ExpressVPN Review (October 2026): Pricing, Audits and Ownership

This page has no affiliate links right now. Every ExpressVPN link below is a plain link, and we earn nothing if you sign up. ExpressVPN has not approved us for its program, and if that changes this line will change with it. See our affiliate disclosure. Editorial placement is decided on merit and is not for sale.

By Lennit Herrera, founder and editor, Shielded Browsing  ·  Last updated October 6, 2026

The verdict: ExpressVPN is one of the best-documented VPNs you can buy, and it is not the cheapest. Its case rests on outside paper: a public audit list that runs from 2018 to May 2026 and includes PwC, KPMG, Cure53 and Praetorian, servers in 113 countries, and RAM-only server software (TrustedServer) that PwC has audited. The headline price is $2.99 a month on the 2-year Basic plan, but the plan renews at $99.95 a year (about $8.33 a month) once the first 28 months are up. Two things to weigh before you buy: Kape Technologies, which owns several VPN brands, is ExpressVPN’s ultimate parent, and a 2021 US Justice Department agreement involving a former ExpressVPN executive is part of the record. Both are covered below.

Plan prices, device limits, the audit list, the transparency report and the privacy policy were read on ExpressVPN’s own pages on October 6, 2026. Court and ownership facts come from the sources linked beside them. We do not test VPNs ourselves, so this page makes no speed or streaming claims.

On this page

• ExpressVPN at a glance
• Pricing: the three plans and the renewal catch
• What its privacy policy says it does and does not keep
• The audit record, and what audits can’t tell you
• Who owns ExpressVPN, and the Gericke question
• What we like and what to watch out for
• ExpressVPN vs the alternatives
• What ExpressVPN can’t do
• Who should buy it, and who should skip it
• How we researched this review
• Frequently asked questions

ExpressVPN at a glance

Starting price: $2.99/mo on the 2-year Basic plan ($83.72 for the first 28 months, then $99.95 a year)  ·  Devices: 10 on Basic, 12 on Advanced, 14 on Pro  ·  Server locations: 113 countries, 24 of them US locations  ·  Protocol: Lightway, with post-quantum protection listed on every plan  ·  Refund: 30-day money-back guarantee for new users, requested through Support  ·  Jurisdiction: British Virgin Islands, per its privacy policy  ·  Parent: Kape Technologies PLC

See ExpressVPN’s current plans on its own site →

Pricing: the three plans and the renewal catch

ExpressVPN’s order page, read on October 6, 2026 under a “fall sports” 80%-off banner, shows three tiers. The tiers are no longer just “the VPN”: each step up adds bundled extras (a private email relay, a password manager, identity-theft tooling), so you are choosing a bundle, not only a VPN.

Source: expressvpn.com/order, read October 6, 2026. All amounts in USD; sales tax is added at checkout where it applies. Each plan’s page also shows a crossed-out list price ($419.72, $475.72, $643.72) that the discount is measured against. The page I read showed only the 2-year plans; shorter terms may appear in a browser, so check before you buy.

The renewal is the number to plan around. The $2.99 is an introductory rate. The page states Basic then “autorenews at $99.95 annually”, which is about $8.33 a month, nearly three times the headline. Advanced renews at $119.95 and Pro at $199.95 a year. In per-month terms Advanced renews at about $10.00 and Pro at about $16.66, so the cost of staying is roughly $100, $120 or $200 a year depending on the tier.

The identity-theft insurance is underwritten by American Bankers Insurance Company of Florida, an Assurant company, and the page says it is subject to the terms and exclusions in the Summary of Benefits. Treat the “$3 million” and “$5 million” as policy limits, not as a promise of what you would recover. A dedicated IP is an optional add-on to Basic and Advanced and included in Pro.

Refund: the page says “If you’re not satisfied in the first 30 days, just ask Support for a refund,” and labels the guarantee as for new users. A first-time buyer has a month to leave; a renewing customer should not assume the same.

What its privacy policy says it does and does not keep

ExpressVPN’s privacy policy (shown as last updated October 2, 2026 when read) draws the line clearly. It says the company does not collect logs of your activity while connected: “no logging of browsing history, traffic destination, data content, or DNS queries.” It also says it never stores connection logs: no record of your IP address, the outgoing VPN IP address, connection timestamps or session duration.

What it does hold is account data: the name, email address and payment details you give it, plus anonymized usage statistics. App diagnostics (failed-connection information, speed test data and crash reports) are collected only if you opt in. The policy also says payment methods that reveal less about you, such as gift cards and Bitcoin, may be available. Fraud and signup-protection partners may see IP addresses, which the policy says are stored separately and can never be tied to VPN traffic “because no record of any such behavior is collected.”

On jurisdiction, the policy says the headquarters and registered place of business is the British Virgin Islands and that Express Technologies Ltd. operates under BVI law. It adds that your data is “controlled by and stored under ExpressVPN, and not by its ultimate holding company, Kape Technologies PLC (UK) or other related entities.” That is the company’s statement, and it is also the clearest official confirmation of who sits above it.

Its transparency report adds numbers. For January to June 2026 it lists 137 government, law-enforcement and civil requests, 1,361,382 DMCA notices and 3 warrants; July to December 2025 shows 155, 1,382,986 and 3; January to June 2025 shows 374, 1,063,598 and 0. The company’s position is that none of the requests resulted in disclosure of user data. That is a self-reported claim: a transparency report tells you what the company says it received and answered.

The audit record, and what audits can’t tell you

This is where ExpressVPN separates itself. Its Trust Center lists external audits in date order. From that list, read October 6, 2026:

• PwC Switzerland, June 2019: its privacy-policy compliance and TrustedServer; June 2020: its build verification process.
• KPMG: a no-logs audit (September 2022), a privacy-policy audit (December 2023) and a third audit of its privacy commitments (June 2025).
• Cure53 (a security consultancy): the browser extension (2018 and October 2022), Lightway (2021, 2022, October 2024), the iOS, Android and Linux apps (2022), Aircove routers (November 2024), then the newer products in 2026: ExpressKeys and ExpressAI (March), EventVPN (April), Identity Defender and ExpressMailGuard (May).
• Praetorian: the third audit of its Lightway protocol (September 2024). F-Secure: the Windows app (March 2022).

Per the Trust Center, the company and the wider Kape Group also hold ISO/IEC 27001, ISO 9001 and ISO 18295 certifications, secured in 2025.

That is a long, dated, named list. Three honest limits apply. First, ExpressVPN commissions and pays for these audits, and it chooses the scope. Second, an audit is a point in time: the June 2025 KPMG work says what the controls looked like then, not what runs on a server today. Third, the audits cover the VPN and product security; they cannot tell you whether the ownership and people behind the company suit you. For the removal-rate side of privacy tooling, where an independent test does exist, see our data removal comparison.

TrustedServer, ExpressVPN’s server software, runs entirely on RAM, so servers are wiped on every reboot. The company says this is why it has nothing stored to hand over; PwC’s audit of it is listed above. We did not read the audit report itself, only the Trust Center listing and the company’s description of it.

Who owns ExpressVPN, and the Gericke question

Ownership. On September 13, 2021, Kape Technologies agreed to buy ExpressVPN for $936 million, per Bloomberg’s report. ExpressVPN’s own privacy policy names Kape Technologies PLC as its ultimate holding company. Kape also owns CyberGhost, Private Internet Access and ZenMate, and Wikipedia lists Israeli businessman Teddy Sagi as Kape’s owner. Wikipedia notes Kape was formerly named Crossrider. If shared ownership across competing VPN brands bothers you, it is a fair reason to look elsewhere. Our CyberGhost review covers one of its sister brands.

The Gericke matter. In September 2021 the US Justice Department announced deferred prosecution agreements with three former US intelligence and military personnel over work for a UAE-based company. The agreement is public: United States v. Baier, Adams and Gericke, Case No. 21-CR-577 in the District of Columbia, charging a conspiracy to commit access-device fraud and computer fraud and abuse. Daniel Gericke’s monetary penalty was $335,000, and the factual statement says he gained at least that much from the UAE company between January 2016 and November 2018. Gericke was ExpressVPN’s chief information officer. In a statement reported by TechTarget on September 16, 2021, ExpressVPN said it had “known the key facts relating to Daniel’s employment history since before we hired him” and would keep him on. We did not verify his current role from a primary source, and the court document does not mention ExpressVPN; the link between the two comes from the company’s own statement and press coverage.

Reasonable people weigh this differently. One view: a deferred prosecution agreement is an admission by a person with sensitive access, and no audit changes that. Another: the audits examine the product, and the company disclosed the matter. We are not telling you which view is right. It is a fact that belongs in the buying decision.

What we like and what to watch out for

What we like

• A long, public audit trail, with names and dates you can check on the Trust Center rather than a vague “independently audited” badge.
• RAM-only servers (TrustedServer), audited by PwC, which limits what exists to seize.
• 113 countries. Virtual locations are marked as such on its server page.
• A published transparency report with request counts every six months.
• Generous device limits: 10 connections even on Basic.

Watch out for

• The renewal. $2.99 a month becomes about $8.33 a month on Basic after 28 months. Put the renewal date in your calendar.
• Bundle creep. The cheap tier is thin on extras, and the plans that add identity monitoring and AI chat are priced around bundles most buyers will not use.
• Parent company and the Gericke matter, covered above. Disclosed, not hidden, but real.
• Audits are self-commissioned and dated, and we could not read every full report.
• Refund applies to new users and goes through Support, not a self-serve button.

Best for: people who want a heavily documented provider and will pay for it. Skip it if: price is the main driver, or Kape’s ownership is a dealbreaker.

ExpressVPN vs the alternatives

• NordVPN. The usual direct rival. See our NordVPN vs ExpressVPN comparison and the NordVPN review.
• Surfshark. Often the cheaper pick; read the Surfshark review.
• Proton VPN and Mullvad. Both lean on privacy credentials and a different ownership picture; see Proton VPN and Mullvad.
• All four head to head: best VPN in 2026. For streaming use, see our streaming guide; for trips abroad, best VPN for travel.

What ExpressVPN can’t do

• It does not make you anonymous. It hides your traffic from your network and swaps your IP. It does nothing about accounts you log into, browser fingerprinting or the data brokers who already hold your profile. See how to stay anonymous online.
• It cannot prove its own no-logs claim to you. You are trusting the audits and the company’s word. An audit narrows the doubt; it does not remove it.
• Insurance and monitoring are not a security product. The identity tools sit on top of the VPN. They do not replace a dedicated password manager or a hardware security key.
• It does not guarantee access to any streaming service. Services block VPNs, and we have no independent test to quote.
• A free VPN is not the alternative. If the choice is ExpressVPN or nothing, read why free VPNs carry their own risks.

Who should buy it, and who should skip it

Buy it if you travel or use public Wi-Fi often, value a long public audit record over the lowest price, want many device slots in one subscription, and are comfortable with a Kape-owned provider.

Skip it if you are choosing on price alone (check the renewal, not the intro), if you object to Kape’s ownership or to the Gericke history, or if you need independent speed and streaming results, which this page does not provide.

If you do buy, pick the term deliberately, note the 30-day refund window, and compare the renewal price against rivals before you commit to 28 months.

Check ExpressVPN’s current plans →

How we researched this review

We read ExpressVPN’s order page, server page, Trust Center and privacy policy directly on October 6, 2026, and the US Justice Department’s deferred prosecution agreement (Case No. 21-CR-577). Ownership and the 2021 statement come from the Bloomberg, Wikipedia and TechTarget pages linked above. We did not examine ExpressVPN’s competitors’ prices for this page, so we make no price comparison. We do not test VPNs ourselves; where a claim comes from ExpressVPN we say so, and where we could not verify something we say that too. Prices and plans change often, so confirm them on the vendor’s page on the day you buy.

Frequently asked questions

How much does ExpressVPN cost?

On the 2-year plans shown October 6, 2026: Basic $2.99 a month, Advanced $4.49, Express Pro $7.49, each billed up front for the first 28 months. Basic then renews at $99.95 a year, Advanced at $119.95 and Pro at $199.95.

Is there a free trial or refund?

The page offers a 30-day money-back guarantee for new users, claimed by asking Support. We found no free tier on the order page.

Does ExpressVPN keep logs?

Its privacy policy says it does not log browsing history, traffic destinations, data content or DNS queries, and does not store connection logs such as your IP, timestamps or session duration. It does keep account and payment details. These are the company’s statements, backed by the audits listed above.

Who owns ExpressVPN?

Kape Technologies PLC, per ExpressVPN’s own privacy policy. Kape agreed to buy it for $936 million in September 2021.

How many devices can I use?

10 on Basic, 12 on Advanced and 14 on Express Pro, per its plan comparison.

How many countries does it cover?

113 countries, per its server-locations page, including 24 US locations. Some locations are virtual and are labeled as such there.

Is ExpressVPN worth it?

If you value a long audit record and wide coverage and accept the Kape ownership, it is a defensible pick. If you are price-driven, compare the renewal price, not the introductory one.

Bottom line

ExpressVPN earns its place on the evidence it publishes, not on any test we ran. It is a strong, well-documented choice for people who put proof ahead of price, with a renewal bill and an ownership and personnel history you should read before you commit.

This page is for information, not legal or security advice.

Related reads

• NordVPN vs ExpressVPN
• Best VPN in 2026: NordVPN vs ExpressVPN vs Surfshark vs Mullvad
• Best VPN for travel
• Best VPN for streaming
• CyberGhost review
• How to stay anonymous online