ExpressVPN

ExpressVPN (Express Technologies Ltd, British Virgin Islands; founded 2009; bought for $936 million on 13 September 2021 by Kape Technologies, which delisted from AIM in May 2023 after Teddy Sagi's Unikmind bought it out) has, on paper, the most complete audit record in the field. KPMG has examined the no-logs policy under ISAE 3000 three times, most recently as of 28 February 2025, with the report public; Cure53 and Praetorian have audited the Lightway protocol, now rewritten in Rust and published under AGPL; TrustedServer runs everything in RAM; the trust centre lists 28 audits since 2018. The product is strong: Lightway, WireGuard and OpenVPN, a kill switch, split tunnelling, Threat Manager, seven UK locations including Docklands and Manchester, 113 countries, 10 to 14 devices by tier, a Linux app, its own Aircove router, 24/7 chat, and a Dedicated IP add-on launched in December 2024 using a blind-token design so the IP cannot be linked to the account (£2.99 a month at checkout, with UK addresses in Docklands and the Midlands, included on the Pro tier). Trustpilot is 4.4 on 28,883 reviews with 7% one-star, and ExpressVPN is not currently inviting them. There is no port forwarding, no device-to-device feature, no SSO on the Teams plan (five licences minimum, per-user price unpublished), and the apps other than Lightway are closed source.

Then the rest of the record. Kape began life in 2011 as Crossrider, a browser-extension platform that a 2015 UC Berkeley and Google study named a major affiliate of ad injectors and that Malwarebytes classed as adware; it renamed itself in 2018 because of "the strong association to the past activities of the company", and it also owns vpnMentor and Wizcase, two of the most-read VPN "review" sites, alongside CyberGhost and Private Internet Access. On 14 September 2021, the day after the Kape deal was announced, the US Department of Justice announced deferred prosecution agreements with three former US intelligence operatives over hacking services to the UAE's Project Raven, one of them Daniel Gericke, ExpressVPN's chief information officer since 2019, who paid $335,000; ExpressVPN said it had known his employment history when it hired him and kept him on. In 2024 the Windows app leaked DNS requests outside the tunnel when split tunnelling was on; in 2025 leftover debug code let remote-desktop traffic bypass the tunnel for several months before a bug-bounty report on 25 April. And the pricing runs the standard playbook: prices to a UK visitor on 7 September 2026 are ex VAT, with Basic £10.99 month-to-month, £3.99 a month on "12 + 3 months" and £2.19 a month on "2 years + 4 months" (£61.32, £73.58 with VAT). To its credit, ExpressVPN prints "then autorenews at £69.95 annually" on the page itself: £5.83 a month, a 166% step. Refunds are 30 days, new subscribers only. None of this makes ExpressVPN a bad VPN. It makes it the one whose owners, conduct and pricing we trust least among ten, and the ranking says so. ExpressVPN runs an affiliate programme; Saaskly has no commercial relationship with ExpressVPN.

Not yet tested by Saaskly: assessed on published pricing, documentation and third-party reviews.