ExpressVPN

ExpressVPN has assembled the deepest published audit portfolio in the consumer category — 20+ cycles across multiple firms. The structural questions aren't about the audit program; they're about who operates the service. Kape Technologies' corporate background and a 2021 DOJ disclosure about a former executive are both public record and don't disappear because the audits are clean.

The Trust Center consolidates audits from Cure53, KPMG, PwC, and others covering apps, infrastructure, and the Lightway protocol. Lightway's core is open-source on GitHub with its own Cure53 audit. Kape Technologies acquired ExpressVPN in 2021, inheriting a corporate history that includes adware distribution under a prior identity. A 2021 DOJ action named a former CIO for UAE surveillance work predating his ExpressVPN tenure — the company responded with new vetting procedures, but the event is on record. BVI jurisdiction is structurally favorable. Neither the Kape history nor the DOJ disclosure is an audit failure; they're context for evaluating who runs the service.

Lightway is ExpressVPN's answer to WireGuard — a purpose-built alternative, not a wrapper. The open-source core and Cure53 audit give it more verifiability than most proprietary protocols. Automatic obfuscation and a default-on firewall-level kill switch remove decisions from the user. The trade-off is that when something behaves unexpectedly, there's limited configuration surface to investigate.

Lightway uses wolfSSL as its cryptographic foundation, with the protocol core on GitHub and audited by Cure53. Automatic obfuscation activates in environments blocking standard VPN protocols without manual intervention. Network Lock kills all traffic at the OS firewall level from the moment the app starts — not only on unexpected VPN drops. On iOS, on-demand VPN mode is used rather than firewall-level locking, which behaves differently when iOS terminates the app under memory pressure. No multi-hop routing. The simplicity works precisely until a user needs to understand or adjust what's running.

MediaStreamer extends the 'it just works' approach to devices that can't install an app — Smart TVs and consoles get DNS-level access without any configuration. The broader streaming library runs across the general fleet without labeled categories or published guarantees, which is consistent with how ExpressVPN handles most things: functional by default, not optimized for power-user control.

MediaStreamer is a DNS-level proxy enabling streaming geo-unblocking on devices without native VPN app support. Netflix across multiple markets, Disney+, BBC iPlayer, Prime Video, and Hulu are reported accessible on the general fleet. No platform-labeled server categories. No published guarantee list. When a streaming platform updates its detection and blocks a set of IPs, ExpressVPN rotates through the fleet — the fix is infrastructure-level, not user-facing. The approach works invisibly when it works; there is no manual override path when it does not.

TrustedServer isn't a policy claim — it's an audited implementation. That distinction is the ExpressVPN approach applied to infrastructure: the premium price includes verified architecture, not just stated architecture. Lightway exists for the same reason: a protocol built and audited by ExpressVPN rather than adopted and trusted.

TrustedServer means every VPN exit server runs on volatile memory — no data persists between sessions. PwC audited the TrustedServer implementation across scoped servers; DNS infrastructure and support systems fall outside the audit scope. Lightway delivers throughput comparable to WireGuard on nearby connections — a purpose-built protocol rather than an adopted one, with its own Cure53 audit. Fleet size is mid-tier relative to the largest networks. The architecture quality and the audit verification are where ExpressVPN's differentiation sits, not the server count.

The interface is built around removing decisions. Large connect button, automatic server selection, no visible protocol negotiation. Browser extensions route all system VPN traffic — not just browser sessions — a capability distinction that only becomes apparent when you need it. Split tunneling gap on iOS only surface when users start wanting per-app control.

One large connect button, automatic server selection, Lightway negotiating protocol invisibly. Browser extensions for Chrome, Firefox, Edge, and Brave control the full system VPN tunnel, not just browser proxy traffic. Split tunneling covers Windows, macOS (all incl. Apple Silicon), Android, and Linux — iOS excluded from split tunneling. The design reduces configuration by intent, which works well for users who want a VPN that runs quietly and poorly for users who eventually want to understand routing decisions.

Aircove is ExpressVPN's hardware answer to the connection cap problem. Rather than raising the connection limit — which would require users to manage more devices — the solution is a router that makes the device count invisible. The complexity moves into hardware; the user experience stays simple.

14 simultaneous connections. Browser extensions for Chrome, Firefox, Edge, and Brave route the entire system VPN connection — not browser-only proxy traffic, which distinguishes them from extensions that only proxy browser sessions. Aircove is a dedicated hardware router: connect it to your network and all devices get VPN coverage without individual app configuration or counting connections. For households that exceed 14 devices, Aircove moves the complexity into hardware rather than asking users to manage it. The connection cap remains the constraint for users who want software-only unlimited coverage.

ExpressVPN's renewal pricing matches the advertised annual rate — no introductory discount cliff at year two. That predictability is the trade-off for sitting at the top of the category price range from day one.

Annual pricing is consistent between the first year and renewals — no gap between promotional and standard rates. ExpressVPN sits at the premium end of the category at renewal as well as at signup. A money-back guarantee applies to all plans; refunds require contacting live chat rather than self-service. No free tier. For users who want predictable billing over promotional value, the structure is among the most straightforward in the category — you pay the premium consistently rather than chasing introductory pricing cycles.

In 2021, ExpressVPN discovered a key exposure during an internal audit and published it through the Trust Center before external discovery. That sequence — internal discovery, proactive disclosure — is what the Trust Center is for. At the premium price point, the disclosure infrastructure is part of what's being sold.

TrustedServer RAM-only architecture is PwC-verified across scoped servers. In 2021, an internal server audit discovered a temporary IPsec key exposure via a misconfigured Linksys router integration. ExpressVPN published the disclosure through the Trust Center proactively — before the incident was discovered externally. No user VPN traffic was compromised. No public uptime SLA. The 2021 event demonstrates the Trust Center mechanism working as designed: not a perfect security record, but a structured way of surfacing what goes wrong.