← VPNs
D

ExpressVPN

Serious concerns
Kape · 🇨🇾 Cyprus
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
App: com.expressvpn.vpn
Manufacturer: Kape Technologies

The bottom line

ExpressVPN is owned by a company that used to inject ads into browsers. The owner was convicted of fraud. They went private so nobody can see what they're doing. ExpressVPN's tech chief built hacking tools for a dictatorship to spy on journalists. They knew when they hired him. Multiple executives have military intelligence backgrounds.

Legal jurisdiction
🇨🇾 Cyprus (headquarters)
✓GDPR (Cyprus DPA) read more →
EU data protection applies. Small authority, limited enforcement track record
D
Parent company: Kape Technologies
Formerly Crossrider adware platform, Sole owner Teddy Sagi convicted of fraud, Owns "independent" VPN review sites +1 more
4 structural risks · 2 products →
Audited by: KPMG (ISAE 3000 (limited), Sep 2024) · Cure53 (pen test, Apr 2022) · F-Secure (pen test, Jan 2022)
An audit is a snapshot, not a guarantee. How reliable are these auditors?
Spying
4/4 EXTREME
Is someone spying on me?
Data Sharing
2/4 MODERATE
Who gets my data?
Security
2/4 MODERATE
Is it actually secure?
Honesty
2/4 MODERATE
Can I trust what they say?
REPLACE Extreme risk. Look for alternatives or lock down hard.
Use Mullvad instead
Police raided, found nothing. Anonymous accounts, cash by mail
See report →
6Contradictions
0Critical
3High
3Medium
4Sources
Findings by concern
Spying 4/4 EXTREME 4 findings
⚡ highpolicy claims vs regulatory findings
ExpressVPN is owned by a company that used to inject ads into browsers. The owner was convicted of fraud. They went private so nobody can see what they're doing.

What they claim: ExpressVPN is a privacy-first company protecting users from surveillance.

What we found: Parent Kape Technologies (formerly Crossrider) classified as adware by Symantec/MalwareBytes. Injected ads via browser extensions. Founder Teddy Sagi convicted of fraud. Went private 2023, eliminating oversight. 180 employees laid off.

⚡ highpolicy claims vs regulatory findings
ExpressVPN's tech chief built hacking tools for a dictatorship to spy on journalists. They knew when they hired him. Multiple executives have military intelligence backgrounds.

What they claim: ExpressVPN's leadership is dedicated to user privacy.

What we found: CIO Daniel Gericke built zero-click surveillance (Karma) for UAE's Project Raven targeting journalists and Nobel laureate. DOJ deferred prosecution ($335K). Announced one day after $936M acquisition. Co-founder: former Unit 8200.

⚡ highregulatory findings vs firmware analysis
ExpressVPN says it's in the British Virgin Islands, but the company that owns it operates from the UK, Isle of Man, and Israel -- all with intelligence ties.

What they claim: BVI jurisdiction protects from surveillance.

What we found: BVI is operating entity but parent chain: UK/Isle of Man/Israel. All have Five Eyes/intelligence cooperation. BVI independence from parent never tested post-acquisition. 2023 privatization removed oversight.

⚫ mediumfirmware analysis vs policy claims
The no-logs claim is actually true -- police seized a server and found nothing. The technology works. The question is whether the owners can be trusted.

What they claim: ExpressVPN has a strict no-logs policy.

What we found: Turkey seizure (2017) validated -- police found nothing. Four KPMG audits confirmed. TrustedServer RAM-only. Technical controls are real. The concern is corporate ownership, not technology.

Data Sharing 2/4 MODERATE 1 finding
⚫ mediumapp permissions vs policy claims
ExpressVPN's app includes marketing trackers that report which ads brought you and how you use it. A privacy VPN tracking your behavior is a contradiction.

What they claim: ExpressVPN app respects user privacy.

What we found: Exodus: 4 trackers (AppsFlyer, Firebase Analytics, MixPanel, CrashLytics). 25 permissions including fine location, camera, ad ID. AppsFlyer and MixPanel are marketing/behavioral analytics.

Honesty 2/4 MODERATE 1 finding
⚫ mediumpolicy claims vs regulatory findings
The "independent" VPN review sites recommending ExpressVPN are owned by Kape Technologies — the same company that owns ExpressVPN. Kape paid $149 million to acquire review sites including vpnMentor and Wizcase. When you search "best VPN" and click the top results, the reviews, the affiliate links, and the recommended product are all controlled by one company. The review ecosystem is a marketing funnel disguised as journalism.

What they claim: Independent review sites recommend ExpressVPN on merit.

What we found: Kape bought vpnMentor and Wizcase for $149.1M. Post-acquisition: all awards went to Kape products. Competing VPNs dropped. Ownership buried. Both claim independence.

Sources