Is ExpressVPN Safe?
Privacy Audit 2026

ExpressVPN has long been considered a premium VPN service with strong encryption and a verified no-logs policy. However, its 2021 acquisition by Kape Technologies raised significant concerns in the privacy community. This audit examines whether ExpressVPN's technical privacy protections remain intact under new ownership and whether the corporate relationship should affect your trust assessment.

What Data Does ExpressVPN Collect?

Our analysis of ExpressVPN's privacy policy, terms of service, and technical behavior reveals the following categories of data collection. Each item represents data that ExpressVPN either explicitly states it collects in its privacy policy or that independent researchers have documented through technical analysis.

• •Account email and payment details
• •No connection logs or browsing activity
• •Aggregate bandwidth usage (not per-user)
• •Successful connection data (date only, no times)
• •VPN server location chosen (not IP assigned)
• •App version and diagnostic data (opt-in)
• •Customer support communications

Privacy Concerns

ExpressVPN was acquired by Kape Technologies (formerly Crossrider) in 2021 for $936 million. Kape Technologies has a controversial history, having previously operated an adware/malware business before pivoting to privacy tools. This acquisition raised concerns among privacy advocates about whether ExpressVPN's no-logs policy would remain trustworthy under new ownership.

ExpressVPN has undergone independent security audits including a PwC audit of its no-logs claims and Cure53 audits of its TrustedServer technology and browser extensions. The company operates RAM-only servers (TrustedServer) that wipe all data on reboot. However, the Kape ownership question remains a persistent concern in the privacy community.

ExpressVPN is incorporated in the British Virgin Islands, which has favorable privacy laws and no mandatory data retention requirements. However, the BVI is a British Overseas Territory, and the extent of UK intelligence influence over BVI-registered companies remains debated by privacy researchers.

Our Privacy Grade: B

ExpressVPN earns an acceptable privacy grade. The product provides adequate security and encryption, but there are areas where data collection exceeds what is strictly necessary for the service. The company holds encryption keys to your data, and administrator or employer access to your content is possible.

ExpressVPN remains technically sound with strong encryption and TrustedServer architecture, but the Kape Technologies acquisition is a valid concern. If corporate ownership matters to your threat model, consider Mullvad (fully anonymous accounts, no email required) or ProtonVPN (backed by Proton's established privacy reputation).

Better Alternatives

If privacy is a priority, consider these alternatives to ExpressVPN that offer stronger data protection:

Build your AI-powered toolkit

Professionals use these tools alongside privacy-first alternatives:

More VPN Services Privacy Audits