ExpressVPN

A VPN company that now sells a wider privacy lineup

ExpressVPN has sold a VPN since 2009, according to the timeline on its About page, and the VPN is still the center of what it sells. Around it the site now groups a set of other products under one subscription pitch: ExpressMailGuard (an email relay), ExpressKeys (a password manager), ExpressAI, Identity Defender (marked "U.S." on the homepage) and Fortify, a VPN router. Its navigation calls this "a fast-growing suite of privacy and security tools." The menu also lists holiday.com, an eSIM service, and Intego, a macOS antivirus brand, as "other products from the family behind ExpressVPN." On ownership, the About page timeline says that in 2021 ExpressVPN "joined the Kape Technologies family of leading privacy and security brands." The site says little more about that parent company.

On who can buy it, the site presents itself as a global service. It lists servers in 113 countries, carries a long language menu running from Spanish and German to Arabic, Korean, Thai and Vietnamese, and routes visitors from the United Arab Emirates to a separate UAE website, with a notice that the content "is not available in your region." The homepage headline shows the VPN "Now at $2.99 /mo," with a footnote that the price may include VAT or sales tax. Downloads are offered for Windows, macOS, Linux, iPhone and iPad, Android, Apple TV, Fire Stick, Android TV, routers and game consoles, plus Chrome, Firefox and Edge extensions. The refund terms note that App Store and Google Play purchases are refunded through Apple or Google rather than by ExpressVPN.

The KPMG audit, and what the provider says it logs

ExpressVPN's Policy Towards Logs page lists third-party reports on its no-logs policy and server technology. It names an audit by KPMG of its privacy policy, including its no-logs policy (December 2023), an earlier KPMG audit of the no-logs policy (September 2022), a security audit by Cure53 of TrustedServer, its in-house VPN server technology (May 2022), and an audit by PwC Switzerland of its privacy policy compliance and TrustedServer (June 2019). The page says these firms were engaged "to exhaustively examine our systems to confirm whether our VPN servers are in compliance with our privacy policy, including our policy of not collecting activity logs or connection logs."

The company's October 2022 blog post on the KPMG engagement explains the method. It says KPMG tested the controls framework and interviewed staff to check the processes and systems meant to keep the VPN servers in line with the privacy policy, including the policy of not collecting activity or connection logs, and that the audit was run under ISAE (UK) 3000 Type 1. The same post says Cure53 ran a source code audit and white-box assessment of TrustedServer, and quotes Cure53 that "mostly general weaknesses and minor flaws were spotted." The post says the full KPMG report is available once a reader accepts KPMG's terms. Separately, the Teams page claims "23+ independent No-logs policy and security audits" without listing them there.

The provider's own logging claim sits apart from those reports. ExpressVPN states that it does not collect browsing history, traffic destination or metadata, DNS queries, or the IP addresses a user is assigned on connecting, and that its servers keep data in RAM, which is erased every time a server reboots. It says it does record which apps and app versions a user activated, the dates (not times) of connections along with the VPN location and source country, and the total amount of data transferred. It also collects anonymized speed test data, connection failures and crash reports, which the settings let a user switch off.

On jurisdiction, the logs page states, "We're registered in the British Virgin Islands, which is a jurisdiction with strong privacy laws." The About page FAQ says the company "operates from the British Virgin Islands."

Apps, protocols, servers and streaming

The apps run ExpressVPN's own Lightway protocol, which the About page says was re-engineered in Rust in 2025, alongside WireGuard, and a Tor page mentions IKEv2 as another option. The feature list includes a kill switch (Network Lock), split tunneling, private encrypted DNS, Threat Manager (a DNS-based blocker for trackers and malicious sites), an ad blocker, parental controls and a dedicated IP option. The About page adds ShuffleIP, which changes the user's IP address periodically, and post-quantum protection in Lightway and WireGuard. It also says physical servers were withdrawn from India in 2022; the logs page says the company still offers virtual servers that give an Indian IP address.

The site gives its network as servers in 113 countries, and the Teams page adds "all 50 U.S. States." The Tor page mentions "40Gbps servers," and the About page says 1Gbps servers began to be replaced with 10Gbps servers in 2022. The site does not publish speed test results.

For streaming, the service page names Netflix, Hulu, BBC iPlayer, Disney+, Max, Amazon Prime Video, DAZN and dozens of regional channels among the services it says it can be used with, and its FAQ answers "Yes" on whether it works with Netflix, Hulu and HBO. That list is the provider's claim. The homepage says a VPN lets P2P users "download with increased anonymity," but the site does not set out a torrenting policy. A Tor page explains how to run the Tor Browser over the VPN ("Onion over VPN").

Price, payment, devices and refunds

The only consumer price on the site is the homepage headline figure of $2.99 per month. The homepage does not say which plan length that rate applies to or how it is billed, and the site does not state a renewal price. A banner advertises "up to 80% off" with a countdown timer. One subscription covers up to 14 devices at the same time, according to the logs page. There is no free plan; the FAQ tells readers that ExpressVPN "is a paid VPN."

The refund promise is a "30-day money-back guarantee" for first-time users, and the logs page puts it as "contact Support within 30 days and get a full refund." Payment methods for the consumer plan are not listed. The About page timeline says the company began to accept Bitcoin in 2014, and the Teams FAQ says Teams subscriptions can be paid by Apple Pay, Google Pay, credit or debit card and PayPal. The support menu includes a "Redemption Code" entry but does not explain it. Support runs through 24/7 live chat and email, a support center and setup tutorials.

ExpressVPN for Teams is a separate business plan with an admin dashboard, "flexible pricing for up to 500 users," terms of 1 month, 12 months or 24 months, and a dedicated IP add-on "available on 1 & 2 year subscriptions." The Teams page gives no price.

What stays open

The biggest gap for a buyer is cost. The site shows a single monthly figure without the plan length behind it, gives no renewal price and does not list consumer payment methods, so the real price of a year needs to be checked at checkout. The streaming list is long, but it is the provider's own list, with no date attached. On ownership, the site names Kape Technologies as the family ExpressVPN joined in 2021 and names sibling brands, but says little else about the group or where it is based.

What the site does document in detail is its audit trail. The logs page names KPMG, Cure53 and PwC Switzerland, each with a scope and a month, and the blog post explains how KPMG tested the controls. That, together with the RAM-only server design and the list of what the apps do record, gives a reader something concrete to check the no-logs claim against.

It suits a buyer who wants a named audit, broad device support from phones to routers and consoles, and a refund window to try it, and who will confirm the plan price and renewal terms before paying. Someone who needs a free tier, or who wants every cost printed up front, will find less here.