A VPN's worth is measured not by its marketing but by what happens when investigators actually seize a server and go looking for evidence. ExpressVPN has that rare distinction: its no-logs claim has been tested in the field, not just on paper. That single episode, more than any slogan, explains why the service remains a reference point in discussions about digital privacy tools.
The mechanics are straightforward in concept, if intricate underneath. ExpressVPN encrypts a device's internet traffic and routes it through a server in a country the user selects, masking the original IP address and shielding data from local networks, internet providers, and anyone watching the connection point. The company builds apps for Windows, macOS, Linux, iOS and Android, along with support for smart TVs and its own router firmware, which extends encryption to every device on a home network at once. For readers comparing options across the wider market, resources like see here offer a useful starting point before committing to a plan.
Lightway and the Protocol Question
At the center of the service sits Lightway, a protocol ExpressVPN wrote itself and later released as open source. Protocols determine how data gets packaged and tunneled between a device and a server, and they shape speed, battery use, and how quickly a connection recovers after a network switch. Lightway was designed to be leaner than older standards, and publishing its code allows independent researchers to inspect it rather than take the company's word for its security. WireGuard and OpenVPN, two widely trusted protocols in the broader VPN industry, remain available for users who prefer them or need compatibility with specific setups.
What "No Logs" Actually Means
Claiming not to keep logs is easy; proving it is not. Two things give ExpressVPN's claim unusual weight. First, after a 2016 assassination in Turkey, authorities seized one of its servers hoping to trace a suspect's online activity, and investigators found no logs capable of identifying any user. Second, the accounting firm KPMG assessed the company's no-logs controls in February 2025, adding an external audit to a claim that had already survived a forensic seizure. Since 2019, every server in the network has run on ExpressVPN's TrustedServer system, which boots from a fresh software image each time and writes nothing to a hard disk, so there is no persistent record for anyone to recover later, whether that's a hacker, a rogue employee, or a government agency with a warrant.
Ownership, Jurisdiction and Cost
ExpressVPN was founded in 2009 by Peter Burchhardt and Dan Pomerantz and is incorporated in the British Virgin Islands, a jurisdiction with no mandatory data-retention laws that would force a VPN to log user activity. In September 2021, Kape Technologies acquired the company, placing it alongside CyberGhost and Private Internet Access under one corporate umbrella - a consolidation that has drawn scrutiny from privacy advocates wary of concentrated ownership in a market built on independence and trust. Pricing follows a familiar pattern across the industry: longer subscriptions carry steep introductory discounts that disappear at renewal, so the headline rate rarely reflects long-term cost. Higher-tier plans bundle in extras like a password manager and identity-protection tools, which can be worthwhile but should be weighed against standalone alternatives. The apps themselves remain closed source, even though Lightway's code is public under the AGPL-3.0 license - a split that leaves most of the user-facing software unverified by outside researchers, even as its core transport protocol is open for anyone to examine.