How safe is ExpressVPN? Logs, audits, Lightway and BVI law

For everyday privacy, yes: ExpressVPN records no activity or connection logs, KPMG has checked that promise, and each server boots from RAM with nothing written to disk. VPNRadarLab scores its privacy and security at 5.7 out of 10 each, well above the consumer medians of 2.7 and 2.1, with no red flags and full data completeness. The overall grade lands at 4.77, 14th place among consumer VPNs, and the deductions are specific: a mandatory email, the absence of a published transparency report, and weak performance against heavy censorship.

Who runs ExpressVPN and how BVI law treats a data request

The service is operated by Express Technologies Ltd., registered in the British Virgin Islands, with UK parent company Kape Technologies PLC (details on the ownership page). The BVI sits outside the 5, 9 and 14 Eyes alliances. The company is subject to BVI law, its stated position is that it fights such demands, and since there are no logs tying activity to a user, there is little to hand over even if a demand succeeds.

What the privacy policy lets it collect

The current policy (updated 2 October 2026) keeps a short list: email at sign-up, the date of successful connections, aggregate bandwidth per user, device details (model, OS, app build, random IDs), analytics via AppsFlyer with country taken from a hashed IP, and opt-in crash reports through Sentry and Crashlytics.

Two details matter for interpretation. Connection dates plus traffic totals can show that a subscription went online on a certain day, yet say nothing about the sites visited. And the billing side outlasts the tunnel: transactional emails are kept for 10 years, and payments pass through named processors including PayPal and Stripe.

KPMG, Cure53 and TrustedServer: what the audits cover

Two independent checks back the story. KPMG examined the policy and the server estate; Cure53 went through TrustedServer, the RAM-only setup where a server boots from memory, so a reboot wipes it. Neither audit year is stated in the reviewed data. If an independently checked policy is high on your list, the ranking of audited no-logs VPNs shows which other providers clear it.

Lightway, Network Lock and the rest of the toolkit

Protocols on offer: Lightway (the house protocol, UDP/TCP, pitched as the fastest), WireGuard, OpenVPN and IKEv2, while PPTP and L2TP are not offered. Keep Lightway as the default; move to OpenVPN over TCP on networks that throttle UDP.

Network Lock must stay on for laptops: it blocks all traffic the instant the tunnel drops, which is what protects your real address when you hop between access points at an airport or café. Encrypted queries through ExpressVPN's own resolvers keep the router where you're sitting from reading your lookups. Split tunnelling keeps banking apps outside the tunnel, and Threat Manager filters ad and malware domains.

Why the privacy and security marks stop at 5.7

The strong side is real: a checked no-logs policy, no stored connection IP, no alliance, memory-only servers, a kill switch that works. Privacy loses points over identity: an email is required at registration, logging in by account number is not possible, and the reviewed pages show neither a transparency report nor a warrant canary. Security deductions follow the same logic: the data does not list open-source apps, two-factor login, a bug bounty, post-quantum keys or stated perfect forward secrecy, and there is no multi-hop route. Censorship bypass, the lowest mark at 1.9, reflects generic obfuscation only, with nothing comparable to VLESS Reality or Shadowsocks in the toolkit.

ExpressVPN safety questions

Does ExpressVPN keep my IP address?

No. The policy leaves the source IP out; what gets recorded is the date plus the data volume.

Can I sign up anonymously?

Partly. Email is mandatory, but paying in Bitcoin drops the card link and disables auto-renewal. A disposable mailbox closes the rest of the gap; KYC is not required.

Is it safe on public Wi-Fi?

Yes, with Network Lock enabled: the kill switch and private encrypted DNS are what protect you when an open hotspot drops the tunnel.

Is there a safe free version?

No free plan and no trial. New subscribers get a 30-day money-back window on Basic, Advanced or Pro; that refund is the closest thing to a trial.

Will it beat strict censorship?

Rarely. Generic obfuscation alone earns 1.9, so heavy DPI states are where it struggles most.

ExpressVPN safety verdict

ExpressVPN is safe for its job: an independently checked no-logs policy, memory-only servers, a BVI base outside all Eyes alliances, and a feature set that covers public networks and travel well. It falls short when the task is an account free of any tied email or a dependable route past strict DPI censorship.