ExpressVPN

Is ExpressVPN safe?

Yes, as a VPN. ExpressVPN encrypts your traffic between your device and its servers, which hides what you do from public Wi-Fi operators and your internet provider. Its claim that it keeps no activity or connection logs has been checked by KPMG three times, and in 2017 it survived a real test when Turkish police seized one of its servers. We score it 79/100.

That puts it level with NordVPN (79) and well behind Proton VPN. The deductions come from marketing data collection that goes further than the App Store label suggests, a 2025 bug in the Windows app that let some traffic skip the tunnel, and pending US lawsuits over automatic renewals.

Does ExpressVPN keep logs?

Not of what you do online, as far as outside checks can tell. The company's own audit list starts with PwC Switzerland, which reviewed its privacy policy and TrustedServer technology in June 2019. KPMG then examined the no-logs policy in September 2022, December 2023 and June 2025. The 2025 engagement, under the ISAE 3000 standard, looked at TrustedServer and the privacy controls as of 28 February 2025 and found no issues with the safeguards against activity logging. The full report is public once you accept KPMG's terms.

The stronger evidence is older. In January 2017 Turkish investigators looking into the assassination of Russia's ambassador seized an ExpressVPN server from a datacentre. ExpressVPN said the server held no logs that could identify the user, because it never kept any.

What ExpressVPN does keep is listed plainly in its policy: the apps and versions you activated, the dates (not times) you connected, which server location you picked, and the total data you transferred per day. The company says this cannot tie you to any website or session, because thousands of other users share the same pattern.

What does the app collect for marketing?

More than the store labels show. Apple's label says your email and user ID are linked to you and used for ExpressVPN's own advertising and marketing, with no tracking. Google Play lists device IDs and email used for advertising or marketing, and says nothing is shared with third parties.

The privacy policy, updated on 2 October 2026, describes more. ExpressVPN sends install and subscription data to AppsFlyer for attribution, adds your phone's advertising ID if you consent, and may use advertising IDs and hashed email addresses to build remarketing audiences on Meta, TikTok, Google Search and YouTube "with your consent where required by law". None of this includes browsing activity, but it is the kind of cross-company ad matching a privacy-focused buyer may not expect from a VPN. Under our rules we score privacy on the broader policy, not the label.

How secure is ExpressVPN?

The engineering record is strong. Every VPN server runs TrustedServer, which keeps the system in RAM so a reboot wipes it. The Lightway protocol, built in-house, has an open-source core library, supports post-quantum key exchange and has been audited by Cure53 and Praetorian several times. The company lists 28 independent audits since 2018 on its Trust Center. The most recent ones on the VPN itself are Cure53 and Praetorian reviews of Lightway in late 2024 and KPMG's 2025 no-logs check; the 2026 audits cover newer add-ons such as ExpressKeys. It also runs a paid bug bounty, now managed by YesWeHack.

The weak spots are in the apps. In 2024 a split-tunnelling setting on Windows leaked DNS requests until a fix was audited in April that year. In April 2025 a researcher reported through the bug bounty that leftover debug code in Windows versions 12.97 to 12.101.0.2-beta sent any TCP traffic on port 3389, the Remote Desktop port, outside the tunnel. That exposed your real IP address and the servers you reached, though not the content. ExpressVPN shipped version 12.101.0.45 five days later.

Some buyers also weigh ownership. Kape Technologies bought ExpressVPN in 2021, and the same year its then chief information officer, Daniel Gericke, was one of three former US intelligence staff who signed a deferred prosecution agreement over hacking operations they managed for a UAE company between 2016 and 2019. Neither event changed how the service handles data, and we treat both as background. Kape also owns review sites: in March 2021 it bought Webselenese, a Tel Aviv publisher of privacy and VPN reviews, for about US$149 million. The review site vpnMentor says it works with Kape, which also owns ExpressVPN, and that its rankings may take this common ownership into account.

How to use ExpressVPN safely

1. Keep the Windows app updated; the 2025 leak only affected versions from 12.97 to 12.101.0.2-beta.
2. Open the app's privacy settings and refuse marketing and attribution consent if you do not want your ad ID or hashed email used for remarketing.
3. Check the renewal date and price in your account after you buy. A proposed class action filed in California in June 2025 alleges that a one-month plan rolled into a monthly subscription without clear consent; it is an allegation, not a finding. A similar suit filed in Illinois in July 2025 (Greenwood) is still at an early stage: in March 2026 the judge ruled that the buyer was not bound to arbitrate, because ExpressVPN had dropped arbitration from its terms in October 2022, and ExpressVPN's appeal was argued before the Seventh Circuit on 27 October 2026.
4. Use the Lightway protocol and leave the kill switch on, so traffic stops if the tunnel drops.
5. Remember that a VPN does not stop phishing, malware or tracking by sites you log in to.

How we scored it

Regulatory record is the strongest factor (88): we found no fine or order. Security (82) and scams and harmful content (82) follow, backed by RAM-only servers, many published audits and a paid bounty, minus the 2025 Windows leak. Privacy is the weakest factor (74), because the policy allows ad remarketing through Meta, TikTok and Google that the App Store label does not reflect.