ExpressVPN Completes 23rd Total Privacy Audit

ExpressVPN recently announced that it had undergone its 23rd successful independent audit of its privacy practices. It’s the 3rd audit completed by KPMG LLP, one of the “Big Four” accounting firms, this time examining its TrustedServer technology and privacy policy claims as of 28 February 2025.

According to ExpressVPN’s official notice, “KPMG provided reasonable assurance that our systems functioned as designed, with no identified issues regarding our technical safeguards against activity logging.” The review was conducted according to the Assurance Engagements (ISAE) (UK) 3000 Type 1, a globally recognized and official standard issued by the International Auditing and Assurance Standards Board (IAASB).

ExpressVPN operates based on a strict no-logs policy, which reads “We do not collect logs of your online activity while you are connected to our Services, including no logging of browsing history, traffic destination, data content, or DNS queries.” It continues that ExpressVPN will “never store connection logs, meaning no logs of your IP address, your outgoing VPN IP address, connection timestamp, or session duration.”

Its TrustedServer system strongly ties in with this policy, providing a technological framework that ensures user technology isn’t permanently stored. It means that its servers run on 100% RAM architecture, so no data is stored persistently. It also specifies that these servers are frequently rebooted to ensure that all temporary, memory-based data is wiped.

Furthermore, all servers run a custom, secure operating system image that’s verified and cryptographically signed to prevent tampering. Finally, they conduct weekly full OS reinstallations to ensure the latest security patches are applied and that no lingering data remains.

Over the years, ExpressVPN has had similar independent “trust audits” conducted by a variety of reputable firms. Cure53 has assessed its proprietary protocol multiple times, most recently in 2023, as well as its TrustedServer technology, apps, browser extensions, and Aircove routers. Other investigations were conducted by F-Secure, PwC Switzerland, and Praetorian.