ExpressVPN says two of its privacy-focused products, ExpressMailGuard and Identity Defender, have gone through independent security audits by Cure53, a Berlin-based cybersecurity firm known for white-box penetration testing.
ExpressMailGuard is an email relay service that lets users create aliases instead of sharing their real email address. When a message is sent to an alias, ExpressMailGuard forwards it to the user’s real inbox while keeping the actual address hidden from the sender.
According to ExpressVPN, the service is built around two main promises: emails are not stored on its servers after being relayed, and the relay system should not be usable to build a profile of who users communicate with. Cure53 reviewed the web app, routing logic, and infrastructure to check whether those protections could be broken.
After 18 days of testing, Cure53 found no critical or high-severity vulnerabilities in ExpressMailGuard. The firm said the product showed a strong and mature security posture. It reported two vulnerabilities and eleven miscellaneous issues, which ExpressVPN says have since been fixed and verified through retesting.
Identity Defender, available as a standalone app for users in the United States, monitors signs that someone’s identity may be misused. It can alert users about new credit inquiries, unexpected address changes, and personal information appearing in data-broker databases or breach lists. The app can also submit removal requests to data brokers on behalf of users.
Because Identity Defender handles personal information, Cure53 focused on user authentication, personally identifiable information, and how sensitive data is stored on iOS and Android devices.
After 14 days of testing, Cure53 again found no critical or high-severity issues. The audit identified seven vulnerabilities and four miscellaneous issues. ExpressVPN says its team fixed the problems, and Cure53 formally retested and verified the fixes.
The company says the two new reports bring its total number of published independent audits to 27. Full Cure53 reports for ExpressMailGuard and Identity Defender are available on the ExpressVPN Trust page, along with the company’s wider audit history and ISO certifications.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
