Proton VPN Professional, as each vendor says. Compare the term you must commit to |
| You want a static IP on every plan and can do without SSO at the lowest tier | GoodAccess, as the vendor says |
| You already run Google or Okta sign-in and want it to gate access | Twingate, as the vendor says; check the static-IP add-on if you need one |
| A regulator or partner names a requirement | Get it in writing and match the plan to it. Your regulator, not this page, decides what counts |
The VPN is one control. Your written programme, devices, training and vendor contracts decide the rest.
References
- SEC. n.d. Regulation S-P. https://www.sec.gov/files/rules/final/2024/34-100155.pdf.
- SEC. n.d. adopted amendments on 16 May 2024. https://www.sec.gov/newsroom/press-releases/2024-58.
- SEC. n.d. SEC compliance outreach: Regulation S-P for small firms. https://www.sec.gov/newsroom/meetings-events/compliance-outreach-regulation-s-p-small-firms.
- ECFR. n.d. 16 CFR Part 314: Safeguards Rule. https://www.ecfr.gov/current/title-16/part-314.
- ECFR. n.d. 16 CFR 314.4: Elements. https://www.ecfr.gov/current/title-16/part-314/section-314.4.
- ECFR. n.d. 16 CFR 314.6: Exceptions. https://www.ecfr.gov/current/title-16/part-314/section-314.6.
- FTC. n.d. FTC: Safeguards Rule, what your business needs to know. https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know.
- ECFR. n.d. Appendix Appendix B to Part 364. https://www.ecfr.gov/current/title-12/chapter-III/subchapter-B/part-364/appendix-Appendix%20B%20to%20Part%20364.
- Nordlayer. n.d. NordLayer pricing. https://nordlayer.com/pricing/.