Expressvpn external auditors confirm the non-logical policy in February

“Expressvpn never keeps data that could link you to an online activity”, VPN supplier complaint on its website. An independent audit of the end of February supports these complaints. The KPMG accounting firm found that “reasonable insurance” that the VPN supplier system prevents journalization from user activity. The product is one of The best VPN choices in Engadget.

RAM VPN servers

The company’s audit places the TrustedServer System of ExpressVPN under the microscope. It is the company based on the company’s RAM. In theory, this approach means that user data is wiped with each restart of the server. (This would even prevent the possibility of long -term storage.) Some competitors, including NordVPN, also to use RAM servers. Meanwhile, Protonvpn counters These properly quantified hard drives are just as safe.

Another counter-argument for RAM servers is that they are only effective if they are restarted. In theory, a company could manage RAM servers for marketing purposes, but never restart them. This is where audits can help.

KPMG conclusions

KPMG has a high level of confidence that the non-engagement system worked as announced at the end of February. “Controls provide reasonable assurance that L’ExpressVPN TrustedServer does not collect the newspapers of user activity,” said KPMG article. This included “no journalization of navigation history, traffic destination, data content, DNS requests or specific connection newspapers.”

KPMG’s assessment was an ISAE 3000 type I audit. This means that it focused on the design and implementation of ExpressVPN control at a specific time. (Meanwhile, a type II audit would have been further, testing the effectiveness of these controls over an extended period.) If you are not familiar, KPMG is one of the four large accounting firms. It is a name of confidence that companies go from large dollars for audits like this.

The evaluation has examined several factors. These included documentation journals, observation of the system at work and the interview with ExpressVPN staff. The conclusion of the audit applies “to February 28, 2025.” Thus, it represents KPMG’s conclusions for a specific moment rather than a general declaration of permanent confidence. The assessment did not include the stress test the whole system or a full -fledged security analysis of the company.

You can read the kpmg full paper for more detailed ventilation.