Is ExpressVPN safe? What it logs, who checked, who owns it

Three questions inside the word “safe”

The question is ExpressVPN safe holds three smaller ones. Does the software protect the connection? Does the company keep records that someone could demand? And who owns and runs the company? The pages we read answer the first mostly in the company’s own words, the second with a policy and a list of audits, and the third with news reports from 2021. This page keeps the three apart and says who said what.

On the first, ExpressVPN’s Trust Center describes two pieces of its own technology. Lightway is its VPN protocol; the company says it uses the wolfSSL cryptography library, that the core library is open source and that it includes post-quantum support. TrustedServer is its server software, which the company says runs only on volatile memory, or RAM, so that all information on a server is wiped every time it is powered off and on again. Security.org, which says it bought a subscription and tested the apps, repeats the RAM point, writes that all the physical servers are RAM-based and says the company resets its servers every week. It also says Lightway can use 256-bit AES or ChaCha20 and that the company announced in February 2024 that it had rebuilt the protocol in the Rust language.

Those are descriptions, and the Trust Center is the company describing itself. What the pages give for checking them is a list of audits, which the next section sets out.

What the company says it logs, and the audits it lists

ExpressVPN’s page on its log policy says the company does not collect browsing history, traffic destinations or metadata, DNS queries or the IP addresses assigned to users when they connect. It says it is registered in the British Virgin Islands. The same page lists what it does collect: the apps and app versions activated, the dates but not the times of connections, the VPN location but not the server address, the source country and the total amount of data transferred. It says none of that lets the company or anyone else match an individual to specific network activity. It adds that it collects anonymized diagnostic data, such as speed test data, connection failures and crash reports, and that each app has a setting to stop sending it.

Security.org reaches a similar reading from its own use. It writes that the company captures device information, software versions and bandwidth usage, that this data is unidentifiable, and that the company does not capture an IP address at all.

For checking, the company points to third parties. The log page says KPMG, PwC and Cure53 audited it and that the audits confirmed it keeps no logs of user activity. The Trust Center, which says it commissions third-party audits frequently, has a much longer chronological list: PwC Switzerland on its privacy policy and TrustedServer in June 2019 and on its build checks in June 2020; Cure53 on Lightway in August 2021 and on TrustedServer in May 2022; KPMG on its no-logs policy in September 2022 and on its privacy policy in December 2023; a fourth Cure53 audit and a third Praetorian audit of Lightway in 2024; and a third KPMG audit of its privacy commitments in June 2025. The list also holds many audits of single apps and products. In 2025, the Trust Center adds, ExpressVPN and the Kape Group obtained ISO certifications for information security, quality management and customer contact; the page names them by standard number, among them ISO 9001 and ISO 18295, and describes them as company statements that the pages we read do not back with a certificate or an audit report.

The sources differ on how recent the last check is. The log page stops at December 2023 for KPMG. Security.org, updated on 10 September 2026, also gives December 2023 as the last. The Trust Center gives June 2025. The pages we read do not say why the lists differ, and the PwC audit of June 2020 appears on the Trust Center but not on the log page.

What the lists leave unsaid

All the audit statements we read come from the company’s pages or from reviewers repeating them. Security.org writes that the company shares the results on its website, and the company says the audits confirmed its claims. The pages we read do not say who paid for the audits, and they do not reproduce the KPMG or PwC reports. They also do not say whether the audits covered every server and location the service runs today. We read the lists of audits, not the reports, so this page cannot say what an auditor examined or found beyond the company’s own summary.

The server seized in Turkey

The pages we read describe one public test of the no-logs claim. TorrentFreak reported on 19 December 2017, in an article by Ernesto Van der Sar, that Turkish authorities had seized an ExpressVPN server while investigating the killing of Andrei Karlov, the Russian ambassador to Turkey. The article says the authorities had found that the assassin’s Gmail and Facebook accounts were deleted remotely over a connection through ExpressVPN, and that the seizure took place the previous January. TorrentFreak says the server held no logs and that an inspection of it yielded no useful information. It also says an investigator wrote to the company, which is incorporated in the British Virgin Islands and, TorrentFreak says, only responds to local court orders, and was told that it keeps no connection or activity logs.

The company gave its own statement, which TorrentFreak quotes: ExpressVPN “does not and has never possessed any customer connection logs” that would show which customer used the addresses the investigators cited. TorrentFreak writes that the provider has had physical server seizures in the past, but generally not more than a few times per year, and that such seizures are not announced in public. It also said that after the Turkish case it stopped using physical servers in Turkey. A virtual location with Turkish IP addresses now points to servers hosted in the Netherlands.

Two cautions come with this case. The article ends with a disclosure that ExpressVPN is a TorrentFreak sponsor. And the pages we read do not include the Turkish investigators’ report; the article cites Turkish news sources, so the outcome reaches readers through those reports and the company. The pages we read do not describe any seizure after 2017.

The owner, the executive and the 2021 agreement

The second question is who owns and runs the company, and the pages we read date it to September 2021. Security.org writes that Kape Technologies bought ExpressVPN in early September 2021 for 936 million dollars, and adds: “Kape began life as Crossrider, a company with a history of producing malware.” Euronews, republishing Reuters, calls Kape a British-Israeli digital security software provider. Security.org also writes that the company has not been proven of wrongdoing and that its own research found it keeps high privacy standards.

In the same week the US Justice Department announced an agreement. According to its release, three former members of the US intelligence community or military entered into a deferred prosecution agreement on 7 September and agreed to pay penalties totalling about 1.7 million dollars, split three ways. They also agreed to full cooperation with the Department and the FBI, to give up security clearances, to a lifetime ban on new US clearances and to limits on future work. The release says they had worked from 2016 to 2019 as senior managers at a company in the United Arab Emirates that carried out hacking operations for that government, and that they provided defense services without a licence required under US export rules. The release describes systems that could compromise a phone without any action by the target. It does not name ExpressVPN.

TechRadar makes the link: it says one of the three, Daniel Gericke, was an ExpressVPN executive, and gives the project the name Project Raven. It stresses that a deferred prosecution agreement is not a conviction or a plea. ExpressVPN told TechRadar it hired Gericke in December 2019, that it knew of the earlier work at CyberPoint and DarkMatter but not of the link to Project Raven, and that it learned of it on 7 September 2021. It also said it does not condone the project. Reuters, in the Euronews piece, writes that the company had known about Gericke’s history as a hacker for the United Arab Emirates and had repeatedly given him more responsibility while the FBI investigation of his conduct moved toward its conclusion; it says he was named chief technology officer in August, according to an internal email, and remained in the post. Reuters also reports the company’s statement that it had not known of the federal investigation or the details of his work in the UAE, which it called “completely antithetical to our mission.” This is not strictly a contradiction of TechRadar, since TechRadar also says the company knew of the earlier jobs but not of Project Raven. Security.org calls ExpressVPN’s executive in this story its CIO. TechRadar says only executive.

TechRadar passes on a statement from the company’s co-founder Dan Pomerantz that every change to code needs a “four-eyes review” and multifactor authentication. It also passes on the company’s statement that the agreement does not let the FBI request material outside Gericke’s immediate possession and that user data is held under British Virgin Islands jurisdiction. TechRadar writes that it has yet to see anything pointing to ExpressVPN being involved in surveillance or activity logging, and that it will keep watching how the company keeps its commitments. It also notes that Edward Snowden warned users to stop using the service. Euronews reports that the news stunned staff and that more than 40 employees voted for an anonymous question saying the episode had eroded consumers’ trust. The pages we read do not say that Gericke had access to user data, and they do not say whether Gericke still holds a role at the company today.

What a reviewer measured

Security.org, in a review updated on 10 September 2026, scores ExpressVPN 9.1 out of 10 and says it has servers in 105 countries and, in its summary, that this is more than any other VPN it tested, although a table in the same review lists NordVPN at 137 countries; ExpressVPN’s own pages say 113 countries. It says it tested the service on a MacBook Air and a Windows laptop from Brooklyn, New York, staying logged in for an average of 15 hours a day over a month. It reports that the service passed its DNS leak test and its WebRTC leak test, both run from the company’s own web tools. It also saw the kill switch trigger twice, once when a server timed out and once when a mobile device switched networks. Our page on the kill switch explains what that feature is for.

On speed, Security.org measured downloads about 39 percent slower on the Mac and about 37 percent slower on Windows, and uploads about 14 percent slower on the Mac and 23 percent on Windows.

It lists the price as starting at $2.79 a month on a two-year plan, calls that higher than NordVPN or Surfshark, and says the prices are introductory offers. Each plan has a 30-day money-back guarantee. Leak tests and speeds describe one reviewer’s setup in one city.

What we did not do, and what stays open

We ran no test of any kind: no leak test, no speed test, no check of the kill switch. We did not open any audit report. Among outside reviews of ExpressVPN we read only the Security.org review, so what other reviewers, forums and customer-review sites report is not here. A company blog post on audits of its desktop apps reached us as an empty shell, and the text we saved of the log page contains a notice that some content is not available in the region we read from, so we state only what the pages say, not what they leave out.

What remains unanswered in the pages we read is who paid for the audits, what the full reports say, whether they cover every current server, and whether any seizure after 2017 tested the claim again. For other services, our pages on NordVPN, Proton VPN, Surfshark and Mullvad set out what each says about itself, with the same attention to who said what.