Best European Alternatives to ExpressVPN
Looking for a European alternative to ExpressVPN? While ExpressVPN is a popular VPN service, it's owned by Kape Technologies (formerly Crossrider) and operates from the British Virgin Islands. For users who value transparency, privacy laws, and European jurisdiction, there are excellent alternatives.
We've curated the best privacy-focused VPN services from Europe. These alternatives offer strict no-log policies, open-source clients, and operate under strong European privacy frameworks.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA or Switzerland, and processes customer data in Europe. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Paid placement can affect which tools appear here and the order they appear in. Editorial policy
Why Choose a European Alternative to ExpressVPN?
Strict Privacy Laws
European jurisdictions like Sweden and Switzerland have strong privacy protections.
True No-Log Policies
Independently audited no-log policies you can actually trust.
Open Source Clients
Transparent, auditable code so you know exactly what's running.
Anonymous Payments
Pay with cash, crypto, or gift cards for complete anonymity.
Best European Alternatives to ExpressVPN
We've curated the best privacy-focused VPN services from European companies. Each alternative has been evaluated for privacy, security, and transparency.
Mullvad VPN
Anonymous VPN service with no email required and cash payment options
Proton VPN
Swiss VPN from the makers of ProtonMail with a generous free tier
IVPN
Privacy-focused VPN with transparent ownership and security practices
AirVPN
Italian VPN run by activists with advanced features for power users
OVPN
Swedish VPN with hardware-level security and court-proven no-log policy
Feature Comparison: ExpressVPN vs European Alternatives
| Feature | ExpressVPN | Mullvad | Proton VPN | IVPN |
|---|---|---|---|---|
| Headquarters | British Virgin Islands | Sweden | Switzerland | Gibraltar |
| Open Source Apps | No | Yes | Yes | Yes |
| Independent Audit | Yes | Yes | Yes | Yes |
| Anonymous Signup | No | Yes | Partial | Yes |
| Free Tier | No | No | Yes | No |
| WireGuard Support | Lightway | Yes | Yes | Yes |
| Cash Payments | No | Yes | No | Yes |
Key takeaways
- ExpressVPN is not American: Express Technologies Ltd. is registered in the British Virgin Islands, so the CLOUD Act is not the reason to leave.
- Kape Technologies owns ExpressVPN, CyberGhost, Private Internet Access and ZenMate, plus the review sites vpnMentor and Wizcase — the seller and the scoreboard have the same owner.
- The claim that ExpressVPN "used to be adware" is wrong about the chronology: the browser-extension business was wound up in 2016 and ExpressVPN was not bought until September 2021.
- Only the Lightway protocol is open source; the Windows client shipped a split-tunnelling flaw from May 2022 until it was disclosed in February 2024.
- ExpressVPN's no-logs claim has survived an actual seizure — Turkey, December 2017, nothing found — which is a stronger record than most of this market has.
Why people leave ExpressVPN
The CLOUD Act argument does not work here, so this page will not make it. The entity named in ExpressVPN's own privacy policy is Express Technologies Ltd., operating under the law of the British Virgin Islands. Washington cannot compel that company the way it compels a firm incorporated in Delaware, and any comparison that opens by claiming otherwise has not read the document it claims to be summarising.
The case against ExpressVPN is about who owns it. Kape Technologies plc bought the company on 13 September 2021 for $936 million, when it had more than four million subscribers. Kape also owns CyberGhost, Private Internet Access and ZenMate — and, since its purchase of Webselenese the same year, vpnMentor and Wizcase. Four VPN brands sold as rivals, and two of the largest sites that rank them, answer to one board.
Then the owner itself changed hands: in May 2023 Kape was taken off the public market by Unikmind Holdings Limited, controlled by Teddy Sagi, who had bought the predecessor company back in 2012. If what you are paying for is a promise about restraint, it is worth noticing that the party making it has been sold twice since 2021, and that you may have found the product on a website the seller owns.
- The seller owns two of the review sites Read the bottom of vpnMentor's about page and it says so itself: it sits in the same ownership group as CyberGhost, ExpressVPN, Intego and Private Internet Access, and its rankings "may also take into consideration the common ownership mentioned above". Publishing that is to vpnMentor's credit and it is not a secret. It does mean that if your shortlist came from one of the big comparison sites, there is a real chance the shortlist was drawn up by the company selling the winner.
- Four brands, one set of decisions CyberGhost, Private Internet Access, ZenMate and ExpressVPN are marketed as separate businesses with separate audits and separate no-logs policies. They share an owner, which means they share the point at which a policy could change. Anyone who hedged by buying two different VPNs off a comparison table may have bought the same company twice without being told.
- You can read the protocol, not the software Lightway was published as open source in August 2021 and independently audited, which is more than most providers do with their transport layer. The applications that wrap it — Windows, macOS, iOS, Android — stay closed. In February 2024 a bug surfaced in the Windows client that exposed the domains visited by anyone using split tunnelling, and it had been shipping since May 2022. Twenty-one months of a privacy product leaking the one thing it sells, found by somebody outside the company, is the argument for being able to read the client rather than the protocol.
- The people running it are part of what you are buying In September 2021 ExpressVPN's chief information officer, Daniel Gericke, settled with the US Department of Justice and paid $335,000 over hacking work carried out for the government of the United Arab Emirates. ExpressVPN kept him and defended the decision publicly rather than quietly. You can reasonably decide either way about that. What you should not do is decide it without knowing, because in a market where the product is a promise, the character of the people making it is not a side issue.
What you have to replace, not just match
Work out which half of ExpressVPN you are actually paying for, because the European providers here are strong at one of them and weak at the other.
The first half is comfort. ExpressVPN is bought by people who do not want to think about any of this: an app that installs itself, a big button, a wide map of countries, support that answers, and a bill that arrives once a year. That is a real product and it is the one the alternatives are worst at.
The second half is the promise underneath — no logs, no records, nothing to hand over. That is the half this page can improve on, because every provider below either publishes its source, owns its hardware, or has had the promise tested by police who left with nothing. If you bought ExpressVPN for the first half and switch for the second, expect a fortnight of mild irritation before it feels normal.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | Mullvad VPN | Gothenburg, Sweden | €5/month flat, no discounts or long-term plans | EU (Sweden) |
| #2 | Proton VPN | Geneva, Switzerland | Free tier / from about €4.99/month | Switzerland (adequacy decision, outside the EEA) |
| #3 | IVPN | Gibraltar | From €6/month (Standard) / €10/month (Pro) | Gibraltar (British Overseas Territory, outside the EU) |
| #4 | AirVPN | Italy | From about €3.79/month on a 3-year plan | EU (Italy) |
| #5 | OVPN | Stockholm, Sweden | From about €4.22/month on a yearly plan | EU (Sweden) |
How each alternative compares to ExpressVPN
- Which law reaches it. EU (Sweden). ExpressVPN is operated from the British Virgin Islands, outside the EU and without an adequacy decision, so transfers rest on contractual safeguards rather than on the data staying inside the EEA.
- Where the data sits. 40+ countries.
- Source code. Open source, where ExpressVPN is not: you can read what it does rather than take the description on trust.
- Independently checked. Independently audited no-logs policy, open source.
Best for: People whose objection is the owner rather than the country
Mullvad VPN AB has operated from Gothenburg since 2009 and is still run by the people who started it, Fredrik Strömberg among them as co-chief executive. There is no holding company above it, no sibling VPN brand beside it and no investor who needs an exit. Against a product that has changed hands twice since September 2021, that continuity is not a detail, it is the entire comparison.
The promise has also been examined by somebody with a warrant. On 18 April 2023 Swedish police arrived at the Gothenburg office looking for customer data, acting on a German request in a blackmail case. There was nothing to find, and they left without taking a single machine.
ExpressVPN can point to a similar outcome in Turkey in December 2017, so this is a difference of arrangement rather than of honesty: Mullvad has organised itself so that a subscription is a sixteen-digit number with no name or email attached to it, which means the seizure had nothing to seize even in principle.
What it refuses to do is the other half of the story. Port forwarding was withdrawn on 1 July 2023 after the feature attracted law-enforcement attention and cost the company hosting contracts, so anything that needs an inbound connection is out. There is no free tier, no trial, no bundle and no attempt to sell you a television catalogue. One product, one price, no discounts.
What Mullvad VPN does better than ExpressVPN
- Founder-run and never acquired, against a service whose owner has changed twice since 2021
- No sister VPN brands and no review sites inside the same group
- Every application it ships is open source, where ExpressVPN publishes only the protocol
- A Swedish company, so EU establishment rather than a British Virgin Islands registration
- Swedish police searched the office in April 2023 and recovered nothing, which is evidence rather than assurance
Where Mullvad VPN is a step down from ExpressVPN
- Port forwarding has been gone since July 2023, so inbound connections need a different provider
- Nothing to try before you buy: no free plan and no money-back window
- A considerably narrower map of countries than ExpressVPN advertises
- Geo-restricted catalogues are a fight it has chosen not to enter, and it says so
Standout against ExpressVPN. It is the only entry here whose ownership has not changed since the day it was founded, which is precisely the thing about ExpressVPN that has changed twice in the past five years.
- Which law reaches it. Switzerland (adequacy decision, outside the EEA). ExpressVPN is operated from the British Virgin Islands, outside the EU and without an adequacy decision, so transfers rest on contractual safeguards rather than on the data staying inside the EEA.
- Where the data sits. 90+ countries.
- Source code. Open source, where ExpressVPN is not: you can read what it does rather than take the description on trust.
- Independently checked. Independently audited, all apps open source.
Best for: Buyers who want the ownership question closed structurally
Proton AG works out of Plan-les-Ouates on the edge of Geneva, and since June 2024 its majority shareholder has been the Proton Foundation, a Swiss non-profit whose trustees have included Tim Berners-Lee. That is a different kind of answer from anything else on this page. Mullvad can say it has not been sold; Proton has arranged that there is no longer a controlling owner in a position to sell it at a price.
Set against ExpressVPN the contrast is exact rather than rhetorical. Kape acquired ExpressVPN because a shareholder wanted a return, and Kape was itself acquired eighteen months later for the same reason.
A foundation-controlled company still has to pay wages, and it does not have anyone whose job is to find a buyer. Whether that holds for twenty years is a bet on Swiss foundation law rather than on a management team, which is a better class of bet than most in this market.
The caveat is real and Proton raised it first. In March 2025 the Swiss government proposed surveillance amendments that would have obliged services of this kind to collect user data, and in July 2025 Proton said it would place €100 million of investment outside Switzerland because the domestic position had become too risky. The jurisdiction is not the settled thing the marketing in this category usually implies, and the company has been louder about that than any of its critics.
What Proton VPN does better than ExpressVPN
- A non-profit foundation has held the majority since June 2024, so there is no owner for the next Kape to buy from
- One VPN brand and no review sites anywhere in the group
- Applications published in full, not just the transport protocol
- An unmetered free plan, so you can judge the speed on your own line before paying for anything
- Switzerland holds an adequacy decision, which European procurement recognises and the British Virgin Islands does not have
Where Proton VPN is a step down from ExpressVPN
- Switzerland sits outside the EEA, and Proton itself called the legal position there too risky in July 2025
- The mail, drive and password products alongside it are separate purchases, not an included suite
- The free plan reaches only a handful of countries and slows when they are busy
- It is a large company with a broad product line, which is structurally the same shape as the thing you are leaving
Standout against ExpressVPN. It is the only provider here that answered the ownership question by rewriting its share register rather than by writing a paragraph in a policy.
- Which law reaches it. Gibraltar (British Overseas Territory, outside the EU). ExpressVPN is operated from the British Virgin Islands, outside the EU and without an adequacy decision, so transfers rest on contractual safeguards rather than on the data staying inside the EEA.
- Where the data sits. 35+ countries.
- Source code. Open source, where ExpressVPN is not: you can read what it does rather than take the description on trust.
- Independently checked. Independently audited, all apps open source.
Best for: People who want a single-product company that pays nobody to recommend it
IVPN Limited is registered in Gibraltar. Look closely at what that means before treating it as an upgrade: Gibraltar is a British Overseas Territory, which is the same constitutional category as the British Virgin Islands. This is a move between two British territories, not a move into Europe, and a directory that blurred that would be doing exactly what this page criticises. What Gibraltar adds is no mandatory retention and data protection rules written to line up with the GDPR.
Where it clearly beats ExpressVPN is on the thing this page is about. There is one product, one owner and no portfolio of competing brands. IVPN runs no affiliate scheme, so nobody earns a commission for putting it on a list — which means that wherever you came across it, you came across it for some reason other than money. Beside a group that owns vpnMentor and Wizcase, that is the sharpest available contrast.
The Standard plan sits near €6 a month and Pro near €10. Source code is published for every client, and an outside firm has examined the logging claim. It is a small operation with a map of roughly thirty-five countries, there is no free tier at all, and none of ExpressVPN's smoothness comes with it.
What IVPN does better than ExpressVPN
- One product and one owner, with no sibling VPNs marketed as rivals
- Pays no commission for placements, unlike a group that owns two of the sites doing the ranking
- Every client is published, where ExpressVPN opened the protocol and kept the applications closed
- Gibraltar imposes no data retention and aligns its data protection rules with the GDPR
- Accounts are created without personal details, so nothing ties the subscription to a name
Where IVPN is a step down from ExpressVPN
- Gibraltar is a British Overseas Territory exactly as the British Virgin Islands is, so this is not EU establishment
- No free plan and no trial, so evaluating it costs money up front
- About thirty-five countries, well short of what ExpressVPN lists
- A very small company, which is reassuring and risky at the same time
Standout against ExpressVPN. It is the only entry here that is honest that the jurisdiction swap is lateral, in a market that sells jurisdiction as the headline.
- Which law reaches it. EU (Italy). ExpressVPN is operated from the British Virgin Islands, outside the EU and without an adequacy decision, so transfers rest on contractual safeguards rather than on the data staying inside the EEA.
- Where the data sits. 21+ countries.
- Source code. Open source, where ExpressVPN is not: you can read what it does rather than take the description on trust.
- Independently checked. Eddie client open source (GPLv3).
Best for: Anyone who needs an inbound connection and keeps losing the feature
AirVPN has been run from Italy since 2010 by a named group of activists — Paolo Brini and staff — rather than by a company with a share register.
It is inside the EU, it is small, and it has never been anywhere near an acquisition, largely because there is no obvious asset for a holding company to buy. If your objection to ExpressVPN is that it became a line item in somebody's portfolio, this is the furthest possible distance from that.
Its practical distinction is port forwarding. Mullvad withdrew the feature on 1 July 2023 and most large providers have quietly done the same, so if you run a service, seed, or need anything to reach you through the tunnel, this page narrows to a single name. The Eddie client is published under GPLv3 and the plans run from about €3.79 a month on a three-year term, with a three-day option for trying it.
The trade is comfort, completely and deliberately. Support is a forum, the documentation assumes you know what a routing table is, the interface is built for function, and around twenty-one countries is the smallest map on this page. ExpressVPN spends its money on making sure you never have to think; AirVPN spends none of it on that.
What AirVPN does better than ExpressVPN
- Port forwarding still works, where Mullvad dropped it in July 2023 and most large providers no longer bother
- An Italian operation, so EU establishment rather than a Caribbean registration
- Run by named individuals with no parent company, no sibling brands and no investor
- The Eddie client is GPLv3, against closed ExpressVPN applications
- A three-day plan, so a proper test costs about the price of a coffee
Where AirVPN is a step down from ExpressVPN
- Around twenty-one countries, the narrowest coverage of anything listed here
- Support is a community forum rather than a desk that answers at midnight
- The interface is built for people who enjoy configuration, which is the opposite of why ExpressVPN gets bought
- The headline price needs a three-year commitment; shorter terms cost noticeably more
Standout against ExpressVPN. It is the only provider here that will still give you an inbound port, which turns a niche preference into the only reason some people can leave ExpressVPN at all.
- Which law reaches it. EU (Sweden). ExpressVPN is operated from the British Virgin Islands, outside the EU and without an adequacy decision, so transfers rest on contractual safeguards rather than on the data staying inside the EEA.
- Where the data sits. 96 self-owned servers in 30 locations.
- Source code. Closed source, as ExpressVPN is.
- Independently checked. No-logs policy tested in Swedish court, diskless servers.
Best for: People who rate physical control above being able to read the code
OVPN Integritet AB is in Stockholm and starts at about €4.22 a month on an annual plan. Its distinguishing decision is that it buys its machines outright instead of renting capacity, and fits none of them with drives, so there is physically nowhere for a record to be written. That converts a sentence in a policy into a property of the building, which is a stronger form of the same promise ExpressVPN makes in prose.
It is placed last here for reasons that only matter on a page about verification. The applications are closed, so this is trust rather than inspection — the identical criticism this page makes of ExpressVPN. And OVPN runs an affiliate programme, which means some of the places you will find it recommended are paid placements. Neither is unusual and neither is dishonest; both are the precise practices the four entries above it have declined.
Ninety-six machines across thirty locations is a small map, the refund window is ten days, and none of the convenience that makes ExpressVPN worth its price comes across with you.
What OVPN does better than ExpressVPN
- Every server is owned rather than leased, so no data centre operator stands between the company and its promise
- Machines run with no disks at all, making the absence of records physical rather than contractual
- A Swedish company inside the EU, against a British Virgin Islands registration
- One brand and one owner, with no group of competing VPNs sharing a boardroom
Where OVPN is a step down from ExpressVPN
- The applications are closed source, which is the central complaint this page makes about ExpressVPN
- It runs an affiliate programme, so part of its visibility in comparison articles is bought
- Thirty locations is a thin map next to what ExpressVPN advertises
- Ten days to change your mind, and no free tier to test with first
Standout against ExpressVPN. It answers the physical half of the question better than anything here and the transparency half worse, which is exactly why it sits at the bottom of a page about what you can check.
What actually breaks when you switch
Before you choose the replacement, check where the shortlist came from. If you narrowed it down on a big comparison site, look for the ownership disclosure — vpnMentor prints one, and it names ExpressVPN, CyberGhost and Private Internet Access as stablemates. Nothing there is hidden, but a recommendation from a sibling company is a different object from a recommendation, and it takes thirty seconds to tell them apart.
The second thing to plan for is the account with no password.
Mullvad issues a sixteen-digit number and IVPN an account identifier, and neither is recoverable: there is no reset email, no security question and no support agent who can find it for you, because none of them know who you are. Write it down somewhere that is not the laptop the subscription is protecting, and do it on the day you sign up rather than the day you need it.
Third, test the connection on your own line before you cancel anything. Lightway is unusually good at surviving a phone hopping between networks, and WireGuard behaves differently; a provider with twenty-one or thirty-five countries may have nothing near the city you actually connect through. Proton VPN's free plan and AirVPN's three-day option make running the replacement in parallel almost free, and that fortnight settles arguments no comparison table can.
If the CLOUD Act does not reach it, what is actually wrong with ExpressVPN?
On the product, very little, and this page will not invent a defect. The apps are the best-made in the category, Lightway is a genuinely good protocol and it is published, the no-logs position held up when Turkish investigators seized a server in December 2017, and the British Virgin Islands imposes no data retention obligation.
What is wrong is structural and it is about information. The company belongs to a group that also owns four other VPN brands and two of the review sites that rank them. That does not make the service worse; it makes it much harder for you to find out whether it is better, because a large share of the public evidence in this market is published by people with a stake in the answer.
If you researched your VPN properly, from sources you chose, and you are happy, staying is defensible. If you bought it because it came top of a list, the list is worth checking before the subscription is.
Is Gibraltar really an improvement on the British Virgin Islands?
Constitutionally, barely. Both are British Overseas Territories. Moving from ExpressVPN to IVPN takes you from one Caribbean-registered British territory to one Mediterranean-registered British territory, and it does not put you inside the European Union. Pages that present that move as a jurisdictional leap are selling you a map rather than a fact.
What Gibraltar has in its favour is that it imposes no mandatory data retention and its data protection rules are aligned with the GDPR, so a European buyer is in familiar regulatory territory. That is worth something and it is not the same as EU establishment.
If EU establishment is genuinely your requirement — because procurement wrote it down, or because you want a supervisory authority you can actually complain to — then only the Swedish and Italian entries on this page satisfy it, and Switzerland does not either.
How much does an independent audit tell me here?
It tells you that a firm looked at a configuration on a particular week and it matched the description. Every serious provider in this market now buys one, including all four Kape brands, which is precisely why an audit no longer distinguishes anybody.
The forms of evidence that are harder to manufacture are the ones this page ranks on. Source code anyone can read, at any hour, without an appointment. Servers with no drives in them. And the strongest of all: a state showing up with a warrant and leaving with nothing, which has happened to Mullvad in Sweden and to ExpressVPN in Turkey.
Rank the evidence rather than counting the certificates, and the shortlist reorders itself into something much shorter.
Will a European provider feel like a downgrade day to day?
In the first fortnight, probably. ExpressVPN puts an enormous amount of engineering into making the decision invisible — the app picks a server, the connection survives a network change, the support desk answers, and nothing asks you a question you cannot answer.
Most of the providers here are smaller companies selling one product, and it shows in the edges: fewer countries, less polish on television and router setups, support by email rather than chat, and in AirVPN's case documentation written for someone who already understands routing.
What you gain is that you can check the claim rather than trust it. Whether that trade is worth a fortnight of friction depends on why you bought a VPN, and it is a legitimate answer that for some people it is not.
Which one to pick
If your objection is the group — four VPN brands and two review sites under one owner — Mullvad answers it most completely. It has never been sold, its founders still run it, and a Swedish search warrant in April 2023 produced nothing at all.
If you would rather the ownership question were shut permanently than answered by the current management, Proton VPN is the structural choice, with the honest caveat that Proton itself has said Switzerland is becoming a worse place to be.
If you need an inbound port, the decision is made for you: AirVPN is the only entry here that still provides one, and everything else about it is the price of that.
And be exact about jurisdiction rather than enthusiastic. Gibraltar is a British Overseas Territory just as the British Virgin Islands is, Switzerland is outside the EEA, and only Mullvad, OVPN and AirVPN put your provider inside the European Union.
ExpressVPN is a good product whose no-logs claim survived a real seizure in Turkey. The reason to leave is who owns it and how little of it you can check — and if neither troubles you, staying is a perfectly respectable answer.
Frequently Asked Questions
Mullvad if your objection is the ownership, because it is the only one here that has never been sold. Proton VPN if you want that answered structurally rather than promised, since a non-profit foundation holds the majority of it. IVPN if you want a single-product company that pays nobody to recommend it. AirVPN if you need port forwarding, which almost nobody still offers. OVPN if physical control of the hardware matters more to you than reading the source.
Kape Technologies plc, which bought it on 13 September 2021 for $936 million. Kape also owns CyberGhost, Private Internet Access and ZenMate, and through its purchase of Webselenese it owns the review sites vpnMentor and Wizcase. Kape itself was taken private in May 2023 by Unikmind Holdings Limited, controlled by Teddy Sagi. The entity you contract with remains Express Technologies Ltd. in the British Virgin Islands.
No. That statute binds providers established on American soil, and Express Technologies Ltd. is registered in the British Virgin Islands, which imposes no retention mandate either. A directory that repeated that claim would have no business making the true ones, so it is worth stating flatly: the argument on this page is about ownership and about what you are able to verify, not about American law.
No, and the dates settle it. The adware complaints attach to Crossrider, a browser-extension toolkit whose customers included ad injectors; that business was wound up in 2016 — Kape's own history has it stopping the browser SDK to move into VPNs, buying CyberGhost the following year — and the company was renamed Kape Technologies in March 2018.
ExpressVPN, founded in 2009, was bought five years after the extension business closed. The owner's history is a fair reason to scrutinise the owner and it is not evidence about the product.
Partly, and it is the less common half. The Lightway protocol was released as open source in August 2021 and audited, which many competitors have not done with their transport layer. The desktop and mobile applications remain closed, and the application is what sees your traffic in the clear. Mullvad, Proton VPN, IVPN and AirVPN publish their clients; OVPN does not.
A flaw in the Windows client meant that users of split tunnelling had the domains they visited exposed rather than resolved through the tunnel.
It was present from May 2022 and disclosed in February 2024, so it shipped for around twenty-one months before anyone outside the company found it. ExpressVPN pulled the feature and fixed it. The lesson is not that the company was careless; it is that a closed client takes years to be checked and an open one takes days.
Yes, and it held. Turkish investigators seized one of its servers in December 2017 during an inquiry into the assassination of the Russian ambassador, and no user records were recovered. That is real evidence and it belongs on this page alongside the criticism. The only comparable episode among the alternatives is the Swedish police visit to Mullvad in April 2023, which ended the same way.
No. Lightway is ExpressVPN's own protocol, and although its source is public, nobody on this page ships it. The alternatives here run WireGuard, which is fast, small enough to be audited properly and supported by every provider listed. If you specifically like how Lightway reconnects when your phone changes network, test that behaviour on a replacement before you cancel.
Less reliably, and several of them do not try. Keeping access to region-locked catalogues means continually replacing addresses that streaming services block, and providers that sell privacy rather than entertainment have mostly declined that race. If the honest reason your subscription renews is a television catalogue in another country, ExpressVPN is better at it and no amount of jurisdiction should talk you out of noticing that.
Who worked on this review
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.