ExpressVPN is a consumer VPN service operated by Express Technologies Ltd and owned since 2021 by Kape Technologies, which also owns the competing VPN brands Private Internet Access and CyberGhost and Webselenese, a portfolio of VPN comparison and review websites. On the engineering side the product is one of the better-evidenced in the consumer market: its TrustedServer platform runs only in RAM so servers retain nothing across a reboot, and its no-logs claim has been examined by named outside firms including KPMG LLP, PwC and Cure53, whose Lightway protocol pentest is published in full. Its transparency report pairs a real request count with a real compliance outcome and it funds a bug bounty with published submission numbers. The weaknesses are not in the tunnel. Account signup requires an email address and payment identity, the apps collect marketing-attribution telemetry including persistent installation identifiers, and the marketing site carries Google Ads remarketing, DoubleClick and Facebook Pixel tags. Kape traded as Crossrider until a 2018 rebrand, a name Malwarebytes still uses for a large adware family, and the group went private in 2023 under Unikmind Holdings. In September 2021 the U.S. Department of Justice announced a deferred prosecution agreement under which ExpressVPN's then-CIO Daniel Gericke personally agreed to pay $335,000 over hacking-related work for the UAE; a DPA is not a conviction, the penalty was against Gericke and not the company, and ExpressVPN publicly defended him and kept him in the role.
TRACK RECORD
1 ENFORCEMENT ACTION
[2021-09-14]
The U.S. Department of Justice announced a deferred prosecution agreement under which three former U.S. intelligence or military personnel — Marc Baier, Ryan Adams and Daniel Gericke — agreed to pay $1,685,000 total to resolve an investigation into violations of U.S. export control, computer fraud and access device fraud laws. Gericke, ExpressVPN's then-serving Chief Information Officer, agreed to pay $335,000. DOJ states the three worked as senior managers at a UAE-based company carrying out computer network exploitation operations for the UAE government between 2016 and 2019. A DPA is not a conviction.
ExpressVPN's published no-logs page states the service does not retain browsing history, traffic destination or metadata, DNS queries, or the IP addresses assigned to users on connection. This is the architectural basis for every downstream privacy claim the company makes, and it is the specific property two named independent auditors were engaged to test.
ExpressVPN's Trust Center describes TrustedServer, its VPN server platform, as running only in volatile memory so that the operating system and applications never write to hard drives and all server state is destroyed on every reboot. The page states this architecture has been audited by PwC.
Unlike the numbered-account VPNs in this category, ExpressVPN requires an identity to hold an account: its Privacy Policy states that an email address and payment information are collected at signup, with the specific payment fields depending on the method chosen and potentially including name, billing address and card number.
Kape Technologies was taken off the London AIM market and into private ownership by Unikmind Holdings, an entity owned by businessman Teddy Sagi who was already Kape's majority shareholder. ExpressVPN's ultimate ownership is consequently a privately held vehicle with materially less public financial disclosure than a listed parent.
ExpressVPN is owned by Kape Technologies, which also owns competing VPN brands Private Internet Access and CyberGhost, antivirus vendor Intego, and Webselenese — a portfolio of consumer VPN comparison and review websites that Kape describes as offering unbiased reviews. A single parent therefore owns both several of the products being compared and review properties that compare them.
Kape Technologies operated as Crossrider until a 2018 rebrand. Malwarebytes uses the detection name Adware.CrossRider for a large family of adware targeting Windows and macOS that was typically delivered through software bundlers. ExpressVPN's parent therefore carries an adware-distribution lineage under its former name, a point of context for a company now selling privacy software.
ExpressVPN's marketing website loads a substantial set of third-party advertising tags. The Privacy Policy names Google Ads remarketing, DoubleClick Ad, Facebook Pixel, Facebook Social Plugins, Google AdServices and Google Syndication among the Marketing Cookies in use, and states that device information including mobile advertising identifiers is used to attribute signups to advertising partners. These are advertising destinations in the data path around the product, distinct from the VPN tunnel itself.
ExpressVPN's H1 2026 transparency report states it received 137 government, law enforcement and civil requests and three warrants in the period, and that none of the requests it received resulted in the disclosure of VPN activity or connection logs — a published request count paired with a published compliance outcome.
ExpressVPN frames its no-logs design as a limit on what it can be compelled to hand over, stating that if anyone attempts to compel release of users' online activities the company cannot supply the information because the data does not exist.
The U.S. Department of Justice announced a deferred prosecution agreement under which three former U.S. intelligence or military personnel — Marc Baier, Ryan Adams and Daniel Gericke — agreed to pay $1,685,000 total to resolve an investigation into violations of U.S. export control, computer fraud and access device fraud laws. Gericke, ExpressVPN's then-serving Chief Information Officer, agreed to pay $335,000. DOJ states the three worked as senior managers at a UAE-based company carrying out computer network exploitation operations for the UAE government between 2016 and 2019. A DPA is not a conviction.
Reporting on the DPA identified Daniel Gericke, who joined ExpressVPN as CIO in December 2019, as a participant in Project Raven — the UAE surveillance programme first exposed by Reuters in 2019. ExpressVPN did not part with him: the company publicly defended the hire, saying it had known the key facts before hiring him and that its trust in him remained strong.
ExpressVPN told TechRadar Pro that when it hired Daniel Gericke in December 2019 it knew he had previously worked at CyberPoint and DarkMatter but had no knowledge of his association with Project Raven. The company defended retaining him on the argument that offensive experience produces better defensive engineering.
Cure53 conducted a source-code-assisted penetration test of ExpressVPN's Lightway VPN protocol across server, client, shared libraries and the high-performance TUN driver, and published the full report. The engagement identified three vulnerabilities and seven miscellaneous issues, all rated Low or Informational, with no High or Critical findings.
ExpressVPN commissioned KPMG LLP to examine its no-logs policy and TrustedServer architecture, and published the outcome: KPMG provided reasonable assurance that the systems functioned as designed with no identified issues regarding technical safeguards against activity logging. The full report is available to the public subject to accepting KPMG's terms. This is a named-firm affirmative audit artifact, not an absence of findings.
ExpressVPN runs funded bug bounty programs with published results: its H1 2026 transparency report records 392 submissions, 308 of them unique, of which forty-two unique reports were classified as valid.
ExpressVPN's own no-logs page states the service does record the apps and app versions a user has successfully activated, and the total amount of data a user transfers — describing the latter as a fair-use control under which the company says it might contact a user whose traffic volume affects service quality for others.
Separately from the VPN tunnel, ExpressVPN's apps collect marketing-attribution telemetry: the Privacy Policy discloses country code derived from a hashed IP address, OS version, device language, app version, device model and randomized persistent identifiers it calls an Installation ID or XV User ID, used to measure marketing campaign effectiveness and conversion attribution, plus advertising identifiers (IDFA / Android Advertising ID) where the user has given explicit consent.