Expo

United States · expo.dev · 26 vendors

Expo is a full-stack React Native framework and platform that provides open-source tools and cloud services (Expo Application Services - EAS) for building, deploying, and iterating on cross-platform mobile applications. It enables developers to write a single codebase in JavaScript for Android, iOS, and the web, simplifying and accelerating the app development process.

Resilience scores

Disruption prediction

Expo has an estimated 11% probability of disruption in the next 6 months.

16 of Expo's 26 vendors monitored for disruptions.

Technology vendors

Services catalogue

4 services in catalogue across 2 categories; runs on 26 sub-vendors.

Insights

Last updated 2026-04-15 · revision 3

26 direct vendors, 332 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Expo exhibits high migration readiness, primarily due to its highly modern and cloud-native technology stack. The use of Google Cloud Platform, ephemeral virtual machines, Go, Node.js, and a strong CI/CD automation platform (EAS Workflows) indicates an architecture designed for flexibility and portability. The application layer, built with React Native, React, TypeScript, and JavaScript, further enhances portability across different environments. Proactive compliance management via Drata also streamlines potential migration efforts by ensuring regulatory adherence. However, a key challenge for migration would be the inherent vendor lock-in associated with its core infrastructure being hosted on Google Cloud Platform; migrating to an entirely different cloud provider would require substantial effort and re-architecture. The lack of specified data residency requirements is a neutral point but could become a challenge if strict requirements emerge in the future. Additionally, the unknown financial stability and growth history could impact the company's ability to fund a large-scale migration project.

Compliance

3 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

While Expo has strong security practices and SOC 2 compliance, no evidence of ISO 27001 certification was found. As a cloud services provider handling sensitive developer code and customer data, ISO 27001 would be beneficial but is not mandatory. Risk is medium as lack of this certification could impact enterprise customer requirements and competitive positioning.

GDPR (source) — Compliant

Expo explicitly states GDPR compliance across multiple official documents and has implemented appropriate technical and organizational measures. As a US-based company serving global customers including EU residents, GDPR applies. The company has documented data processing practices, retention policies, and deletion procedures. Risk is low due to explicit compliance statements and proper data handling procedures.

Evidence: https://expo.dev/privacy-explained, https://expo.dev/security, https://expo.dev/trust

SOC 2 (source) — Compliant

Expo has achieved SOC 2 Type 2 compliance with attestation for Security trust services criterion. As a cloud services provider handling customer data, SOC 2 compliance is critical and they have demonstrated compliance through third-party audit. Risk is low due to active compliance and regular attestation.

Evidence: https://expo.dev/security, https://expo.dev/trust, https://app.drata.com/trust/9cc346b0-0c38-11ee-865f-029d78a187d9

Financials

Three-year financials

Financial Resilience Score: 6/10

Expo (650 Industries, Inc.) occupies a dominant position in the React Native developer tooling ecosystem, claiming approximately 80% market share among React Native developers. Its open-source-led, cloud-monetized business model — where the free Expo SDK drives adoption and EAS cloud services generate revenue — mirrors structurally proven peers such as Vercel, Supabase, and HashiCorp. The tiered SaaS pricing with usage-based overages creates natural net revenue retention as customer apps scale, and enterprise contracts with custom pricing represent a high-ARPU, high-stickiness revenue segment. SOC 2 Type 2 and GDPR compliance further reduce friction in enterprise sales cycles. However, the complete absence of public financial disclosures makes it impossible to assess burn rate, profitability, cash runway, or the ratio of paid to free users. The company has been operating for approximately 10 years (founded 2015) without a public liquidity event, and total funding raised is estimated at only ~$7–15M USD — a relatively modest capital base for a platform serving millions of developers globally. This raises questions about whether the business is self-sustaining or still dependent on external capital. The free-tier-heavy user base (a large proportion of 100,000+ weekly active developers paying $0) creates infrastructure and support cost burdens without direct revenue offset. The modest paid tier pricing ($19–$199/month) means average contract values are low, placing significant revenue dependence on enterprise deals and usage-based expansion. The lean team of approximately 40–50 employees relative to the scale of the platform also introduces execution and support risk. Strategic concentration risk is meaningful: the entire business is predicated on the continued health and prioritization of React Native by Meta, which has historically deprecated projects. Competition from adjacent platforms (Vercel, AWS Amplify, Firebase) and the lack of a disclosed path to IPO or exit after a decade of operation are additional concerns that temper an otherwise strong qualitative position.

Key strengths: ~80% claimed market share among React Native developers, 40,000+ GitHub stars and 2M+ weekly npm downloads indicating strong ecosystem lock-in, 100,000+ weekly active developers and 500,000+ projects created, Usage-based pricing model with natural expansion revenue as apps scale, Enterprise contracts with custom pricing, SLAs, SSO, and Slack support providing high-ARPU sticky revenue, SOC 2 Type 2 and GDPR compliance reducing enterprise sales friction, Official recommendation by Meta/React Native Foundation providing strong third-party endorsement, Open-source SDK core driving adoption with cloud services monetization layer, Diversified product portfolio: EAS Build, EAS Update, EAS Workflows, EAS Submit, EAS Hosting

Risk factors: All financial metrics (revenue, profitability, equity, funding totals) are entirely undisclosed, Total funding estimated at only ~$7–15M USD — modest capital base relative to platform scale, No public liquidity event after ~10 years of operation, potential investor pressure, Heavy reliance on Meta's continued prioritization of React Native ecosystem, Large free-tier user base creates infrastructure cost burden without direct revenue offset, Low average contract values ($19–$199/month) on paid tiers; enterprise deals needed for meaningful revenue, Lean team of ~40–50 employees relative to global platform ambitions, Competition from Vercel, AWS Amplify, Google Firebase, and other CI/CD and hosting platforms, Unknown paid conversion rate from large free-tier installed base, No disclosed burn rate or cash runway assessable from public sources

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report