ExpressVPN’s No-Logs Policy Verified by Independent Audit

• ExpressVPN’s no-logs claim verified by KPMG audit conducted in February 2025.
• Audit confirms TrustedServer system doesn’t store browsing or connection activity.
• KPMG issued “reasonable assurance” based on ISAE 3000 Type I audit standards.

ExpressVPN’s long-standing claim that it does not track or store user activity has been supported by a recent independent audit. Global accounting firm KPMG conducted the assessment in February 2025 and reported "reasonable assurance" that the VPN provider’s system is designed to prevent the logging of online activity.

According to ExpressVPN, its system, called TrustedServer, is built entirely on RAM-based servers. Unlike traditional hard drives, RAM does not retain data once it is powered off, meaning all user information is automatically wiped whenever a server is rebooted. This approach aims to ensure that no user activity can be stored long-term. Several VPN providers, including Surfshark VPN, use similar setups, while others, like ProtonVPN, argue that properly encrypted hard drives can be just as secure.

Still, the effectiveness of RAM-based systems depends on regular reboots, and some critics have suggested that such setups could be used more for marketing than for actual privacy protection. That’s where third-party audits play a key role in verifying these claims.

KPMG’s audit, carried out under the ISAE 3000 Type I standard, focused on ExpressVPN’s control design and how it was implemented at a specific point in time, February 28, 2025. It did not evaluate how the controls perform over a longer period (which would require a Type II audit) or test the entire system’s security under stress.

The audit reviewed documentation, observed system behavior, and included interviews with ExpressVPN staff. Based on this, KPMG concluded that ExpressVPN’s controls provided reasonable assurance that the company did not log browsing history, traffic destinations, data content, DNS queries, or specific connection logs.

While the audit supports ExpressVPN’s no-logs claim as of late February, it’s worth noting that the findings only apply to that moment in time. The report does not offer a permanent guarantee, nor did it serve as a complete security review of the company’s infrastructure.

Still, the audit adds credibility to ExpressVPN’s privacy claims, particularly for users seeking transparency from their VPN providers.