A criminal investigation did what marketing copy never could: it tested ExpressVPN's privacy claims against a government seizure. After a 2016 assassination in Turkey, authorities confiscated one of the company's servers hoping to trace a user's activity. They found nothing linking the hardware to any individual, because the service simply hadn't kept the records investigators were after.
That episode has become something of a reference point in a market where nearly every provider asserts a no-logs policy but few have had the claim tested by anyone with subpoena power. ExpressVPN encrypts a user's traffic and routes it through a server in a country the user selects, masking both location and the contents of the connection from internet providers, network operators and anyone else positioned to watch. The company runs apps across Windows, macOS, Linux, iOS and Android, extends to smart TVs, and ships its own router firmware for people who want protection applied to an entire household rather than one device at a time. For readers comparing options before committing, a provider comparison table is a reasonable starting point, since pricing structures and feature sets shift often enough that last year's recommendation isn't always this year's best fit. a provider comparison table
How the tunnel actually works
The mechanics rest on tunneling: data leaving a device gets encrypted and wrapped inside another layer of traffic before it reaches an ExpressVPN server, which then forwards the request to its destination on the open internet. Encryption standards and the protocol handling that handshake determine both speed and resistance to interception. ExpressVPN's default is Lightway, a protocol it wrote in-house and later published as open source, a move that let outside researchers examine the code rather than take security assurances on faith. WireGuard and OpenVPN remain available for users who prefer them or need compatibility with specific network setups.
Since 2019, every server in the network has run what the company calls its TrustedServer system: machines boot from a fresh read-only image each time and write nothing to local disk. In practice, that limits how much a server could reveal even if someone did seize one, because there's no persistent storage holding past activity. KPMG conducted an independent assessment of the no-logs controls in February 2025, adding a second layer of outside verification beyond the Turkey case.
Ownership, jurisdiction and the fine print
ExpressVPN was founded in 2009 by Peter Burchhardt and Dan Pomerantz and is incorporated in the British Virgin Islands, a jurisdiction without mandatory data retention laws that would otherwise force logging. Ownership changed in September 2021 when Kape Technologies acquired the company, placing it alongside CyberGhost and Private Internet Access under one corporate parent - a consolidation trend that has reshaped much of the VPN industry and raises reasonable questions about how independently each brand still operates.
The client apps themselves are closed source, so users rely on audits and incidents like the server seizure rather than reading the code directly; Lightway, by contrast, is published under the AGPL-3.0 license. Pricing follows an industry-standard pattern: long-term plans carry a discounted introductory rate that renews substantially higher, a structure worth calculating in full before signing up. Higher tiers bundle in a password manager and identity-protection tools, extending the product beyond pure traffic encryption into broader personal security.