ExpressVPN proves it can be trusted with your data as it announces 4 new ISO certifications alongside a fresh transparency report

News
By published

Security and privacy is a top priority for ExpressVPN

Person holding a smartphone with an ExpressVPN and ISO compliant logo and graphic
(Image credit: ExpressVPN)

ExpressVPN is proving why it can be trusted with your data as it receives four new ISO certifications and releases an updated transparency report.

The VPN's security and privacy credentials are one of the reasons it sits at number three on our best VPN list, and these two announcements further improve its trust framework.

More than just audits

ExpressVPN is arguably the hardest-working VPN when it comes to privacy and security audits, with over 20 being completed to date. While it's vitally important for the most secure VPNs to undertake regular independent audits, they're only a snapshot in time.

This is why ExpressVPN has widened its security framework and reinforcing its audits with International Organization for Standardization (ISO) certifications.

ExpressVPN said that audits validate its technology, and ISO certifications validate its methodology. ISO certifications are internationally recognized and cover all forms of standardization levels, not just online security.

Four ISO certifications have been issued to ExpressVPN, and its parent company, Kape Technologies:

  • • ISO/IEC 27001 – Information security management
  • • ISO 18295-1 & 18295-2 – Customer support operations
  • • ISO 9001 – Quality management

ExpressVPN rolls out Network Insights and Secure Device Assistant

(Image credit: ExpressVPN)

"Security isn't just something you prove once – it's something you build into how a company operates every day," explained Shay Peretz, COO at ExpressVPN.

"These ISO certifications reflect a real shift in how we run ExpressVPN, with clear standards, stronger governance, and greater transparency at the core. It's about putting proven systems in place so privacy and quality are built into every product we ship, and giving users real confidence their data is protected for the long term."

Three more areas for standardization and recognition are being explored by ExpressVPN in 2026.

It is aiming to achieve an ISO/IEC 27701 certification to strengthen how it handles data across its systems. It's pairing this with ISO 22301 for Business Continuity, to prove its critical services remain standing even during disruptions.

By the third quarter of 2026, ExpressVPN said it aims to "demonstrate compliance with the EU’s NIS2 Directive and HIPAA security standards." Finally, it's pursuing "transparent, accountable, and strictly controlled" AI integration with ISO/IEC 42001.

155 data requests in the second half of 2025

Numerous VPNs release yearly, half-yearly, or quarterly transparency reports. These detail the requests for your data made by authorities and how much of that data is handed over. For reputable VPNs operating strict no-logs policies, the number of requests may be high, but the amount of data handed over will always be zero.

ExpressVPN has shared its transparency report for the second half of 2025, covering July to December.

155 government, law enforcement, and civil data requests were received, down significantly from the 374 received in the first half of 2025. Three government warrants were received in H2 2025, but neither these nor any other request resulted in any ExpressVPN user data being handed over.

DMCA requests related to copyright and these are increasingly automated and sent in bulk. 1.38 million DMCA requests were received by ExpressVPN in H2 2025, up from the 1.06 million in H1.

Screenshot of ExpressVPN data requests table, comparing H1 and H2 2025

(Image credit: ExpressVPN / Future)

ExpressVPN said: "None of the requests received during this period resulted in the disclosure of user data. ExpressVPN’s systems are built without activity logs, so there’s nothing to retrieve when requests seek browsing or connection information."

ExpressVPN operates a strict, audited, no-logs policy, meaning no information relating to your VPN activity or browsing information is collected, stored, or shared. It also runs on RAM-only servers. This means that even if data was collected, it'd be deleted every time the server shuts down.

All ExpressVPN transparency reports, independent audits, and technical disclosures can be found in its Trust Centre.

Disclaimer

We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

George Phillips
George Phillips
Staff Writer

George is a Staff Writer at Tom's Guide, covering VPN, privacy, and cybersecurity news. He is especially interested in digital rights and censorship, and its interplay with politics. Outside of work, George is passionate about music, Star Wars, and Karate.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.