ExpressVPN Trust Center

The ExpressVPN software is guarded, from creation to software delivery, against contamination with malicious code, due to an in-house build verification system that has been independently reviewed.

We use public-private key pairs for a variety of security purposes, such as two-factor authentication, signing Git commits, and connecting to a server via SSH. We mitigate the risk of our private keys being stolen by keeping them on hardware security devices. This means that even if our workstations are compromised, an attacker cannot steal our private keys.

These devices are secured with strong passphrases and are configured to “brick” themselves after multiple failed attempts to unlock them. The devices require a physical touch to operate, meaning that malware cannot steal the keys without a human being involved.

All production code requires at least one other human to act as a reviewer. This makes it much more difficult to add malicious code, either from insider threat or if an employee’s workstation is compromised.

We use SSH as a secure way to gain remote access to our critical servers. These SSH servers are configured to only use a set of highly secure ciphers, key exchange algorithms, and MACs. We also don’t allow connecting as root, and authentication can only occur using strong SSH keys—no passwords allowed. We use intermediate SSH bastion hosts to segregate production infrastructure from the open internet. These machines only accept traffic from addresses on an IP whitelist.

All of this configuration is defined in code, so it is peer reviewed and reproducible. 

For production machines, software dependencies are updated automatically via unattended upgrades.

To mitigate the threat of stolen keys being used to impersonate a VPN server, we require the ExpressVPN application to check in with our API servers to receive updated configuration settings. Our applications authenticate the servers they are connecting to by validating the private Certificate Authority (CA) signature and common name ensuring that an attacker cannot impersonate us. 

ExpressVPN’s password manager (named ExpressVPN Keys) leverages zero-knowledge encryption to ensure that no one—not even ExpressVPN—can decrypt the information our users store. Zero-knowledge encryption ensures that if there was a data breach of our servers, an attacker would not be able to decrypt any information stored by our users. This information is only ever decrypted on a user’s device, and can only be decrypted using encryption keys generated by the user’s primary password—which only they know.

Security and privacy threat modeling is incorporated into the design phase of any system. We use the MITRE ATT&CK framework to identify threats that can exist in our designs, consider ways to remove them, and apply sufficient measures to minimize potential risks. 

All our users, services, and operations follow the least-privilege model. Our employees are authorized access to only the services and production systems necessary for their roles. Our customer-support agents work under two environments, an untrusted one for general web browsing activities and a restrictive one for accessing sensitive systems. These measures minimize the impact and thwart the goals of the attackers should they manage to take over any of our accounts.

We continuously monitor our internal services and infrastructure for any anomalous or unauthorized activity. Our 24/7 on-call security team performs real-time monitoring and triaging of security alerts. 

Many of our systems are automatically destroyed and rebuilt several times per week, if not on a daily basis. This limits the potential length of time that an attacker lurks within our systems. 

We perform regular penetration tests to evaluate our systems and software to identify vulnerabilities and weaknesses. Our testers have full access to the source code and employ a combination of automated and manual testing to ensure a thorough evaluation of our services and products.

We engage independent auditors to review the security of our services and software. These engagements serve as validation that our internal controls are effective in mitigating security vulnerabilities, while offering customers documentation on the accuracy of the security claims we make about our products.

See the full list of audit reports