Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Is ExpressVPN safe, as so many Reddit threads ask? The same two questions keep coming up, so we answer them directly. On the evidence side, ExpressVPN lists 27 independent audits by May 2026, including three KPMG no-logs reports, and runs its servers from memory. On the concern side, its owner Kape began as Crossrider, whose platform adware makers used. Its former chief information officer, Daniel Gericke, reached a deferred prosecution agreement with US prosecutors in 2021 over hacking work for the UAE before he joined.
This guide covers the audits, the Kape history, the Gericke case, jurisdiction and who should choose something else.
Is ExpressVPN Safe? The Audit Record Reddit Cites
ExpressVPN lists 27 independent audits by May 2026, our tables record. They include three KPMG no-logs assurance reports, the latest in February 2025, PwC Switzerland reviews in 2019 and 2020, and Cure53 tests of its apps, Lightway protocol and TrustedServer system.
That is more than NordVPN’s six or Mullvad’s ten-plus. Our ExpressVPN audit guide lists them by type.
Kape and Crossrider
Kape bought ExpressVPN for $936 million in September 2021, the largest recorded VPN deal, gHacks noted. Kape was called Crossrider until 2018. Ad-injecting browser extensions used its platform, and Malwarebytes classified Crossrider products as adware, reports from gHacks and CyberInsider note.
CyberInsider adds that most of Crossrider’s leadership left and Kape’s chief executive was never part of Crossrider. Kape also owns CyberGhost, PIA and ZenMate, and review sites including vpnMentor and Wizcase, which readers should weigh when those sites praise Kape brands.
The Gericke Case
Daniel Gericke became ExpressVPN’s chief information officer in December 2019. In September 2021, the US Justice Department announced a deferred prosecution agreement with him and two others. It concerned hacking services for the UAE between 2016 and 2019 without required export licences, and he paid $335,000, reports note.
ExpressVPN said it knew the key facts before hiring him and did not condone the project. Reuters reported that some staff raised concerns internally, a 2026 review notes. A 2026 review describes him as the then-CIO; we could not confirm his current role.
Is ExpressVPN Safe Technically?
Its servers run from memory under TrustedServer, so they write nothing to disk, and Lightway uses post-quantum key exchange. Network Lock blocks traffic if the tunnel drops, and its Cure53-tested apps have published reports.
Those protections address data on servers and leaks on your device; they do not answer ownership questions, which is where most Reddit debate sits.
Jurisdiction
ExpressVPN is based in the British Virgin Islands, outside the Five Eyes alliance. Its parent Kape, a British-Israeli company, is about 64% owned by Unikmind Holdings, gHacks reported. Kape is now privately held, so it publishes less than a listed company would.
Our Five Eyes VPN guide explains what jurisdiction means in practice.
What Reddit Users Weigh When Asking If ExpressVPN Is Safe
The recurring Reddit argument sets audits against ownership. Audits show how the service handles data now; they cannot rule out future changes by an owner with an adware past. People who see Kape and Gericke as disqualifying usually move to Mullvad or Proton.
Our ExpressVPN alternatives guide lists options.
The ExpressVPN Safe Reddit Debate in Brief
Reddit discussions about whether ExpressVPN is safe tend to split along one line. Some people trust audits of how the service runs today; others weigh who owns it and who it has hired. Both sides use the same facts.
Neither the audits nor the ownership history settles it alone, which is why we set them side by side here for you to weigh.
What the Audits Do Not Cover, and Using It Safely
A no-logs audit checks systems and policies at the time of the audit. It cannot promise that a future owner, a court order in a new jurisdiction or a policy change will not alter things later.
Repeat audits narrow that gap, which is why ExpressVPN’s run of KPMG reports matters more than any single one of them.
Keep the apps updated, leave Network Lock on and use Lightway or WireGuard. Run a DNS and WebRTC leak test after setup, since leaks bypass even the best server design.
Pay with a method you are comfortable linking to your account; ExpressVPN accepts cards, PayPal and other options.
Our Verdict on Risk
For everyday privacy, streaming and public Wi-Fi, ExpressVPN’s 27 audits outnumber NordVPN’s six and Mullvad’s ten-plus. For journalists, activists or anyone whose threat model includes the owner itself, the ownership history is a fair reason to choose a provider with simpler ownership.
ExpressVPN’s Basic plan renews at $99.95 a year for 10 devices, our tables record, and new users get 30 days to ask for a refund.
How We Research
This page draws on gHacks’, CyberInsider’s and Tech Advisor’s coverage of the Kape acquisition and the Gericke case, a 2026 ExpressVPN review, Kape’s Wikipedia entry, ExpressVPN’s trust pages and our audit tables. We cross-checked these sources against each other, and where they conflict or something can’t be verified, we say so in the text rather than guessing. We checked time-sensitive figures, including prices in US dollars, on 8 October 2026. The main source we relied on is CyberInsider’s report on Kape. Our full approach lives on the About Us page.
Is ExpressVPN Safe FAQ
For everyday privacy, its 27 audits make a strong case.
Kape, formerly Crossrider, since 2021.
Its then-CIO reached a 2021 deferred prosecution agreement over earlier hacking work for the UAE.
Mostly Kape’s adware-linked past and the Gericke case.
High-risk users who count the owner in their threat model.
The Verdict
Is ExpressVPN safe? Its audits say yes for everyday use. Its ownership history is the honest reason some Reddit users still look elsewhere.