Two independent audits, one real-world seizure, and the claims that still rest on trust alone
ExpressVPN’s privacy claim is simple to state. It says it does not keep the data that could reveal who you are or what you did while connected.
Its published privacy policy describes a guiding principle: collect only the minimal data required to operate the service at scale.
Simple claims are easy to make, though. What separates a genuine privacy company from a marketing one is whether that claim survives contact with evidence, corporate structure, technical architecture, independent testing and real-world legal pressure.
This investigation does not ask whether ExpressVPN says it is private. It asks what can actually be verified, what remains a company assertion, and what is still unknown.
Three things make that harder than it first appears.
ExpressVPN sits inside Kape Technologies plc, a company whose own regulatory filings describe its ambition to become a “pure-play consumer digital privacy and security provider”, a strategic statement worth testing against evidence, not accepting at face value.
It is also no longer only a VPN tunnel. The business runs a wider commercial surface of payment processors, analytics tools and adjacent products, each with its own privacy implications.
And the strongest evidence available (independent audits) is, by its nature, a snapshot in time rather than a permanent guarantee.
Five lenses guide the analysis, as with every STACK privacy investigation:
- Privacy Model: what it claims to collect
- Trust Architecture: what technical and organisational evidence supports those claims
- Evidence Architecture: how strong that evidence actually is
- Privacy Surface: where personal data touches parts of the business beyond the VPN tunnel
- Criticisms: how the claims have held up under scrutiny and legal pressure
Privacy model
What ExpressVPN says it does not collect
According to its published privacy policy, ExpressVPN states that it does not log:
- Browsing history, traffic destination, data content or DNS queries (“activity logs”)
- IP addresses, assigned VPN IP addresses, connection timestamps or session duration (“connection logs”)
These two categories are the core of any (L)no-logs policy(L) claim. Activity logs would reveal what a user did online. Connection logs would reveal when and from where they connected. ExpressVPN’s policy explicitly rules out retaining either.
What ExpressVPN says it does collect
The same policy describes a narrower set of operational data collected to run the service. This includes app diagnostic data (crash reports, usability diagnostics and VPN connection diagnostics) which the policy states is collected on an opt-in basis.
What a policy alone can prove
Taken alone, that’s a policy statement, a description of intent, not proof of practice. ExpressVPN’s own documentation can’t be the final word on whether the company actually behaves this way.
That’s the job of the next two sections.
Trust architecture
Trust Architecture asks a different question than the Privacy Model. Not what does the company say, but what reduces the amount of trust a user has to place in that statement.
Independent technical verification
Two independent assessments provide direct, third-party testing of ExpressVPN’s no-logs claims.
KPMG LLP issued an independent assurance report, dated 24 June 2025, providing reasonable assurance that ExpressVPN’s system configurations aligned with its privacy policy’s claims regarding activity and connection logging.
Cure53 conducted a security audit, dated 24 October 2022, and reported no critical vulnerabilities in the architecture it examined.
These are genuinely independent, third-party attestations, the strongest tier of evidence available under STACK’s evidence hierarchy, and materially stronger than the policy language alone. (See (L)how VPN audits work(L) for what these engagements do and don’t establish.)
Open-source verification
ExpressVPN’s Lightway Core protocol is published on GitHub, where the source code shows packet-handling logic with no disk-commit logging at the protocol layer, as of a repository snapshot dated 15 August 2023.
That’s a verifiable code artifact, and it should be read for what it is: publicly inspectable source code, not a third-party audit finding. It supports the no-logs claim at the protocol level, but doesn’t carry the same evidentiary weight as an independent assurance engagement on its own.
The corporate-firewall claim: asserted, not independently tested
ExpressVPN’s privacy policy also states that a parent, subsidiary or related entity cannot be compelled to, nor would voluntarily, provide personal data stored by Express Technologies Ltd. the entity registered under the BVI Business Companies Act, Company No. 1827827, per BVI Corporate Registry records.
This claim matters, because the operating company sits beneath (L)Kape Technologies plc(L), which was itself taken fully private by Unikmind Holdings Ltd. in a 2023 takeover.
Two things are worth separating here. Express Technologies Ltd.’s BVI incorporation, and Unikmind Holdings’ acquisition of full ownership of Kape Technologies plc, are both matters of public legal and regulatory record, that part is verified.
What is not independently verified is the claim itself: that this ownership structure cannot be used to compel disclosure of user data. No independent legal opinion on the enforceability of foreign subpoenas within BVI jurisdiction is available in the evidence reviewed. This is a company assertion about its own legal exposure, not a tested legal conclusion.
Readers should treat the “corporate firewall” as ExpressVPN’s stated position, sitting alongside, but not equivalent to, the independently audited no-logs claims above.
Evidence architecture
This section asks how strong the underlying evidence actually is, and where its limits sit.
What the audits actually tested
KPMG’s own attestation report is explicit about scope. The assessment was limited to testing system configurations against management’s privacy assertions as of the testing period, per its 26 February 2026 report.
Cure53’s later assessment, dated 18 December 2023, went further: penetration testing and a source-code audit of TrustedServer technology, confirming a volatile-memory execution model consistent with ExpressVPN’s stated architecture.
Audits like these cut both ways at once. They’re a genuine, independent check, not a marketing exercise, but they’re also bounded: a point-in-time test of a defined scope, not an open-ended guarantee that nothing outside that scope has ever occurred, or could occur.
Distinguishing company documentation from independent testing
ExpressVPN’s TrustedServer architecture whitepaper, dated 10 May 2024, describes the underlying design: a read-only operating environment executed from RAM, with no writes to hard disk.
This whitepaper is company-authored. It defines the technical claims that Cure53’s independent audit was then tested against. The two documents are best read together, the whitepaper as the design specification, Cure53’s report as the independent check on whether that design holds up in practice.
Transparency reporting as a track record
ExpressVPN’s H1 2025 transparency report states that the company publishes this disclosure every six months, detailing legal requests received and how it responded to them. It reports zero instances of providing activity or connection log data to law enforcement, attributed to the data simply not existing to hand over.
That’s useful as a running, dated record rather than a one-off claim, though it remains ExpressVPN’s own reporting, not an independently audited disclosure.
What remains unknown
The evidence available does not establish how ephemeral RAM is handled in the moments before a server reboot cycle completes, during a live law-enforcement seizure. This sits outside what any of the available audits tested. It’s a genuine gap rather than a criticism, and no independent evidence closes it.
Privacy surface
The no-logs claim describes the VPN tunnel. It does not describe the full set of ways ExpressVPN, as a business, can come into contact with personal data.
Named third-party processors
ExpressVPN’s privacy policy lists a substantial set of third-party service providers integrated into the product and business: PayPal, Forter, Braintree, Chargebee, Google Analytics, Cloudflare, Zendesk, TeamSupport, AppsFlyer, Sentry and Firebase Crashlytics.
Of these, independent verification is available for one. AppsFlyer’s own privacy documentation, dated 12 November 2025, confirms that its SDK, when integrated into mobile applications, processes device identifiers, IP addresses and attribution data.
For the remaining processors named in the policy, the evidence establishes that they are integrated, not how each of them individually handles the data they receive. Naming a vendor is a transparency practice. It is not the same as that vendor’s data-handling practices being independently tested.
Diagnostic data
App diagnostic data (crash reports, usability diagnostics and VPN connection diagnostics) is collected on an opt-in basis, per ExpressVPN’s privacy policy. This sits outside the no-logs commitment to activity and connection data, but is explicitly framed as optional rather than default.
Adjacent products: ExpressKeys
ExpressVPN’s password manager, ExpressKeys, is documented as using a zero-knowledge architecture, with local end-to-end encryption applied before any data synchronises to storage, per ExpressVPN security documentation dated 15 February 2024.
This documentation is company-authored rather than independently audited. It describes a product that sits adjacent to, rather than inside, the core VPN privacy surface.
Business model and incentives
Understanding why a company might protect (or erode) privacy means looking at what it’s actually paid to do.
Kape Technologies plc’s financial statements, dated 31 December 2022, describe a revenue model built on recurring consumer subscription fees rather than data commercialization. That’s a structurally relevant fact: a subscription-funded business doesn’t depend on monetising user data the way an advertising-funded one would.
At the same time, ExpressVPN’s privacy policy states that Identity Defender (a separate product) operates with no association between data collected for VPN services and data collected for Identity Defender. Like the corporate-firewall claim above, this is a policy assertion rather than an independently verified technical separation. No third-party audit of that specific data boundary is available in the evidence reviewed.
ExpressVPN also runs a public vulnerability disclosure programme through Bugcrowd, with published statistics on reward history, scope and resolution metrics as of 1 December 2025. This is a genuine, ongoing financial incentive aligned with finding and fixing security issues, one of the more concretely evidenced incentive alignments in this investigation.
The company also sends limited transactional communications to users; account, renewal and price-change notices, per its privacy policy. That’s a modest but real ongoing communications relationship between ExpressVPN and its customers.
Criticisms
Executive background: Project Raven
In 2021, the U.S. District Court for the District of Columbia entered a Deferred Prosecution Agreement involving Daniel Gericke, detailing his prior involvement in Project Raven, a UAE-based computer intrusion operation. Gericke subsequently held an executive role connected to ExpressVPN’s parent structure.
Reuters reported ExpressVPN’s response at the time: the company said it was unaware of the federal investigation at the point of hiring, and reiterated its no-logs architectural controls.
That’s a legitimate matter of public record. But it’s important to separate what it does and doesn’t tell readers evaluating ExpressVPN’s privacy practices specifically: the court record establishes facts about an individual’s prior conduct in a separate context. It does not, on its own, provide evidence that ExpressVPN’s technical no-logs claims were compromised.
Readers researching executive background and corporate governance in more depth may find that question addressed more directly in Who Owns ExpressVPN?
A real-world test: the 2017 Turkish server seizure
In December 2017, Turkish prosecutors seized an ExpressVPN server attempting to obtain logs relevant to an investigation. According to official reporting, no log data was recovered: consistent with the company’s RAM-only server architecture.
That’s a rare form of evidence: an adversarial, real-world test of the no-logs claim under legal pressure, rather than a company-controlled demonstration.
The absence of contradictory court findings
Based on the public court dockets reviewed, no judicial record establishes that ExpressVPN has ever retained or surrendered user activity or connection logs.
This should be stated carefully. An absence of contradictory evidence isn’t the same as positive proof that logs have never existed. It is, however, a meaningful negative finding, the kind of claim that would be relatively likely to surface in court records if it had occurred, and hasn’t.
STACK view
ExpressVPN’s core privacy claim (that it does not retain activity or connection logs) rests on solid ground: two independent third-party assessments (KPMG, Cure53), a publicly inspectable protocol implementation (Lightway Core), a real-world adversarial test the architecture appears to have withstood (the 2017 Turkish seizure), and a multi-year public track record of transparency reporting.
That’s a materially stronger position than a privacy policy alone, and readers should weigh it accordingly.
Two things temper that conclusion. Neither is a reason to distrust the core finding, they’re reasons to be precise about what the finding covers.
The audits are scope-limited and point-in-time by their own admission. KPMG’s own report defines its testing as limited to system configurations as of the testing period. That’s a normal and appropriate limitation for this kind of assurance work. But “independently audited” shouldn’t be read as “permanently guaranteed.”
Several claims outside the core no-logs commitment (the corporate-firewall assertion, the Identity Defender data-separation claim, and the individual data practices of most named third-party processors) are currently supported only by ExpressVPN’s own policy language. None of these are unreasonable claims, and nothing in the evidence reviewed contradicts them. But they haven’t been independently tested the way the no-logs claim has. Readers deciding how much to trust ExpressVPN with sensitive data should hold that distinction, rather than treat every claim in this investigation as equally verified.
Conclusion
Based on the evidence reviewed:
ExpressVPN’s no-logs claim the question most people mean when they ask whether the service is private: is well supported by independent technical evidence, and has held up under at least one real-world legal test.
The company’s corporate structure, and its assertions about resisting compelled data disclosure, are matters of verified legal record at the ownership level. But the specific claim that this structure prevents compelled disclosure remains a company assertion, not an independently tested legal conclusion.
The broader privacy surface (third-party payment, analytics and support vendors, and adjacent products like ExpressKeys) extends beyond the audited VPN tunnel, and most of it is documented rather than independently verified.
No court record reviewed contradicts the no-logs claim, though several matters (RAM handling during active seizure, and the internal data boundaries between products) remain genuinely unknown rather than resolved.
Readers whose primary concern is whether ExpressVPN can see or hand over their browsing activity will find the strongest evidence available in this investigation supports the company’s claims. Readers evaluating trust more broadly (across ownership structure, adjacent products and third-party vendors) should treat the less-verified claims identified above as open questions rather than settled conclusions.
Related investigations
- Who owns ExpressVPN?
- (L)How VPN audits work(L)
- (L)What is a no-logs policy?(L)
- Is NordVPN private?
Methodology
This investigation is based on official ExpressVPN documentation, independent technical audits (KPMG, Cure53), corporate and legal registry records (BVI Financial Services Commission, London Stock Exchange, U.S. District Court for the District of Columbia), and publicly reported enforcement events.
Claims sourced solely to ExpressVPN’s own documentation are identified as such throughout.