ExpressVPN vs NordVPN

The transparency report. P05/P06/P08/P09 now rest on ExpressVPN's biannual transparency report (Jul–Dec 2025: 155 government/law-enforcement requests, 0 disclosures, 3 warrants listed separately) reached via the Trust Center — the earlier run missed both.

The canary, and the rest of the block. No ExpressVPN warrant canary could be found and no primary statement denies one, so P07 stays unknown. P02/P03=none_known rest on the transparency series and the privacy policy's litigation stance; P11=none_known on the policy's statement that all demands run through BVI courts. P04=withdrew_physical is the June 2022 India exit.

What is never published. Subscriber count (M08) and total server count (U03) are not published. Server hardware ownership (C08: owned vs leased) and app-level device identifiers (C12) could not be established from any page checked.

106 countries against a claim of 113. U02_server_countries reflects the 105 country-landing pages in ExpressVPN's own sitemap plus China (confirmed 'Available - Virtual Locations' on the live /vpn-server page but lacking a dedicated landing page) — 106 codes total, against the site's own marketing claim of '113 Countries'; the live server-location page is a very large per-protocol table that was not exhaustively parsed, so the gap between 106 and 113 is reported rather than resolved.

An audit finding between two categories. V11_audit_findings is recorded as session_metadata rather than none_linkable or aggregates_only: the 2025 KPMG report describes a structured per-connection record (country, ISP, date, protocol, data volume, a stable salted-hash pseudonym) that is more than a pure aggregate but lacks IP and precise time — a genuinely ambiguous case for this field's four middle categories.

Not checked this pass. Whether ExpressVPN's coverage exists outside affiliate sites (X08), its affiliate payout tier (X10), and whether owner-run review media flags the ownership tie (X11) were not checked in this pass.

P2P, looked for and absent. U12a_p2p_allowed stays unknown for a different reason than the rest: it was looked for and is not published. Neither sitemap (578 page and support URLs) nor the terms of service mentions P2P, BitTorrent or file sharing anywhere, while every other catalogued provider states its position in its own documents. A support article or a terms clause would close it; a review site saying it works would not.

The canary, and the quarter that replaced it. The same page retired the warrant canary (P07=removed) for quarterly transparency reports; the latest complete quarter (Apr–Jun 2026) shows 85 government inquiries and 0 disclosures, so P08/P09 are that period, not the lifetime figure.

India, and the secret-order regime. P04=withdrew_physical is the June 2022 India exit. P11=none_known rests on the page's statement that NordVPN has received no binding National Security letters or gag orders and on Panama's absence of such a regime.

An assurance level nobody can check. NordVPN describes the Deloitte Lithuania engagement as a reasonable assurance engagement under ISAE 3000 (Revised), which would be the stronger form; PIA's report, which can be read, states a limited assurance conclusion.

Why the stronger form is not credited. The model now prices that difference, and this record does not get the benefit of it: V15_assurance_strength is unknown because the only statement of the level is NordVPN's own, about a report nobody outside a Nord Account can open. A document behind a login is not evidence here at any level, so the engagement is credited at the market norm rather than at the level it is said to have reached.

A report behind a login. The report itself is readable only after signing in to a Nord Account, so nobody outside that relationship has checked its scope, and every audit field here rests on NordVPN's own summary of it rather than on the document. That, and not a finding against the service, is why this record is the thinnest in the catalogue.

The owner fields. M11_owner_jurisdiction and X04_owner_group_history are unknown: nordvpn.com and nordsecurity.com name Nord Security as owner but neither states Nord Security's own jurisdiction of incorporation or any prior record for the group; secondary press ties a 'Cyberspace' holding entity to the Netherlands from the 2022 merger, but that was not confirmed against a primary Nord Security or NordVPN page in the time available.

In 2017, Turkish authorities seized an ExpressVPN server investigating the assassination of Russian Ambassador Andrei Karlov and found no usable logs (TorrentFreak, which carries a sponsorship notice for ExpressVPN — noted, not excluded, since the facts are externally checkable and ExpressVPN's own statement page has since returned HTTP 410 with no Wayback Machine snapshot).

In September 2021 the DOJ's Deferred Prosecution Agreement with Daniel Gericke, ExpressVPN's Chief Information Officer, over his prior 2016-2018 role in the UAE's 'Project Raven' hacking operation became public; the primary DPA document itself never names ExpressVPN (it covers only his earlier UAE employment) — the ExpressVPN link comes from ExpressVPN's own and press statements. ExpressVPN kept Gericke employed and published a public defense of that decision.

C12 is resettable_ad_id on the provider's own prose rather than on a store category. The privacy policy's marketing paragraph states that an Installation ID and an XV User ID are always collected and that advertising identifiers — IDFA or the Android Advertising ID — follow on explicit consent, all of it reaching AppsFlyer; the Play data-safety form independently declares Device or other IDs for advertising or marketing.

The consent gate and a mitigation nobody else here offers — AppsFlyer-bound traffic routed through a dedicated ExpressVPN IP pool so attribution cannot correlate by IP — are real and are recorded here, because the floor prices what can be held, not how well it is explained.

U07_protocols carries the whole picker: Lightway UDP and TCP as vendor_open, beside WireGuard, OpenVPN UDP/TCP and IKEv2. Lightway is ExpressVPN's own protocol and its source is published with independent review behind it (Cure53, 2021 and 2024), which is the distinction vendor_open exists for — proprietary prices the impossibility of telling whether a transport is weak, and here it can be told.

PPTP is retired on ExpressVPN apps by the provider's own protocol page, and L2TP and SSTP are explained there without being offered.

The 2018 Finland datacenter breach was a third-party intrusion, not a law-enforcement seizure — recorded under P12_case_history as kind=breach, not P01_seizure_event. NordVPN's own account (nordvpn.com/blog/official-response-datacenter-breach/) and Bloomberg's contemporaneous coverage agree the disclosure followed Twitter allegations by outside researchers, not NordVPN's own initiative — hence third_party_disclosed rather than self_disclosed_late.

NordVPN and Surfshark share a parent (Nord Security) but both companies' own merger announcement states separate infrastructure and product roadmaps; M18 is set to separate on that basis.