- Who each VPN tends to suit
- Questions that decide a VPN choice
- NordVPN and ExpressVPN side by side
- Protocols and speed: NordLynx versus Lightway
- Streaming, travel and local laws on VPN use
- VPNs for work: NordLayer and ExpressVPN for Teams
- Questions to ask before you buy any VPN
- What a VPN can and can't do
- A simple way to choose between them
- Frequently asked questions
NordVPN states Panama as its jurisdiction and uses NordLynx; ExpressVPN states the British Virgin Islands and uses Lightway. Both cite independent audits, and both have business products. Choose by device count, audit history, travel needs and whether you're buying for yourself or a team.
A VPN is one of those tools people buy because someone told them to, then never think about again. If you run a small business, work from cafes and hotels, or simply don't love public Wi-Fi, it's worth understanding what you're choosing. NordVPN and ExpressVPN are two of the best-known names, and they overlap a lot. This comparison is built from each company's own product, support and security pages, not a long personal trial, so it's a guide to the differences worth weighing rather than a lab result. Both companies publish a lot of marketing, so I've stuck to what they state and flagged where the detail depends on the plan.
Who each VPN tends to suit
| If you are | You may lean towards | Why |
|---|---|---|
| A household or team with lots of devices | Either | NordVPN says up to 10 devices at once; ExpressVPN says up to 14 |
| Someone who values a long, published audit history | NordVPN | Its pages describe repeated independent no-logs assurance engagements |
| Someone who likes RAM-only servers and a protocol audit | ExpressVPN | It describes RAM-only TrustedServer technology and an audit of its Lightway protocol |
| A small business that wants more than a consumer app | Either | NordLayer and ExpressVPN for Teams are both aimed at businesses |
| A traveller who wants lots of server locations | Either | Both advertise servers in well over a hundred countries |
| A person who simply wants the quickest set-up | Either | Both have apps for the main platforms; try the apps before committing |
These are leanings, not rulings. Both products change often, so use this page to decide what to look for, then check the current pages.
Questions that decide a VPN choice
Where is the company based, and does it matter to you?
Jurisdiction is the question people ask first, so here's what each company says. NordVPN's support pages say it's based and operates under the jurisdiction of Panama, and that Panama has no mandatory data retention law. Its parent company, Nord Security, is headquartered in the Netherlands. ExpressVPN's site says it's registered in the British Virgin Islands, which it describes as a jurisdiction with strong privacy laws. Those are the companies' own descriptions; I'm not a lawyer, so check with one if a legal point matters to your business.
What has been independently checked?
A no-logs promise is only a promise until someone outside the company looks. NordVPN describes assurance engagements on its no-logs claims by PricewaterhouseCoopers Switzerland in its earlier years and by Deloitte in more recent ones, with the full reports viewable after logging into a Nord account. ExpressVPN's no-logs page lists an audit by KPMG, a security audit by Cure53 of its TrustedServer technology, and an audit by PwC Switzerland of its privacy policy compliance and TrustedServer. Separately, ExpressVPN says it commissioned Cure53 to test its Lightway protocol. Audits are snapshots in time, so read what each one covered.
What will you connect, and from where?
Think about the real use. Safer browsing on hotel Wi-Fi is different from checking a service in another country, which is different from giving a team secure access to company tools. The first two are consumer jobs; the last is a business one, and the business products below are built for it.
NordVPN and ExpressVPN side by side
| Area | NordVPN | ExpressVPN |
|---|---|---|
| Stated jurisdiction | Panama (parent company in the Netherlands) | British Virgin Islands |
| Independent checks | PwC Switzerland, then Deloitte, per its own pages | KPMG, Cure53 and PwC Switzerland, per its own page |
| Own protocol | NordLynx, based on WireGuard | Lightway, plus WireGuard and OpenVPN |
| Simultaneous devices | Up to 10 on one account | Up to 14 |
| Server reach | Advertises servers in about 150 countries | Advertises servers in 113 countries |
| Server design | See its security pages for current details | RAM-only servers (TrustedServer) |
| Business product | NordLayer, built on zero-trust principles | ExpressVPN for Teams, with an admin dashboard |
| Audit scope | Reports viewable after logging in to a Nord account, per its pages | Audits listed on its no-logs page |
Figures like server counts and device limits move, so treat the numbers as a snapshot from the companies' pages and look at the current ones before you decide.
Protocols and speed: NordLynx versus Lightway
A protocol is the set of rules your device and the VPN server use to build the encrypted connection. NordVPN's NordLynx is built on WireGuard, a newer and lighter design. ExpressVPN's Lightway is its own protocol, with code it has made open source, and it also supports WireGuard and OpenVPN. In plain terms, both are aimed at quick connections and fewer dropouts on phones moving between Wi-Fi and mobile data. Neither company's marketing proves speed on your connection, so if speed matters, use whatever trial route each offers and test on your own broadband.
Streaming, travel and local laws on VPN use
People often buy a VPN to reach home services while abroad. Both companies advertise servers in many countries, but which streaming services work from a given server changes constantly, because the services block VPN traffic. Check each service's terms of use too. Laws on VPNs also differ by country: they are legal to use in many places, restricted in some and banned in a few. Before you travel, look up the rules for your destination on an official government travel page.
VPNs for work: NordLayer and ExpressVPN for Teams
If you manage a team, a consumer app shared on one login isn't a great idea. NordLayer describes itself as a business VPN built on zero-trust principles, with identity-based access, device checks, multi-factor enforcement and a central control panel. ExpressVPN for Teams describes a single admin dashboard for assigning and reclaiming licences, bulk onboarding, and SCIM sync with an identity provider. Both are separate products from the consumer apps, so read their pages as you would any business software.
A VPN is only one layer. Strong passwords, up-to-date devices and staff who know what a phishing email looks like matter at least as much, and my guide to building a strong cybersecurity culture in your organisation covers that side. If you run a website too, securing and protecting your website is a sensible companion.
Questions to ask before you buy any VPN
Marketing pages for VPNs all sound alike, so it helps to have your own checklist. These questions work for NordVPN, ExpressVPN or anyone else.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
- Who runs it, and where? Look for a clear company name and a stated jurisdiction.
- What exactly was audited? A no-logs audit, a protocol audit and a policy review are three different things.
- Can you read the result? Some companies publish summaries, others show full reports only to account holders.
- Which platforms are covered? Check phone, laptop, tablet, router and any work devices.
- How do you get help? Find the support options before you need them.
- What happens to your data at sign-up? Read the privacy policy for what the company collects about you, such as account and payment details.
Write the answers down for both and compare them side by side. It takes ten minutes and tells you more than any headline.
What a VPN can and can't do
- It encrypts your traffic between your device and the VPN server. That helps on shared Wi-Fi.
- It hides your IP address from the sites you visit. It doesn't make you anonymous if you sign in to your accounts.
- It won't stop phishing or malware. You still need good habits and security software.
- It moves trust, it doesn't remove it. You are trusting the VPN company, which is why audits and jurisdiction get so much attention.
- It can't override a service's rules. Terms of use still apply.
One related privacy point: your domain registration details are another place personal information can leak, which I cover in what WHOIS privacy protects.
A simple way to choose between them
- Write down your main job: public Wi-Fi, travel, or team access.
- Count the devices you need covered, and check the limit on each plan.
- Read what each company says it has had independently checked, and when.
- Note the stated jurisdiction and decide if it matters to you.
- Try the apps on your actual phone and laptop, using any trial or guarantee terms on their sites.
- If you're buying for a team, look at the business product, not the consumer one.
Make VPN or online security software? See how to get it featured on this list.
Frequently asked questions
Where are NordVPN and ExpressVPN based?
NordVPN's support pages say it operates under the jurisdiction of Panama, with its parent company in the Netherlands. ExpressVPN says it's registered in the British Virgin Islands. These are the companies' own statements.
Have NordVPN and ExpressVPN been independently audited?
Both describe independent audits on their own pages. NordVPN names PricewaterhouseCoopers Switzerland and Deloitte, and ExpressVPN lists KPMG, Cure53 and PwC Switzerland. Audits are point-in-time, so read what each covered.
What are NordLynx and Lightway?
They are each company's own connection protocols. NordLynx is based on WireGuard. Lightway is ExpressVPN's own protocol, and ExpressVPN also supports WireGuard and OpenVPN.
How many devices can I connect at once?
NordVPN says up to 10 devices on one account. ExpressVPN says up to 14. Limits can change, so check the current plan page.
Is there a business version of each?
Yes. NordVPN's business product is NordLayer, and ExpressVPN has ExpressVPN for Teams. Both are separate from the consumer apps and aimed at managing access for staff.
Is it legal to use a VPN?
In many countries yes, but rules differ and a few places restrict or ban VPNs. Check the official government guidance for any country you're travelling to or working in.
