A seized server in a criminal investigation and an outside audit have given ExpressVPN something few privacy tools can claim: independent confirmation that its no-logs promise holds up under pressure. The company encrypts a user's traffic and reroutes it through a server in a country of their choosing, with applications covering Windows, macOS, Linux, iOS, Android, smart TVs and its own router firmware. That breadth of platform support, combined with a protocol it built itself, has kept it near the top of a crowded field for more than a decade.
The technical core of the service is Lightway, a protocol ExpressVPN wrote in-house and later released as open source so independent researchers could examine its code. WireGuard and OpenVPN remain available for users who prefer them, but Lightway is the default, built to be lighter and faster to establish a connection than older standards. This matters because the choice of protocol shapes everything from battery drain on a phone to how quickly a connection recovers after a network drop. In regions where authorities actively restrict circumvention tools, protocol design also affects whether a connection can be detected and blocked, which is part of what VPN users in Iran run into when ordinary access to blocked services becomes a daily obstacle rather than a convenience.
Encryption alone does not make a privacy claim credible. What distinguishes ExpressVPN's case is a concrete test: after a 2016 assassination in Turkey, investigators seized one of its servers and found no logs connecting it to any identifiable user. That episode predates most marketing claims about "no-logs" policies that other providers make without ever facing forensic scrutiny. KPMG's assessment of ExpressVPN's no-logs controls in February 2025 added a formal audit to that real-world precedent, giving customers two distinct forms of evidence rather than a single unverified assurance.
How TrustedServer Changes the Risk Calculation
Since 2019, every ExpressVPN server has run on its TrustedServer architecture, which boots from a fresh software image each time and writes nothing permanent to disk. This design removes an entire category of risk: a server cannot leak historical data it never retained, and a government or attacker seizing hardware finds nothing useful. It is a structural answer to a problem that has plagued the VPN industry for years, where logging policies were often just promises with no technical enforcement behind them.
Ownership, Jurisdiction and the Cost of Convenience
ExpressVPN was founded in 2009 by Peter Burchhardt and Dan Pomerantz and remains incorporated in the British Virgin Islands, a jurisdiction with no mandatory data-retention laws for telecommunications companies. Kape Technologies acquired the company in September 2021, placing it alongside CyberGhost and Private Internet Access under one corporate umbrella - a consolidation trend that has drawn scrutiny from privacy advocates wary of reduced competition among providers that once marketed themselves as rivals. The apps themselves remain closed source, even though Lightway's code is public under the AGPL-3.0 license, meaning users must still trust the company's binaries even as its protocol is open to inspection. Pricing follows an industry-wide pattern that deserves attention: long-term plans carry steep introductory discounts, then renew at considerably higher rates, a structure that rewards attentive shoppers and penalizes those who forget to cancel or renegotiate.