Digital Domain Audit: ExpressVPN

Target: ExpressVPN (consumer VPN; Express Technologies Ltd / ExpressVPN Inc; owned by Kape Technologies plc) Domain: Digital (Digital / Technology) Date: June 2026 Scope: ExpressVPN’s own digital/data/cyber/surveillance/AI conduct re Israel. Kape group-level and sibling-brand tech is attributed at the parent-group level except where ExpressVPN itself relies on it or where Kape’s Israeli infrastructure intersects with ExpressVPN’s operations.

Enterprise Technology Stack & Vendor Relationships

Core protocol - Lightway: ExpressVPN’s proprietary VPN protocol, Lightway, was developed in-house and open-sourced under GPLv2 in 2021.¹ It is built on the wolfSSL cryptographic library (a US-based vendor), supports AES-256-GCM and ChaCha20/Poly1305 encryption, and uses DTLS 1.2 for server authentication.² The core codebase was rewritten in Rust and released in February 2025.³ Two independent security assessments of the Rust implementation - by Cure53 (October 2024) and Praetorian (September–December 2024) - each found a low number of low-severity findings, all subsequently remediated.⁴ A prior Cure53 audit of the C implementation was conducted in 2022.⁵ No Israeli vendors are identified in the Lightway technology stack; wolfSSL is a US company.

Post-quantum encryption: ExpressVPN integrated ML-KEM (the NIST-standardised Kyber algorithm) into Lightway in 2024, making post-quantum protection active by default.⁶

TrustedServer architecture: Launched in 2019 and audited by PwC under ISAE 3000, TrustedServer runs every VPN server entirely on volatile RAM; no data is written to persistent storage and each reboot wipes all state.⁷ KPMG provided ISAE 3000 Type I reasonable-assurance opinions on TrustedServer in 2022, 2023, and February 2025, each confirming that the architecture prevents collection of user activity logs.⁸ As of 2024, ExpressVPN held 23 completed independent audits.⁹

AWS as cloud backbone: ExpressVPN uses Amazon Web Services as its primary web infrastructure provider, including Amazon EC2 for compute and AWS Nitro Enclaves for security-sensitive workloads.¹⁰ The dedicated-IP (DIP) product is implemented inside AWS Nitro Enclaves: blinded tokens bearing no user-identifying information are issued inside cryptographically attested enclave environments, preventing even ExpressVPN staff from linking a dedicated IP to a specific customer account.¹¹ AWS is a US-domiciled vendor; no Israeli sovereign cloud or government-cloud services are identified in ExpressVPN’s stack.

Router hardware - Aircove: In September 2022 ExpressVPN launched Aircove, a Wi-Fi 6 consumer router with VPN protection built in by default, sold initially on Amazon US at $169.¹² No Israeli hardware component suppliers are identified in public disclosures.

Kape group backend integration (parent-group context - flagged): Following the September 2021 acquisition, Kape’s public communications referenced “shared back-end, billing, and support” across group brands and “integrated products” as synergies.¹³ ExpressVPN’s own announcement stated that customer data would continue to be “held in its own entity, under BVI jurisdiction,” and that it would operate as “a separate brand and service, run by our existing team.”¹⁴ The extent to which backend or billing systems are now shared with Kape’s Tel Aviv R&D operation - which employs approximately 120 engineers at the Azrieli Sarona Tower - is not publicly confirmed. This is a material gap for assessing whether ExpressVPN’s data-handling infrastructure has any Israeli technical touchpoint.

Surveillance, Biometrics & Retail Technology

Daniel Gericke / Project Raven - the central issue for this domain:

ExpressVPN’s Chief Information Officer Daniel Gericke is one of three former US intelligence operatives who entered into a Deferred Prosecution Agreement (DPA) with the US Department of Justice on 14 September 2021.¹⁵ The DPA resolved allegations that the three men - Gericke, Marc Baier, and Ryan Adams - committed violations of US export control law (ITAR), computer fraud statutes, and access-device fraud law by providing advanced offensive cyber-intelligence services to the UAE government without a required State Department licence.¹⁶

Specifically, while working at DarkMatter (a UAE-based intelligence contractor), Gericke and colleagues were alleged to have supervised the development of “zero-click” intelligence hacking systems capable of compromising target devices without any user interaction, targeting US citizens, foreign heads of state, and dissidents critical of the UAE government, including the Emir of Qatar and Yemeni human-rights activists.¹⁷ The operation was known publicly as Project Raven following earlier Reuters reporting. The three men were fined a combined $1,685,000 and accepted employment restrictions prohibiting work involving Computer Network Exploitation (CNE) activity or export of defence articles.¹⁸

What ExpressVPN knew and when: ExpressVPN hired Gericke as CIO in December 2019 - during or immediately after the period covered by the DPA. The company’s public statement acknowledged it was aware at the time of hire that Gericke had worked at CyberPoint and at DarkMatter, describing this as background that made him “an invaluable hire for our mission.”¹⁹ ExpressVPN stated it first learned of his involvement specifically in Project Raven and the existence of the DPA on 7 September 2021, when the DOJ finalised the agreement.²⁰ The company chose to retain Gericke after the public disclosure, citing his offensive-security expertise as strengthening its defensive posture and arguing that structural safeguards (TrustedServer, least-privilege access) mitigated any personnel risk.²¹

Civil society response: Edward Snowden publicly stated that “if you’re an ExpressVPN customer, you shouldn’t be,” characterising the retention of a former UAE surveillance operative as fundamentally incompatible with a privacy service.²² ExpressVPN employees reportedly questioned management internally about the disclosure.²³

Israel nexus assessment: Project Raven/DarkMatter is a UAE intelligence operation, not an Israeli one. No public evidence has been identified that Gericke’s UAE surveillance work had any Israeli component or that ExpressVPN’s hiring decision was motivated by Israeli state relationships. The significance for this audit is the demonstrated willingness of ExpressVPN leadership to hire and retain a senior executive with a documented offensive cyber-surveillance background - a structural trust question relevant to assessing ExpressVPN’s digital conduct standards more broadly.

Biometrics and retail surveillance: No public evidence identified of ExpressVPN deploying biometric, facial recognition, or retail surveillance technology.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Server network: ExpressVPN operates VPN servers in 105+ countries.²⁴ This network includes servers in Israel: ExpressVPN’s own server-location page lists Tel Aviv as an available location, providing Israeli IP addresses to subscribers.²⁵ These are standard VPN egress servers providing commercial connectivity; no evidence has been identified that they constitute shared infrastructure with Israeli state entities or sovereign cloud participation.

Virtual server locations: Some ExpressVPN “server locations” are virtual - traffic is routed through a server physically located elsewhere but advertising a local IP from the named country. ExpressVPN publishes a list of virtual server locations.²⁶ It is not publicly confirmed whether the Tel Aviv listing is a physical or virtual server.

BVI data jurisdiction: ExpressVPN customer data remains held by Express Technologies Ltd, incorporated in the British Virgin Islands.²⁷ No US, EU, or Israeli data-residency obligations are publicly identified as applicable to ExpressVPN’s subscriber database.

TrustedServer RAM architecture and data residency: Because TrustedServer purges all state on reboot and writes nothing to persistent storage, the geographic data-residency question for VPN traffic metadata is substantially moot by design - there is no persistent log to reside anywhere.²⁸ This claim has been independently verified by PwC and KPMG.

DNS leak incident (2022–2024): A bug introduced in May 2022 in ExpressVPN’s Windows app (version 12.23.1) and persisting until February 2024 (version 12.72.0) caused DNS requests to leak outside the VPN tunnel when split tunnelling was enabled, routing them to users’ ISPs.²⁹ ExpressVPN estimated less than 1% of its user base was affected. No Israeli data-handling dimension to this incident has been identified.

Sovereign cloud participation: No public evidence identified of ExpressVPN participating in Israeli sovereign cloud programmes or government-cloud procurement.

Defence, Intelligence & Security Sector Technology Relationships

DOJ deferred prosecution / Project Raven: The core defence-sector relationship already documented is the confirmed prior employment of ExpressVPN’s CIO Daniel Gericke in an offensive cyber programme operated by a state intelligence contractor (DarkMatter/UAE). This is the only confirmed defence-intelligence sector technology relationship for ExpressVPN directly.

Israeli defence sector: No public evidence identified of ExpressVPN holding contracts with, or providing services to, the Israel Defense Forces, Israeli intelligence agencies (Shin Bet, Mossad, Unit 8200), or Israeli defence contractors.

Kape Technologies leadership - Israeli military backgrounds (parent-level context - flagged): Kape’s co-founder and early CEO Koby Menachemi is reported to be a Unit 8200 veteran.³⁰ Kape’s subsequent CEO Ido Erlichman (2016–2023) is a veteran of the IDF’s Duvdevan commando unit.³¹ These are Kape group-level personnel, not ExpressVPN personnel, and are attributed to Kape at the parent level, recorded as context only. No evidence has been identified that these individuals’ intelligence backgrounds were operationalised through ExpressVPN’s product or infrastructure.

Teddy Sagi - ownership and donations (owner-level context - flagged): Kape’s controlling shareholder Teddy Sagi (via his holding company Unikmind) is an Israeli billionaire who reportedly donated $3 million for IDF soldier scholarships in 2019 and approximately $1 million in 2023 for transport of soldiers during military operations in Gaza.³² This is owner-level conduct, distinct from ExpressVPN’s own corporate behaviour, and is attributed to Sagi at the owner level.

Government data requests (transparency reports): ExpressVPN received 333 government, law enforcement, and civil requests in 2024, reporting that it disclosed no user data in response to any of these.³³ In H1 2025, 374 such requests were received; again no data was disclosed.³⁴ Breakdown by requesting jurisdiction is not published, so it is not possible to determine whether any requests originated from Israeli authorities.

Turkey 2017 server seizure: Turkish police seized an ExpressVPN server in January 2017 during the investigation of the assassination of Russian ambassador Andrey Karlov. ExpressVPN confirmed it held no user logs, and Turkish authorities were unable to recover any data.³⁵ This is not an Israeli-nexus event.

AI, Algorithmic & Autonomous Systems

ExpressAI: In February 2026 ExpressVPN announced, and on 31 March 2026 began rolling out, ExpressAI - a browser-based private AI platform for ExpressVPN Pro subscribers.³⁶ The architecture uses confidential computing enclaves in which each interaction is processed with encryption keys generated inside hardware and inaccessible to ExpressVPN or infrastructure operators.³⁷ Users can enable “Ghost Mode” for automatic conversation deletion. ExpressVPN states no prompts or files are used for AI model training and no human review of user data occurs.³⁸

AI models offered: At launch, ExpressAI provides access to models from OpenAI, DeepSeek, Alibaba/Qwen, and NVIDIA.³⁹ The inclusion of DeepSeek - a Chinese AI lab subject to China’s National Intelligence Law - is a noted privacy concern in public commentary, though ExpressVPN’s confidential-computing architecture is designed to prevent the underlying model providers from accessing user prompts.⁴⁰

ExpressAI security audit: Cure53 conducted a penetration test and source-code review of ExpressAI’s frontend, backend, cryptographic implementations, and key management between February and March 2026, concluding that the platform’s architecture meets its stated privacy goals.⁴¹

AI and Israel nexus: No Israeli AI vendors, Israeli military AI systems, or Israeli government AI contracts are identified in ExpressVPN’s AI product stack. The confidential computing approach relies on general cloud hardware enclaves; no Israeli-specific components are identified.

Keys (password manager): ExpressVPN launched Keys as an integrated password manager in November 2023 and subsequently as a standalone app (ExpressKeys).⁴² No AI-driven behavioural profiling or algorithmic systems with an Israeli nexus are identified in these products.

Technology Ecosystem & R&D Footprint

ExpressVPN’s own R&D geography: ExpressVPN’s engineering and product teams are described as distributed globally across approximately 20 cities.⁴³ The company’s careers pages and public disclosures do not identify an Israeli engineering office. No public evidence has been identified that ExpressVPN maintains its own R&D presence in Israel.

Kape Technologies Tel Aviv R&D (parent-level context - flagged): As of March 2022, Kape Technologies employed approximately 120 engineers at its Tel Aviv development centre, located in the Azrieli Sarona Tower, with approximately 850 employees globally.⁴⁴ This is Kape group infrastructure, not ExpressVPN’s own. The degree to which ExpressVPN’s product or infrastructure development benefits from Kape’s Tel Aviv R&D resource is not publicly confirmed and represents a material transparency gap.

Crossrider/adware legacy (parent-level context - flagged): Kape Technologies was founded as Crossrider in 2011 by Koby Menachemi and Shmuel Achdut, as a cross-browser extension development framework.⁴⁵ By 2013 the platform had over 300 million users and was identified in a Google/UC Berkeley study as one of approximately 1,000 businesses involved in ad injection.⁴⁶ Malwarebytes and Symantec documented Crossrider-associated malware variants, although the malware was created by third-party abusers of the Crossrider SDK rather than by Crossrider/Kape itself.⁴⁷ Kape closed the Crossrider platform in 2016 and rebranded as Kape Technologies in 2018. ExpressVPN was acquired five years after this pivot; the legacy does not directly attach to ExpressVPN’s own technology.

Kape-owned VPN review sites conflict of interest: In May 2021, Kape acquired Webselenese, owner of vpnMentor and Wizcase - two of the most-trafficked VPN review websites. Following the acquisition, both sites’ top recommendations shifted to Kape-group VPN products (ExpressVPN, CyberGhost, PIA). Neither site discloses Kape ownership prominently in its on-page text.⁴⁸ This is a group-level digital ecosystem issue with direct relevance to how ExpressVPN is presented to prospective users.

Open-source contributions: ExpressVPN has open-sourced the Lightway protocol (GPLv2 on GitHub) and makes audit reports publicly available via its Trust Center.⁴⁹

Civil Society Scrutiny & Regulatory History

Edward Snowden (September 2021): Following the DOJ DPA announcement, Snowden publicly urged all ExpressVPN customers to stop using the service, citing Gericke’s retention as evidence of a fundamental conflict with the company’s stated privacy mission.⁵⁰

ExpressVPN employees (September 2021): Vice/Motherboard reported that ExpressVPN employees internally questioned management about the Gericke/Project Raven revelation and the company’s decision to retain him.⁵¹

Privacy community and press (2021–2022): Multiple VPN-focused publications published critical analyses of the Kape acquisition and the Gericke scandal, questioning the credibility of ExpressVPN’s privacy claims given its parent’s adware history and CIO’s surveillance background.⁵²

DNS leak disclosure (2024): The public disclosure in February 2024 of the DNS-leak bug - which had persisted undetected for nearly two years - drew criticism regarding ExpressVPN’s internal security monitoring.⁵³

No FTC, FCC, or data-protection regulatory enforcement actions: No public evidence has been identified of ExpressVPN being the subject of enforcement action by the FTC, FCC, UK ICO, or any EU data-protection authority.

Transparency reports: ExpressVPN publishes semi-annual transparency reports covering government, law enforcement, and civil data requests. All reports to date record zero user data disclosed.⁵⁴ No breakdown by requesting country is published.

Kape review-site conflict of interest - civil society scrutiny: Independent researchers (e.g. CyberInsider) have published detailed analyses of Kape’s ownership of vpnMentor and Wizcase, documenting the shift in recommendations post-acquisition and the absence of prominent ownership disclosure on those sites.⁵⁵ ExpressVPN has not publicly addressed this conflict in the context of its own transparency commitments.

End Notes