Comparison
A device VPN is right when you need full device or network access. BusinessProxy is right when the job is controlled browser-based work: work domains, approved egress, session accountability and no OS-level tunnel.
On unmanaged devices, BusinessProxy does not stop someone from using another browser or profile. If bypass prevention matters, validate the browser-extension package through customer-managed browser or device policy before rollout.
| Capability | BusinessProxy | Device VPN |
|---|---|---|
| Scope | Browser path managed by the BusinessProxy browser extension. | Whole-device network tunnel. |
| Install | Browser extension required; no OS agent. | OS-level VPN client/profile. |
| Non-browser traffic | Stays outside BusinessProxy path. | Typically routed or affected by VPN policy. |
| Personal apps/calls | Not touched by BusinessProxy. | Can be affected by routing/DNS/network policy. |
| Work sites and internal web apps mode | PAC can send approved work domains and published internal web apps through BusinessProxy while other domains stay direct. | Usually routes by network/DNS/split-tunnel rules. |
| Filtering | Domain, category, allow and deny policy without HTTPS content decryption. | Varies; some VPN/SASE stacks may inspect more deeply. |
| Private network access | Not for full private network access on browser path. | Good fit when full private network access is needed. |
| Admin revoke | Revoke browser proxy sessions. | Revoke VPN session/device profile depending on platform. |
| Bypass on unmanaged device | User can use another browser/profile or disable extension. | Depends on OS/device management. |
| Best fit | Contractors, BYOD work browsing, support/Ops SaaS, QA web testing. | Full network apps, device-wide posture, non-browser apps, broad internal access. |
VPNs are the right tool when you genuinely need full device-level access.
And vs Cloudflare Access?
Cloudflare Access is a strong broad ZTNA platform. BusinessProxy is intentionally narrower: per-user scoped sessions to specific apps, an access event log and one-click revoke, that work on any hosting without moving your DNS or origin behind a new provider — plus a Partner Access channel so SaaS/ERP/hosting providers can offer this to their own clients. We do not try to win a head-to-head on broad universal access.
FAQ
No. BusinessProxy does not install a device VPN and does not route the whole machine. It manages a browser path through the BusinessProxy browser extension. Non-browser traffic, local apps, calls and other browsers stay outside the BusinessProxy path.
Yes. Users need the BusinessProxy browser extension for a supported desktop browser. The point is that there is no OS-level agent and no device-wide VPN client. Enforced deployments require customer-managed browser or device policy validation.
Yes, outside the managed browser path. On an unmanaged device, a user can use another browser, another unmanaged profile, or remove/disable the extension. If bypass prevention matters, validate the browser package through customer-managed browser or device policy before rollout.
No. BusinessProxy is for accountable work browsing and controlled web testing. It is not an anonymity network, scraping platform, unblock tool, or way to evade terms or legal restrictions.
If the work happens in a managed browser, start with BusinessProxy. If the work needs the whole device or private network, use a VPN/ZTNA tool.