Best VPN for Law Firms

The ethics rule asks a firm for reasonable efforts to protect client information, not for a product. Here is what a small firm can buy that supports those efforts.

A traveler working on a laptop at an airport window at dawn

Question 1 of 2

What is behind the search for a VPN for your firm?

20,024 VPN picks made through VPN.com in the last 30 days

What the ethics rule asks of you

What the ABA rules ask of a firm that uses a VPN

What does the confidentiality rule ask for?

ABA Model Rule 1.6(c) says a lawyer must make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

The rule’s comment lists what counts when judging reasonableness: how sensitive the information is, how likely disclosure is without more safeguards, the cost of them, the difficulty of using them, and how much they get in the way of representing clients. It adds that a client may require special security measures.

  1. There is no fixed list.ABA Formal Opinion 477R (2017) says what is reasonable is not susceptible to a hard and fast rule. A lawyer may need special precautions when the client agreement or the law requires them, or when the information calls for a higher degree of security.
  2. A VPN is an example, not the standard.Opinion 477R names secure Wi-Fi, a virtual private network or another secure internet portal as ways to secure access. It also lists unique complex passwords, firewalls and multi-factor authentication to access firm systems.

General information, not legal advice. A VPN alone does not make a firm compliant with Rule 1.6. At most it supports the reasonable efforts the rule asks for.

What Opinion 498 says about remote work

ABA Formal Opinion 498 (March 2021) covers virtual practice. On connections, it says lawyers should make sure their routers are secure and should consider using a VPN when connecting over Wi-Fi.

  1. "Consider," not "must."The opinion does not require a VPN, and it names no product. Whether a VPN is warranted is a judgment about the sensitivity of the matter and the network.
  2. Personal devices need a policy.The opinion says a policy for lawyers and staff using their own devices should cover security measures such as access through a VPN, along with strong passwords, updates and phishing training.
  3. Check your state bar.State bars issue their own opinions on technology and confidentiality. Check yours before you rely on the ABA text alone.

A VPN alone does not make a firm compliant. It covers the connection, not the device, the password or the people.

Install the app on each laptop
Protected on home, hotel and airport Wi-Fi

By plan

Which plans include the controls

Read from each vendor’s own pages on 8 October 2026; NordLayer was read again on 29 October 2026. These are the vendors’ statements and list prices, not our verdict.

What you are comparingControls the firm can switch on, as the vendor saysPrice per user per month, as the vendor lists it
NordLayer CoreSays Core and above can add a dedicated-IP server and IP allow-listing; Lite cannot. Lists SSO and MFA.Lists $11 on yearly billing, 5-user minimum (Lite $8, Premium $14). A dedicated-IP server is +$40 a month.
Proton VPN ProfessionalSays Professional includes dedicated IPs in 20+ countries and SSO. Essentials enforces 2FA.Lists from $9.99, 2-user minimum. The price shown appears to assume a multi-year term.
GoodAccessSays every plan has a static IP for each gateway. SSO is on Premium and Enterprise only.Lists Essential $7 and Premium $11 on yearly billing, 5-user minimum.
Surfshark VPN for TeamsSays a dedicated IP is not a feature of VPN for Teams.Lists from $5.90 (Starter, 5-license minimum).
ExpressVPN for TeamsSays a dedicated-IP add-on is available on 1- or 2-year Teams plans. SSO not stated.No per-user price on its page; volume discounts only.

The risk, in numbers

Security incidents are common in law firms.

A VPN covers the connection, not the whole practice.

29%
of surveyed attorneys said their firm had a security breach, a broad term that includes a lost or stolen device
54%
said their firm has two-factor authentication available

Source ABA TechReport 2023, Cybersecurity (2023 Legal Technology Survey Report)

Our verdict

Controls a small firm can switch on

Our take: NordLayer is our pick to start with. It says Core and above can add a dedicated-IP server and IP allow-listing, and it lists SSO and MFA. No ABA text requires a VPN, so weigh the term and price against your own risk.

  • A dedicated-IP server and IP allow-listing on Core and above, as the vendor says.
  • SSO and MFA listed, with one admin console to add and remove people.
  • Core lists $11 per user a month on yearly billing, with a 5-user minimum.
NordLayer
  • G2 4.3/5Reviews: 126 · As of October 2026
  • Gartner Peer Insights 4.6/5Ratings: 104 · As of October 2026
  • Easy team rollout
  • Reliable connections
  • Every device encrypted

Why NordLayer is where we would start:

  • Dedicated IP and IP allow-listing on Core and above
  • Lists SSO and MFA
  • One admin console to add and remove people

What NordLayer lists:

  • Lite $8, Core $11, Premium $14 per user a month
  • Yearly billing, 5-user minimum
  • A dedicated-IP server is +$40 a month

Before you commit:

  • Whether your state bar adds its own test
  • The term you must commit to
  • That a VPN alone does not make a firm compliant
See NordLayer business plans

The full guide

The detail behind our pick

Bottom Line: The ABA texts we read do not require a law firm to buy a VPN. Model Rule 1.6(c) asks for reasonable efforts to protect client information, and Opinion 498 says lawyers should consider a VPN when connecting over Wi-Fi. A VPN alone does not make a firm compliant. The plans below differ on dedicated IP, single sign-on and multi-factor sign-in.

What this page is for

This page is for a partner or office manager at a small firm choosing a business VPN. It sits under our best VPN for business guide, which explains how a business VPN differs from a personal one. For larger organisations see the enterprise VPN guide. A medical practice faces a different rule; see best VPN for healthcare.

We do not run our own security tests. Every vendor-specific line below is what the vendor says on its own pages, with the date we read it. The ABA texts are linked under Resources. This is general information, not legal advice.

Does the ABA require lawyers to use a VPN?

No ABA text we read says so. Rule 1.6(c) sets a standard of reasonable efforts, and Opinion 477R says that standard is not a hard and fast rule. Opinion 498 says lawyers should consider using a VPN when connecting over Wi-Fi. A VPN alone does not make a firm compliant, and your state bar may add its own tests.

Rule 1.6(c) asks for reasonable efforts to prevent unauthorized disclosure of or access to client information. What counts as reasonable is how sensitive the information is, how likely disclosure is, the cost and difficulty of safeguards and how much they get in the way. Opinion 477R says there is no hard and fast rule; Opinion 498 says to consider a VPN on Wi-Fi

Controls you can buy, and which plan has them

The controls a firm can switch on are dedicated IP or allow-listing (so a system accepts connections only from the firm’s fixed address), single sign-on (SSO, so access follows your staff accounts) and multi-factor sign-in (MFA, a second proof beyond a password). Opinion 477R lists multi-factor authentication to access firm systems among available tools. Each vendor below says what its plans include, read on 8 October 2026.

ProviderDedicated IP or static IPSSOPrice shown per user per month
NordLayerCore and aboveListed$11 (Core), yearly billing
Proton VPN for BusinessProfessionalProfessionalFrom $9.99, appears to assume a multi-year term
GoodAccessEvery planPremium and Enterprise$11 (Premium), yearly billing
Surfshark VPN for TeamsNot a Teams featureNot statedFrom $5.90
ExpressVPN for TeamsAdd-on on 1- or 2-year plansNot statedNot listed

GoodAccess has no review page on VPN.com, so it is not linked internally. NordLayer has no review page either, so NordLayer links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say.

Opinion 498 on virtual practice: a VPN covers the connection, alongside a secure router, and the opinion does not require one. Strong passwords, updates, phishing training and a policy for personal devices cover the rest, and your state bar may add its own opinions

What to ask a VPN company before client files go through it

Opinion 477R says a lawyer should do due diligence on vendors providing communication technology, including checking references and credentials. In practice, ask:

  1. Which security reports or certifications do you hold, and can I see them? Ask for the report, not just the badge, and check its date.
  2. Is there a written data-processing or confidentiality agreement, and who signs it? Get it before client files cross the service.
  3. Which controls come with my plan? Dedicated IP, SSO and MFA enforcement are gated by plan at the vendors above.
  4. What does the vendor log, and for how long? Your own duty to protect client information does not end with the vendor’s promise.

Final Verdict

If this is your situationStart with
You want a dedicated IP, SSO and MFA on a small-firm budgetNordLayer Core or Proton VPN Professional, as each vendor says. Compare the term you must commit to
You want a static IP on every plan and can do without SSO at the lowest tierGoodAccess, as the vendor says
A plan has no dedicated IPSurfshark VPN for Teams says it has none; rule it out if your firm needs one
A client or insurer names a requirementGet it in writing and match the plan to it. The rule’s comment says a client may require special security measures

The VPN is one control. Your passwords, devices, supervision of staff and state bar rules decide the rest.

References

  1. Americanbar. n.d. ABA Model Rule 1.6: Confidentiality of Information. https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/.
  2. Americanbar. n.d. ABA Model Rule 1.6, Comment. https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/.
  3. Americanbar. n.d. ABA Formal Opinion 477R: Securing Communication of Protected Client Information. https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-477.pdf.
  4. Americanbar. n.d. ABA Formal Opinion 498: Virtual Practice. https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-498.pdf.
  5. Nordlayer. n.d. NordLayer pricing. https://nordlayer.com/pricing/.

Frequently Asked Questions

Does the ABA require lawyers to use a VPN?

No ABA text we read does. Rule 1.6(c) asks for reasonable efforts, and Opinion 498 says lawyers should consider using a VPN when connecting over Wi-Fi. Neither says must, and neither names a product. A VPN alone does not make a firm compliant. Your state bar may add its own rules.

What does ABA Model Rule 1.6(c) require of a law firm’s technology?

It requires reasonable efforts to prevent inadvertent or unauthorized disclosure of, or access to, client information. The rule’s comment lists factors: sensitivity, likelihood of disclosure, cost, difficulty and effect on representation. It names no technology. A VPN alone does not satisfy the rule; at most it supports those efforts.

What did ABA Formal Opinion 498 say about VPNs for remote lawyers?

Opinion 498 (March 2021) says lawyers connecting over Wi-Fi should make sure routers are secure and should consider using a VPN. It also says a policy for personal devices should cover access through a VPN. It says “consider,” not “must,” and it names no product.

Is a VPN enough to protect client confidentiality?

No. A VPN protects the connection, not the device, the password or the people. Opinion 477R also lists unique complex passwords, firewalls and multi-factor authentication to access firm systems. Rule 1.6(c) asks for reasonable efforts across all of that, judged by sensitivity, cost and difficulty. A VPN alone does not make a firm compliant.

Is it safe for a lawyer to work on public Wi-Fi?

It depends on the matter and the network. Opinion 498 says lawyers should make sure routers are secure and consider using a VPN when connecting over Wi-Fi. How much care a matter needs depends on how sensitive the information is, and a VPN protects the connection only. Check your state bar’s opinions too.

What does a business VPN cost a small law firm per lawyer?

At the vendors we read on 8 October 2026, list prices ran from about $5.90 to $11 per user per month on the plans in the table. NordLayer lists $11 for Core on yearly billing, and a dedicated-IP server is an extra monthly fee. Minimum seat counts and billing terms differ, so check each vendor.

Why would a law firm want a dedicated IP address on its VPN?

A dedicated IP gives the firm one fixed address, so a system can be set to accept connections only from it. NordLayer says Core and above can add a dedicated-IP server and IP allow-listing. Whether a given case-management or document system supports that is a question for its own vendor.

Do lawyers need multi-factor sign-in on a firm VPN?

No ABA text we read requires it for a VPN, but Opinion 477R lists multi-factor authentication to access firm systems among available tools. It adds a second proof beyond a password. NordLayer lists MFA, and Proton says it enforces 2FA on its Essentials plan.

What should a firm ask a VPN company before client files go through it?

Ask which security reports it holds and whether you can see them, whether a written confidentiality or data-processing agreement exists and who signs it, which controls your plan includes, and what it logs. Opinion 477R says to do due diligence on vendors providing communication technology.

Can a lawyer use a consumer VPN for client work?

A consumer VPN may protect a connection, but it is sold per person, while the firm-wide controls in the table belong to team and business plans. Rule 1.6(c) asks for reasonable efforts, and cost is one factor. For client work, a plan with dedicated IP, SSO and MFA gives a firm more to point to.