Despite the controversial acquisition by Kape Technologies, ExpressVPN’s core technical architecture physically prevents the parent company from accessing or logging your online data.
Specifically, ExpressVPN utilizes RAM-only servers and operates under the British Virgin Islands legal jurisdiction to provide a strict barrier against corporate overreach.
If you are researching the ExpressVPN Kape Technologies merger, you likely want to know if your browsing history remains secure today.
To help you navigate these concerns, this guide will break down the controversial corporate history and the recent financial buyouts surrounding Kape Technologies. We will then examine ExpressVPN’s physical server defenses to show you exactly how your data remains structurally secure despite the complex holding company.
Key takeaways:
- Kape Technologies acquired ExpressVPN in September 2021 for $936 million.
- Kape’s predecessor, Crossrider, operated an ad-injection platform that created significant industry skepticism.
- ExpressVPN utilizes TrustedServer technology, running exclusively on volatile RAM to ensure no browsing history is written to hard drives.
- Independent audits by KPMG (June 2025) and Cure53 (May 2022) confirm that Kape Technologies has not compromised the zero-logs policy.
- In June 2023, Teddy Sagi’s Unikmind Holdings took Kape Technologies private, removing it from the London Stock Exchange.
2. The ExpressVPN Kape Technologies controversy: From Crossrider to a VPN monopoly
The corporate history of Kape Technologies starts in the advertising sector rather than cybersecurity. Understanding this timeline is essential to separate factual financial history from online rumors.
The company’s shift from advertising technology to digital privacy set the stage for a massive industry consolidation. This aggressive expansion ultimately led to the $936 million acquisition of ExpressVPN.
2.1. The origins of the Crossrider SDK
Kape Technologies originally operated under the name Crossrider. Founded in 2011, Crossrider built a software platform and development kit (SDK) designed to help developers create browser extensions. However, the platform quickly became entangled in the intrusive adware industry.
A 2015 joint study by Google and UC Berkeley exposed the technical reality of this ecosystem. The research specifically named Crossrider among the affiliate businesses responsible for distributing ad-injection software. According to the Google Security Blog, this affiliate network drove installations through aggressive tactics, including bundling applications with popular downloads and, in some cases, outright malware distribution.
By actively participating in this ad-injection economy, Crossrider created massive industry skepticism and a legacy of distrust that still follows the Kape Technologies brand today.
2.2. The pivot to cybersecurity and Kape rebranding
In 2016, a new management team took over and pivoted the company entirely toward the cybersecurity sector. To distance itself from the adware controversies of the past, the corporation officially rebranded to Kape Technologies plc in March 2018.
Following this name change, Kape Technologies executed a timeline of aggressive industry acquisitions to build its current software portfolio. The company purchased CyberGhost in 2017, ZenMate in 2018, and Private Internet Access in 2019.
This consolidation strategy turned the former advertising company into a dominant force in the digital privacy market. The aggressive buying spree culminated in September 2021, when Kape acquired ExpressVPN for $936 million.
Related reading: Since both ExpressVPN and PIA now operate under the same corporate umbrella, many users wonder how they stack up against each other. For a detailed breakdown of their speeds, server networks, and independent audits, check out our head-to-head comparison: ExpressVPN vs PIA
3. Teddy Sagi and the 2023 Unikmind privatization
The $936 million buyout of ExpressVPN was not the final major financial shift for the holding company. To understand the current transparency of Kape Technologies, we must look at a major financial restructuring that occurred shortly after.
This move directly affects how public data is reported today and how much visibility users have into the corporation’s finances.
3.1. The mechanics of the June 2023 buyout
The primary financial backer behind Kape Technologies is Israeli-Cypriot businessman Teddy Sagi. In June 2023, Sagi executed a major structural change through his personal investment firm, Unikmind Holdings Limited.
Unikmind Holdings officially acquired all the remaining shares of Kape Technologies that Sagi did not already own. This strategic financial acquisition consolidated full ownership under a single private entity, completely shifting the balance of corporate control away from public shareholders.
By purchasing the remaining shares, Teddy Sagi effectively pulled the holding company out of the public trading sphere. This transition from a public entity to a privately held corporation significantly altered the company’s operational transparency and its regulatory obligations to the open market.
3.2. The impact on public financial reporting
The Unikmind buyout successfully delisted Kape Technologies from the London Stock Exchange. Taking a company private means the corporation is no longer legally required to publish detailed quarterly financial reports for public shareholders.
This reduction in mandatory financial disclosure generated heavy skepticism within privacy communities. Users rely on corporate transparency to ensure that a cybersecurity company is operating ethically and sustainably.
Because public transparency decreased, privacy advocates correctly demanded a heavier reliance on independent third-party server audits. Without public financial records, these technical audits remain the only way to verify that ExpressVPN is actually securing user data.
4. The illusion of choice: Kape’s ownership of VPN review sites
Beyond buying software providers, Kape Technologies also purchased the media outlets that review those exact products. This strategy creates a closed ecosystem that heavily influences online recommendations.
You must understand this ownership dynamic before trusting general online rankings. Knowing who owns the review sites will help you evaluate the validity of their top-ranked products.
4.1. The $149.1 million Webselenese acquisition
Kape Technologies does not just own cybersecurity products like ExpressVPN and CyberGhost. In 2021, the corporation paid $149.1 million to acquire Webselenese, vastly expanding its financial influence across the digital privacy market.
Webselenese is a massive online publishing parent company that operates major tech review websites, specifically vpnMentor and Wizcase. These websites explicitly claim to offer independent, objective rankings of digital privacy tools for everyday consumers seeking unbiased advice.
By purchasing Webselenese, Kape Technologies gained direct editorial control over platforms that reach millions of potential buyers every single month. This structural acquisition means the parent company of ExpressVPN now actively dictates the editorial content on the very websites reviewing ExpressVPN.
4.2. Navigating affiliate marketing conflicts of interest
This cross-ownership creates a massive conflict of interest in the cybersecurity review industry. A direct feedback loop occurs when users search for independent reviews and land on vpnMentor.
The site then funnels those readers toward Kape-owned products like ExpressVPN or CyberGhost through highly visible affiliate links. When a user purchases a subscription through these links, the Kape-owned review site earns a commission, keeping all the money within the same corporate umbrella.
You should remain highly skeptical of commercial rankings that fail to explicitly disclose these corporate ownership ties. Always verify technical claims through independent security audits rather than relying solely on affiliate-driven review articles.
5. The human element: Decoding the Daniel Gericke and Project Raven controversy
Alongside corporate acquisitions, personnel choices at ExpressVPN have also sparked intense debate regarding trust and security. The hiring of a specific executive brought international legal scrutiny to the brand.
5.1. The $335,000 Department of Justice settlement
In September 2021, the United States Department of Justice fined then-ExpressVPN Chief Information Officer Daniel Gericke $335,000. This fine stemmed directly from his involvement in an operation known as Project Raven.
Gericke previously worked as a mercenary hacker for the United Arab Emirates, helping them develop a zero-click exploit system known as Karma. The UAE utilized this powerful system to target suspected terrorists, human rights activists, and political dissidents without requiring the victim to click any malicious links.
The DOJ issued the fine because Gericke and two others provided these advanced defense services to a foreign government without a valid United States export license. This legal violation resulted in a formal deferred prosecution agreement.
However, it is crucial for users to understand that this specific personnel controversy is now firmly in the past, as Daniel Gericke officially departed from ExpressVPN in 2023.
5.2. ExpressVPN’s offensive defense strategy
At the time of the DOJ settlement, ExpressVPN released an official corporate response defending their initial decision to hire Gericke. The company stated they knowingly brought him on board for his extensive background in offensive state-sponsored hacking.
Their rationale was that understanding advanced exploitation techniques allowed them to harden the ExpressVPN infrastructure against those exact threats. To prevent internal sabotage or rogue actions, Gericke helped implement strict system compartmentalization across the entire network during his tenure.
Today, this security setup remains fully active. It requires multi-factor authentication and a mandatory “four-eyes review” for any code changes. This ongoing operational rule ensures that no single employee, including current executives, can secretly implement a backdoor into ExpressVPN’s software.
6. The ExpressVPN firewall: Can Kape Technologies actually access your data?
While the corporate history and personnel choices present clear controversies, the actual security of your data depends entirely on the physical hardware. We must evaluate the technical architecture to see if the parent company can legally or mechanically extract your browsing history.
The physical infrastructure and legal jurisdiction of ExpressVPN provide a definitive answer to these privacy concerns.
6.1. TrustedServer architecture and volatile RAM
Traditional network servers write your browsing history and connection logs directly to physical hard disk drives. These drives retain data permanently until it is manually overwritten, creating a massive vulnerability if the server is seized.
ExpressVPN utilizes a custom framework called TrustedServer, meaning the operating system and network stack run exclusively on volatile RAM. Because RAM requires continuous electricity to retain data, all information is physically obliterated the moment a server reboots or loses power.
Functionally, this means even if Kape Technologies executives or government authorities demand historical user traffic logs, the data structurally does not exist to be handed over. The hardware physically prevents long-term data storage.
6.2. The British Virgin Islands legal shield
The physical server design is heavily reinforced by a strict legal firewall. While Kape Technologies operates under United Kingdom jurisdictions, the legal entity controlling user data remains strictly incorporated in the British Virgin Islands.
The BVI has no mandatory data retention laws, meaning ExpressVPN is never legally required to log your online activity. Furthermore, this location operates entirely outside the intelligence-sharing alliances of the United States and the United Kingdom.
This strategic location legally shields ExpressVPN from foreign subpoenas. Even if a UK court ordered Kape Technologies to provide user data, the BVI subsidiary is legally protected from complying with that foreign demand.
6.3. Verification through independent audits
Independent auditing firms routinely test these privacy claims to ensure strict compliance under the new Kape Technologies ownership. A December 2023 Privacy Policy Audit and a June 2025 no-logs audit by KPMG verified that ExpressVPN strictly adheres to its internal data protection rules.
These extensive audits confirmed that the parent company has not forced ExpressVPN to start tracking user activity or altering its privacy commitments. Furthermore, a May 2022 penetration test by Cure53 proved that no backdoors exist within the RAM-only hardware.
These independent tests confirm the zero-logs policy remains completely intact despite the complex corporate holding structure. Users can rely on these third-party verifications to trust the physical infrastructure.
7. Alternatives to Kape-owned VPNs
If the corporate ties of the parent company still conflict with your personal security requirements, you have other reliable options. Selecting a provider ultimately depends on understanding your specific risk factors.
7.1. Determining your personal threat model
You must clearly determine your personal threat model to choose the right privacy software for your daily internet usage. If your primary goal is bypassing geo-blocks, streaming 4K video, or securing standard public Wi-Fi connections, the ExpressVPN infrastructure remains highly secure and incredibly effective.
The RAM-only servers are more than enough to protect against everyday cyber threats and local network snooping. Conversely, if you are a strict privacy advocate whose threat model involves absolute personal data sovereignty, uncompromising demands for corporate transparency, or severe opposition to industry consolidation, migrating away from Kape Technologies is a logical choice.
For highly privacy-conscious users seeking complete isolation from large corporate holding companies, moving to a fully independent provider ensures maximum structural transparency.
7.2. Verified independent alternatives
For users seeking an immediate exit strategy from Kape-owned products, Mullvad and Proton VPN stand out as verified independent alternatives. Both platforms are crowdsourced community favorites that operate entirely outside of large, consolidated holding companies.
They maintain strict corporate independence, meaning no outside investors or parent corporations dictate their privacy policies or security features. Both Mullvad and Proton VPN have successfully undergone rigorous third-party security audits to validate their no-logs claims.
By choosing these independent alternatives, you ensure that your internet traffic remains highly transparent and completely free from the influence of broader digital marketing conglomerates.
8. FAQs about ExpressVPN Kape Technologies
Is ExpressVPN owned by Kape Technologies?
Yes, acquired in 2021. Kape Technologies officially acquired ExpressVPN in September 2021 for $936 million. ExpressVPN now operates as a subsidiary under the larger holding company.
Is ExpressVPN still a legitimate and safe company?
Yes, the technology remains highly secure. Despite ownership concerns, ExpressVPN is technologically safe due to its TrustedServer architecture, which runs exclusively on RAM. Rigorous independent audits continually verify that its zero-logs policy remains uncompromised.
Which VPNs do Kape Technologies own?
They own four major VPN brands. The complete Kape portfolio currently includes ExpressVPN, CyberGhost, Private Internet Access, and ZenMate. This consolidation makes Kape one of the largest holding companies in the cybersecurity industry.
What is the controversy with Kape Technologies?
The controversy stems from their past as Crossrider. Under this previous name, the company operated a software platform that was named in a 2015 Google study as part of an affiliate network responsible for distributing adware and unwanted programs. This active history in the intrusive ad-injection economy created long-standing distrust within the privacy community.
Who owns Kape Technologies?
It is backed by Teddy Sagi. The Israeli-Cypriot billionaire is the primary financial backer of the corporation. He successfully took the holding company private via Unikmind Holdings in June 2023.
9. Conclusion
Evaluating the ExpressVPN Kape Technologies merger requires separating corporate history from physical hardware capabilities. While Kape Technologies has a highly controversial corporate past and utilizes aggressive market consolidation tactics, the underlying cryptographic hardware remains solid.
The RAM-only TrustedServer technology and the strict British Virgin Islands legal jurisdiction successfully insulate your ExpressVPN data from corporate overreach.
You must assess your own threat model to make the final decision. You can remain confident using ExpressVPN for high-speed streaming and robust encryption, but switching to an independent provider is reasonable if corporate transparency is your absolute top priority.
For more detailed insights and step-by-step security walkthroughs, explore our comprehensive VPN Guides on Safelyo.
