How the route works
With a normal connection, your device connects to one VPN server, and that server talks to the website. With Secure Core, traffic first enters one of Proton's Secure Core servers and then leaves through a second server in the exit country you pick. Proton's stated goal is to limit the damage if an exit server is compromised, especially in higher-risk countries. An observer at the exit can trace traffic back only to the edge of the Secure Core network, not to your real IP address. [1]
The entry servers are chosen for where they are and who runs them. Proton says they are in Iceland, Sweden and Switzerland. Proton owns and provisions them, and they use IP addresses from its own Local Internet Registry. Proton describes the Swedish site as an underground data center and the Icelandic one as a former military base. [1] Its feature page adds that all Secure Core servers use full-disk encryption. [2]
| Standard Proton connection | Secure Core connection | |
|---|---|---|
| Servers in the path | One | Two: a Secure Core entry server, then the exit server [1] |
| Entry countries | Any server you pick | Switzerland, Iceland or Sweden [1] |
| If the exit server is compromised | The exit server sees your real IP address | Traffic traces back only to the Secure Core network edge [1] |
| Latency | Depends on distance and load [3] | Proton says it adds a lot of latency [3] |
| Plan | Free or paid | All paid plans [1] |
| Exit choice | Any country on your plan | Not every exit country connects through every Secure Core location [1] |
Plan requirements
Proton states that Secure Core is available on all paid Proton VPN plans. [1] The Free plan does not include it. If you are deciding between Free and a paid plan, see our Free or Plus guide. Other features follow the same split. In WireGuard config downloads, for example, Free accounts get only VPN Accelerator among the options. [4]
The speed cost, in Proton's own words
Proton does not dress this up. Its speed guide says Secure Core routes your traffic through an extra server, which adds a lot of latency, and that most people do not need the additional security it provides. [3] The same guide explains why distance matters: the farther away the server is, the higher your latency and the more network links your traffic crosses. [3]
Geography makes this worse for some travelers. All entry servers are in Switzerland, Iceland or Sweden. [1] A traveler in Southeast Asia who picks a Japanese exit therefore sends traffic to Europe and back before it reaches Japan. A traveler in Western Europe pays a much smaller penalty. Proton publishes no figures for the added delay, so test it yourself. Compare a normal and a Secure Core connection to the same exit country on a video call, not just a speed test.
Turning it on in the apps
Proton documents Secure Core in every desktop and mobile app. [1]
- Windows: Countries, then the Secure Core filter, then choose a country. Routing can be automatic or through a specific Secure Core location. [1]
- macOS: click the Secure Core button, choose Secure Core On, then pick a country or a specific server. [1]
- Android: Countries tab, Secure Core filter, then a country; the three-dot menu chooses the entry location. [1]
- iOS and iPadOS: toggle Secure Core on, tap a country, then enable the entry country you want. [1]
- Linux: Secure Core servers appear in each exit country's list with entry-exit codes, such as CH-LU#1 for Switzerland to Luxembourg. [1]
Secure Core on a router
Proton says router connections are available on all plans and that routers must support OpenVPN or WireGuard. It also warns that some app features may not be available through a router, and that changing servers means changing the router's configuration. [5] Proton's WireGuard configuration guide does not mention Secure Core. [4] Its OpenVPN configuration guide does list a Secure Core server as one of the download choices, alongside a whole country or an individual server. [6]
In practice, Secure Core on a GL.iNet router means an OpenVPN profile for a Secure Core server, uploaded as an OpenVPN client. Proton's GL.iNet guide covers this OpenVPN client route, with OpenVPN credentials that differ from your normal Proton login. It was written for the original Flint (GL-AX1800) on firmware 3.208. [7] Expect two costs. Proton says WireGuard is usually its fastest protocol, and this route uses OpenVPN instead. [3] You also cannot switch Secure Core routes from a menu. Each change means downloading and uploading a new profile. For most travelers, turning Secure Core on in the app of the one device that needs it is simpler.
When a traveler should turn it on, and when not
Secure Core suits people who are worried about the exit server itself, not about the café Wi-Fi. Ordinary public Wi-Fi risks are handled by a standard VPN connection.
| Situation | Secure Core? | Why |
|---|---|---|
| Hotel or airport Wi-Fi, ordinary work and browsing | No | A standard connection already encrypts traffic off the local network; Proton says most people do not need Secure Core [3] |
| Video calls, gaming or large uploads | No | The extra server adds a lot of latency [3] |
| Exiting in a country where you distrust local server hosting | Yes | The design goal is protecting you if an exit server in a high-risk jurisdiction is compromised [1] |
| Journalism or sensitive research while traveling | Yes, on the device doing that work | Traffic traces back only to Proton's Secure Core network [1] |
| Whole travel router for a family | Rarely | Router setup needs OpenVPN profiles and manual server changes [5][6] |
| Free plan | Not available | Secure Core is on paid plans only [1] |
Questions before you decide
Which Proton VPN plans include Secure Core?
Proton says Secure Core is available on all paid Proton VPN plans. It is not part of the Free plan.
Does Secure Core slow down Proton VPN?
Yes. Proton's speed guide says Secure Core routes traffic through an extra server, which adds a lot of latency, and that most people do not need it. The penalty grows the farther you are from Switzerland, Iceland or Sweden.
Can I use Secure Core on a GL.iNet travel router?
Proton's WireGuard config guide does not mention it, but its OpenVPN download page lists a Secure Core server as a choice. You would load that profile as an OpenVPN client and change servers by uploading new profiles.
Where are Proton's Secure Core servers?
In Switzerland, Iceland and Sweden. Proton says it owns and provisions them, uses its own IP addresses for them, and houses the Swedish servers in an underground data center.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Proton VPN Support: Secure Core Accessed 30 Oct 2026
- Proton VPN: Secure Core feature page Accessed 30 Oct 2026
- Proton VPN Support: How to increase VPN speeds Accessed 30 Oct 2026
- Proton VPN Support: How to download WireGuard configuration files Accessed 30 Oct 2026
- Proton VPN Support: Installing Proton VPN on a router Accessed 30 Oct 2026
- Proton VPN Support: How to download OpenVPN configuration files Accessed 30 Oct 2026
- Proton VPN Support: GL.iNet Flint (GL-AX1800) router setup Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.