A server seized by investigators after a 2016 assassination in Turkey, examined for clues about who had been using it, turned up nothing linking it to any individual. That episode remains one of the more concrete real-world tests of a privacy promise that most providers can only assert, not prove. ExpressVPN has built much of its reputation on that single data point, along with a broader architecture designed to minimize what any server, anywhere, actually knows about its users.
The mechanics are familiar to anyone who has used a vpn app before: traffic leaves a device encrypted, travels through a server in a country the user selects, and emerges onto the open internet carrying that server's address rather than the user's own. What distinguishes one provider from another is rarely the basic concept - it's the protocol doing the encrypting, the jurisdiction holding the company accountable, and whether the no-logs promise has ever been tested outside a marketing page. ExpressVPN's own protocol, Lightway, now sits at the center of that pitch, offering a lighter, faster alternative to older standards while still supporting WireGuard and OpenVPN for users who want them. vpn app
Founded in 2009 by Peter Burchhardt and Dan Pomerantz, the company is incorporated in the British Virgin Islands, a jurisdiction with no mandatory data-retention laws for communications providers. That legal structure matters as much as any encryption algorithm, because a no-logs policy is only as credible as the government that can or cannot compel a company to break it. Kape Technologies, which also owns CyberGhost and Private Internet Access, acquired ExpressVPN in September 2021 - a consolidation that has drawn some scrutiny in the privacy community, given how much of the consumer VPN market now sits under a small number of corporate umbrellas.
What TrustedServer Actually Changes
Since 2019, every ExpressVPN server has run on what the company calls TrustedServer: machines that boot from a fresh read-only image each time and never write data to a hard disk. In practice, this closes off a specific risk - a server seized or compromised has no persistent log file to hand over, because none was ever created. KPMG's assessment of these controls in February 2025 adds an external check to a claim that would otherwise rest entirely on the company's word. No audit eliminates every theoretical risk, but independent review is the closest the industry has to a verification standard, and most providers still don't submit to it.
Open Source, Closed Source, and the Trust Gap
ExpressVPN publishes Lightway under the AGPL-3.0 license, letting outside researchers examine how the protocol handles encryption and connection negotiation. The applications themselves remain closed source, which means the interface and surrounding software can't be independently inspected the way the protocol can. This split is common across the industry and reflects a real tension: full transparency invites scrutiny that strengthens trust, but it also exposes implementation details that competitors can copy outright.
The Price of Convenience
Multi-platform support - Windows, macOS, Linux, iOS, Android, smart TVs, and dedicated router firmware - makes ExpressVPN usable across nearly any device a household owns, and higher-tier plans bundle a password manager and identity-monitoring tools. The trade-off is pricing structure: long-term plans carry steep introductory discounts that disappear at renewal, a pattern worth checking before committing, since the second-year cost often looks very different from the first.