ExpressVPN is safe to use. It sits in the British Virgin Islands, and its servers are RAM-only. Outside firms have examined the no-logs policy repeatedly. Turkish police once seized one of its servers and found nothing on it. ExpressVPN was bought in 2021 by a company with an adware past, and its chief information officer had a history that made headlines the same year.
Neither has produced a privacy failure since. Both are covered below, so you can weigh them yourself instead of taking a verdict on faith.
Is ExpressVPN Legit? Who Owns It
Yes, ExpressVPN is a legitimate company with a 15-year trading history. It was founded in 2009 and is registered in the British Virgin Islands. The territory has no data retention requirement and no membership of the 14 Eyes intelligence-sharing group. A BVI company cannot be quietly compelled by a US or UK court to start recording what a named customer does.
In September 2021, Kape Technologies bought it, which also owns CyberGhost, Private Internet Access, and the security software maker Intego. The technical foundation is famous TrustedServer. Every server boots from read-only memory with no hard drive, so the entire software stack is reinstalled from scratch on each restart, and nothing persists between reboots.
A server physically removed from a rack has nothing on it to read. ExpressVPN was first to market with this design, and it is now the standard the rest of the industry copies, including NordVPN and Proton VPN.
Encryption, Lightway, and Post-Quantum Protection
ExpressVPN uses AES-256 with a 4096-bit RSA key for the control channel and SHA-512 HMAC authentication. Those are the same primitives protecting online banking, with no known practical attack against any of them. We would skip the phrase “unbreakable” here, since encryption is rarely what fails. Implementation is. Three protocols are available in the app.
Lightway is ExpressVPN’s own, built on the wolfSSL cryptography library. It was written to be small enough to audit properly, its main argument over OpenVPN’s larger codebase. It reconnects almost instantly when a phone switches from Wi-Fi to mobile data. OpenVPN remains in UDP and TCP forms, and IKEv2 covers macOS and iOS. Lightway also includes post-quantum protection.
It answers a specific threat called harvest-now-decrypt-later. An adversary records your encrypted traffic today and warehouses it, waiting for quantum computers capable of breaking it open. ExpressVPN added quantum-resistant key exchange to Lightway via wolfSSL, ahead of most of the market. Obfuscation is built into the standard servers instead of a separate list.
So, connections are disguised automatically on networks that block VPN traffic. That is what makes it workable in heavily censored countries like China.
No-Logs Policy: Audits + Court Proof
Every VPN says it keeps no logs. ExpressVPN is one of a very small number that has been forced to prove it. In January 2017, Turkish investigators seized an ExpressVPN server in Turkey during the investigation into the assassination of the Russian ambassador in Ankara. Investigators believed the suspect had used the service to delete evidence.
They imaged the server and found nothing, because there was nothing on it to find. A courtroom test beats any promise on a marketing page. The paperwork backs the same claim. ExpressVPN has commissioned repeated independent assessments, including KPMG on the no-logs policy itself and Cure53 on the Lightway protocol, the browser extensions, and the TrustedServer architecture.
The policy states that browsing history, traffic destinations, DNS queries, and connection timestamps are never recorded. Our no-logs VPN comparison sets out how that stacks up against the field.
The Two Things That Dented ExpressVPN’s Reputation
Anyone searching whether ExpressVPN is still trustworthy is usually thinking of one of these. But let us explain the situations.
➡️ The Kape acquisition. Kape Technologies bought ExpressVPN in September 2021. Kape was previously called Crossrider, whose browser extension platform was widely used to distribute adware. The company changed its name and direction from about 2016 and now owns a portfolio of privacy products. ExpressVPN’s audits, infrastructure, and policy have all continued under Kape ownership, and no logging incident has surfaced in the years since.
➡️ The chief information officer. In September 2021, the US Department of Justice announced settlements with three former intelligence operatives over Project Raven, a hacking-for-hire operation working for the United Arab Emirates. One of them, Daniel Gericke, was ExpressVPN’s CIO at the time. ExpressVPN said it had known his background before hiring him and kept him in post.
➡️ One technical stumble. In 2024, ExpressVPN disclosed a bug in the Windows app’s split tunneling feature that sent DNS requests outside the tunnel. A researcher found it through the company’s bug bounty programme. ExpressVPN pulled the feature, fixed it, and published the details. Finding your own bugs and announcing them is the behaviour you want.
Leak Protection and Network Lock
Encryption is worthless if your real IP address escapes around the side of the tunnel, which is why this is the check that decides the question. We tested for DNS, IPv6, and WebRTC leaks across servers in several regions and on each protocol.
No leaks appeared, and the private DNS resolvers on every server mean queries never reach your internet provider. The tests were last performed in August 2026. Network Lock is ExpressVPN’s kill switch. We dropped the connection deliberately, and all traffic stopped until it came back.
Our kill switch guide explains what separates a good implementation from a token one. Threat Manager blocks connections to trackers and malicious domains, and the ad blocker cut page load times noticeably on ad-heavy sites.
Is ExpressVPN Illegal?
No, not in the US, the UK, Canada, Australia, or across the EU, where using a VPN is entirely lawful. A small number of countries restrict or ban them, China, Russia, Iran, and the UAE among them, and there the legal risk attaches to the person using it. Using a VPN also does not change the legality of what you do through it.
Piracy is still piracy with an encrypted connection. For the position in individual jurisdictions, see our breakdown of VPN legality worldwide.
Verdict: Is ExpressVPN Safe?
Yes. The encryption is standard and correctly implemented, and Lightway is auditable and quantum-resistant. TrustedServer removes the hard drives that would store something. The no-logs policy survived an actual government seizure; it leaked nothing in our tests, and Network Lock is enabled before you touch a setting.
Kape’s history as Crossrider and the decision to retain Gericke in 2021 are worth weighing, and no audit resolves them. What we can say is that five years of independent assessments since the acquisition have found nothing wrong with the product. If it bothers you, the ExpressVPN alternatives page covers more options.
If it does not, this remains one of the most secure VPNs. The full picture is in our ExpressVPN review, and it faces its closest competitor in an updated ExpressVPN vs NordVPN duel we recently prepared for you.
Is ExpressVPN Safe: Frequently Asked Questions
🛡️ Is the ExpressVPN Lightway protocol safe to use?
Yes. Lightway is built on the wolfSSL cryptography library, which holds FIPS 140-2 validation, and the protocol has been examined by Cure53. Its small codebase is a deliberate design choice, since fewer lines of code leave fewer places for a flaw to hide.
🤓 Is ExpressVPN a good VPN for beginners?
Yes. The apps open on a single connect button, the kill switch is active by default on desktop, and no configuration is needed. Support is available on live chat at any hour, which covers the router setups that trip people up.
🧅 Does ExpressVPN work with Tor?
Yes. Routing Tor through the VPN hides Tor use from an internet provider and adds a layer the exit node cannot see past. The trade-off is speed, since two layers of encryption apply at once.
📝 Does Kape share data with its sister VPNs?
No. Each brand under Kape operates its own infrastructure and privacy policy, and no shared logging arrangement has been identified. The diskless server design also means there would be no stored activity data available to share.