A police seizure in Turkey turned into an unplanned proof point for ExpressVPN. When investigators probing a 2016 assassination took possession of one of the company's servers, they found no logs capable of linking activity to a specific user - a real-world test that few privacy tools ever face, let alone survive.
That episode sits at the center of how ExpressVPN pitches itself today. The service encrypts a user's internet traffic and sends it through a server in a country of the user's choosing, masking the original IP address and shielding data from networks in between. It runs on Windows, macOS, Linux, iOS and Android, extends to smart TVs, and even ships its own router firmware for people who want every device on a home network covered at once. Plans are sold in tiers, with the pricier ones bundling a password manager and identity-monitoring tools alongside the core VPN; readers weighing whether those extras justify the cost may want a closer look at the pricing before committing to a multi-year term. a closer look at the pricing
The Engineering Behind the Encryption
ExpressVPN's default protocol is Lightway, built by the company itself and later released as open source under the AGPL-3.0 license - a move that lets independent researchers examine its code rather than take security claims on faith. WireGuard and OpenVPN remain available for users who prefer them, which matters because protocol choice affects speed, battery use and compatibility with restrictive networks. Underpinning all of this since 2019 is TrustedServer, an architecture in which every server boots from a fresh read-only image and writes nothing permanent to disk. In practice, that means a server wiped and restarted has no historical data to hand over, whether to a hacker, a rogue employee or a government request.
No-Logs Claims Meet External Scrutiny
Marketing claims about "no logs" are common across the VPN industry and hard for ordinary users to verify. ExpressVPN has tried to close that gap with outside review: accounting firm KPMG assessed its no-logs controls in February 2025, adding a formal audit to the Turkey server incident as evidence the policy holds up under pressure rather than just in a privacy policy document. No audit is a permanent guarantee - infrastructure changes, and so do legal environments - but repeated, independent scrutiny is a meaningfully stronger signal than a company's word alone.
Ownership, Jurisdiction and the Trade-Offs
ExpressVPN was founded in 2009 by Peter Burchhardt and Dan Pomerantz and is incorporated in the British Virgin Islands, a jurisdiction with no mandatory data-retention laws for VPN operators. That changed in character, if not necessarily in practice, when Kape Technologies acquired the company in September 2021, placing it in the same corporate family as CyberGhost and Private Internet Access. Critics of consolidation in the VPN market argue that shared ownership across competing brands can reduce genuine choice even when each service keeps separate infrastructure. The apps themselves remain closed source, which means users cannot inspect the client code directly, even though the underlying Lightway protocol is open. That split - open protocol, closed application - is a compromise increasingly common in the industry, and it's worth weighing against the subscription cost, since long-term plans are typically discounted up front and renew at substantially higher rates once the introductory period ends.