Sourced comparison
ExpressVPN vs Private Internet Access: audits, owners and leak fixes
ExpressVPN and Private Internet Access side by side: who runs each, what independent auditors checked, and how each app handled the TunnelVision and TunnelCrack leaks. Every cell links its source. Last checked 28 Oct 2026.
Same owner: ExpressVPN and Private Internet Access both belong to Kape Technologies, according to each brand’s own legal page. See who owns which VPN for the other brands in the group.
Where ExpressVPN and Private Internet Access differ
- Audits. ExpressVPN lists 23 since 2019, the latest by Cure53 in Apr 2026; Private Internet Access lists 3 since 2022, the latest by Deloitte on 8 Dec 2025.
- TunnelVision. On Android, ExpressVPN says not affected and Private Internet Access says mitigated.
- TunnelCrack LocalNet. On Windows, macOS, Linux and Android, ExpressVPN says not affected and Private Internet Access says not stated; on iOS, ExpressVPN says mitigated and Private Internet Access says not stated.
The same on both: owner: both are Kape Technologies brands, ExpressVPN run by Express Technologies Ltd. and Private Internet Access by Private Internet Access, Inc.; RAM-only servers: both state it on their own pages; open-source apps: both state it on their own pages; transparency: both publish a report or canary; TunnelCrack ServerIP: the same status on every app.
At a glance
| ExpressVPN | Private Internet Access | |
|---|---|---|
| Company and country | Express Technologies Ltd., British Virgin Islands SourceRead 18 Oct 2026 | Private Internet Access, Inc., United States SourceRead 18 Oct 2026 |
| Part of | Kape Technologies SourceRead 18 Oct 2026 | Kape Technologies SourceRead 18 Oct 2026 |
| Independent audits | 23 since 2019, 18 with a public report | 3 since 2022, 1 with a public report |
| Most recent audit | Apr 2026, Cure53: Apps and infrastructure SourceRead 26 Oct 2026 | 8 Dec 2025, Deloitte: No-logs SourceRead 18 Oct 2026 |
| RAM-only servers | ExpressVPN says its VPN servers run on RAM only and never write to hard drives. SourceRead 19 Oct 2026 | PIA says its servers are RAM-only. SourceRead 19 Oct 2026 |
| Open-source apps | ExpressVPN publishes the source of its Lightway protocol and its browser extension on GitHub, not the source of its desktop or mobile apps. SourceRead 26 Oct 2026 | Desktop, iOS and browser-extension clients are published on GitHub. SourceRead 19 Oct 2026 |
| Transparency report or canary | Government, law enforcement and civil requests; ExpressVPN says it had no logs to disclose. SourceRead 18 Oct 2026 | Subpoenas, warrants and foreign requests; PIA says it produced no logs. SourceRead 18 Oct 2026 |
| Incidents on record | 16 Sep 2021, Other: ExpressVPN's CIO was named in a US Department of Justice resolution over his earlier hacking work for a UAE company. SourceRead 19 Oct 2026 | Jul 2016, Servers seized: Russian authorities seized several Private Internet Access servers in July 2016, and PIA removed its servers from Russia. SourceRead 26 Oct 2026 |
| Newest app versions | Windows 14.3.1 (22 Sep 2026) SourceRead 18 Oct 2026 macOS 14.3.1 (22 Sep 2026) SourceRead 18 Oct 2026 Linux 14.3.1 (22 Sep 2026) SourceRead 18 Oct 2026 Android 12.82.0 (9 Oct 2026) SourceRead 18 Oct 2026 iOS 12.76.0 (13 Oct 2026) SourceRead 18 Oct 2026 | Windows, macOS, Linux 3.8.0 (15 Oct 2026) SourceRead 18 Oct 2026 Android 4.1.5 (20 Oct 2026) SourceRead 26 Oct 2026 |
Known VPN leak attacks
Each provider’s own statement for each app. “Not stated” means the provider published nothing on it.
| Attack | ExpressVPN | Private Internet Access |
|---|---|---|
| TunnelVisionA rogue DHCP server pushes routes (option 121) that pull traffic out of the tunnel while the VPN still shows connected. | Not affected Android SourceRead 18 Oct 2026 Mitigated Windows, macOS, Linux SourceRead 18 Oct 2026 Affected iOS SourceRead 18 Oct 2026 | Mitigated Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Affected iOS SourceRead 18 Oct 2026 |
| TunnelCrack LocalNetA rogue Wi-Fi network assigns itself public addresses the VPN treats as local, so traffic to them skips the tunnel. | Not affected Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Mitigated iOS SourceRead 18 Oct 2026 | Not stated All apps SourceRead 18 Oct 2026 |
| TunnelCrack ServerIPA spoofed DNS answer for the VPN server makes the client route chosen traffic outside the tunnel. | Not stated All apps SourceRead 18 Oct 2026 | Not stated All apps SourceRead 18 Oct 2026 |
Audits on record
ExpressVPN
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| Apr 2026 | Cure53 | Apps and infrastructure | Pentest, code audit, design and crypto review of EventVPN, ExpressVPN's separate VPN product: architecture and software. | 1 critical, 2 high, 1 medium, 9 low | Report SourceRead 26 Oct 2026 |
| Jun 2025 | KPMG | Privacy policy | ISAE 3000 assurance on the privacy and no-logs commitments. | Not published | Report SourceRead 18 Oct 2026 |
| Nov 2024 | Cure53 | Apps | Aircove routers, second audit. | Not published | Report SourceRead 18 Oct 2026 |
| Oct 2024 | Cure53 | Protocol | Lightway after its rewrite in Rust, fourth audit. | Not published | Report SourceRead 18 Oct 2026 |
| Sep 2024 | Praetorian | Protocol | Lightway, third audit; the public report is the retest. | Not published | Report SourceRead 18 Oct 2026 |
| Jun 2024 | Cure53 | Browser extension | The VPN browser extension, second audit. | 1 medium | Report SourceRead 18 Oct 2026 |
| 16 Apr 2024 | Nettitude | Apps | Windows app, checking the fix for the split-tunnelling DNS leak. | 1 medium | Report SourceRead 18 Oct 2026 |
| Dec 2023 | KPMG | Privacy policy | Assessment of the privacy policy claims. | Not published | Report SourceRead 18 Oct 2026 |
| 13 Dec 2022 | Cure53 | Apps | White-box pentest and source code audit of the Android app. | Not published | Report SourceRead 26 Oct 2026 |
| Nov 2022 | Cure53 | Protocol | Lightway, second audit. | 5 low, 4 info | Report SourceRead 18 Oct 2026 |
| Oct 2022 | Cure53 | Browser extension | The VPN browser extension, first audit. | Not published | Report SourceRead 18 Oct 2026 |
| 28 Sep 2022 | Cure53 | Apps | Pentest and source code audit of the Aircove router UI, interfaces and firmware. | 4 medium, 2 low | Report SourceRead 26 Oct 2026 |
| Sep 2022 | KPMG | No-logs | ISAE 3000 Type 1 assurance on the no-logs policy. | Not published | SourceRead 18 Oct 2026Report not public |
| Sep 2022 | Cure53 | Apps | iOS app. | Not published | Report SourceRead 18 Oct 2026 |
| Aug 2022 | Cure53 | Apps | Linux app. | Not published | Report SourceRead 18 Oct 2026 |
| Jul 2022 | Cure53 | Apps | macOS app. | Not published | Report SourceRead 18 Oct 2026 |
| May 2022 | Cure53 | Servers and infrastructure | White-box review of TrustedServer, the in-house VPN server software. | None reported | Report SourceRead 18 Oct 2026 |
| Apr 2022 | F-Secure | Apps | Windows app version 12. | Not published | SourceRead 18 Oct 2026Report not public |
| Mar 2022 | F-Secure | Apps | Windows app version 10. | Not published | SourceRead 28 Oct 2026Report not public |
| Aug 2021 | Cure53 | Protocol | Lightway, first audit. | Not published | Report SourceRead 18 Oct 2026 |
| Jun 2020 | PwC | Backend and payments | PwC Switzerland on the build verification process. | Not published | SourceRead 18 Oct 2026Report not public |
| Jun 2019 | PwC | Privacy policy | PwC Switzerland on privacy policy compliance and TrustedServer. | Not published | SourceRead 18 Oct 2026Report not public |
| 28 Jan 2019 | Cure53 | Browser extension | Security review of the Chrome browser extension, October 2018; fixes verified in November 2018. | 3 medium, 2 low, 3 info | Report SourceRead 26 Oct 2026 |
Private Internet Access
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 8 Dec 2025 | Deloitte | No-logs | Deloitte Audit Romania, ISAE 3000: server configuration as of 31 October 2025, including dedicated-IP tokens. | Not published | Report SourceRead 18 Oct 2026 |
| 25 Apr 2024 | Deloitte | No-logs | Deloitte Audit Romania: servers, network and incident management, dedicated IP. | Not published | SourceRead 18 Oct 2026Report not public |
| 30 Aug 2022 | Deloitte | No-logs | Deloitte Audit Romania: server configuration as of 30 June 2022. | Not published | SourceRead 18 Oct 2026Report not public |
Check it on your own connection
Records say what ExpressVPN and Private Internet Access state. A test shows what your own connection does today: run the ExpressVPN leak test with that app connected, or the Private Internet Access leak test with the other; each checks your IP, DNS, WebRTC and IPv6.
How this page is kept
- ExpressVPN’s column is read from expressvpn.com and github.com; Private Internet Access’s from privateinternetaccess.com and github.com. Auditors’ published reports count as well. Each cell links its source and the date it was read.
- “No statement on record” under ExpressVPN or Private Internet Access means our sources hold none for that provider. It is not a finding that ExpressVPN or Private Internet Access lacks the feature; check its own pages.
- This page does not rank ExpressVPN against Private Internet Access. Which row matters depends on what you need the VPN for.
- A script re-reads every ExpressVPN and Private Internet Access source weekly; when one changes, a person checks it before the ExpressVPN or Private Internet Access row changes. These records also feed every published VPN audit, who owns which VPN and leak issues by provider.
The data on this page as JSON: facts.json (CC BY 4.0) · All open data · Changes and Atom feed