Installation & Updates & Requirements

The eXpress App

Click the button to download the eXpress app for PC, phone, tablet, or open the web version:

You can use eXpress on an unlimited number of devices. System requirements and installation instructions for each platform are listed below.

eXpress Corporate Desktop App

Special Client App for ETS

1. Obtain your
   ETS
   app credentials from your organization
2. Check the workstation requirements
3. Review your organization's user guide

How Does a ETS App Differ From eXpress?

• Works only with the corporate server — you cannot use a public account
• Some features may differ from the regular eXpress app
• Additional restrictions may apply (e.g., screenshots may be prohibited on mobile platforms)
• A
  ETS
  app is distributed and updated by the customer organization
• Digital certificates installation may be required on the client devices

Can I Log Into eXpress With ETS App Credentials?

Tracking eXpress Updates

New versions are released every two weeks. You can track updates on the following resources:

• The “Updates” section on this website
• The #Express - Tech Notifications channel in the app (in Russian for corporate users only)
  
  If you are the first participant from a corporate server, previous channel messages will be unavailable. For details, see the “History and End-to-End Encryption” section.
• The VKontakte community (in Russian)
• The Telegram channel (in Russian)

Using Updates

For Administrators: Client Update Administration

RTS

Lite

CTS

ETS

How Do ETS App Updates Work?

ETS

For branded

ETS

apps, the customer organization:

• Publishes updates in app stores via the vendor or independently by instructions (contact eXpress support for them)
• Installs the app on user workstations (see recommendations for installing client apps on various platforms below).

How Do Automatic Updates Work for the Desktop App?

Package Format	Update Installation Process
EXE (Windows) DMG (macOS) Appimage (Linux)	Support checking, automatic downloading, and installing updates.
DEB, RPM (Linux)	Support checking for updates, but require manual downloading and installing updates.
MSI (Windows)	No checking or downloading updates, only manual installation of new packages.

The Auto update app setting must be enabled, and there must be access to updates.express.ms from client side (

ETS

app uses its own updates server, if configured).

1. At startup, a timer (6–12 hours) is generated to check for updates. This prevents simultaneous requests from all users.
2. A /settings/server/meta request is sent to
   CTS
   or
   RTS
   :
   • If the request is successful — checking again in 1–10 minutes.
   • If there’s an error — the check is canceled after 20 seconds.
3. When a new version is detected:

   Version	Installation Method
   X.x.x (Major) x.X.x (Minor)	A notification is displayed prompting to install.
   x.x.X (Patch)	Automatic installation upon restart without confirmation.

Configuring Automatic Updates for Desktop ETS App

ETS

Only for desktop app formats that support automatic updates:

1. Create a read-only bucket in a public S3 storage (recommended volume — 10 GB).
2. Place version files from the eXpress vendor with anonymous access.
3. Provide the bucket link to eXpress for integration into the
   ETS
   app build.

You can obtain detailed recommendations from the vendor.

Web App Update

Updates for the eXpress web app are performed automatically by the provider itself. If your organization has deployed its own instance of the web app (eXpress or an

ETS

app), the update is performed alongside the server software.

Tools to Motivate Users to Install Updates

To encourage users to install updates, use the built-in tools:

Tool	Description
RTS ETS UI Alerts	Compares the client version with the version specified in the UI Alert. Configured on ETS (or on RTS ин the provider for eXpress app). Blocks the use of the app. Allows requiring the user to update the app, update the app with cache clearing, or re-login into the session.
CTS Update Notification	Compares the client version with the server software version by a specified number of lagging minor versions. Configured on CTS . Can be non-blocking. Allows requiring the user to update the app.

For Administrators: Server Software Updates

Lite

CTS

ETS

eCTS

⚠️ For stable app performance, organization administrators or partners are strongly advised to update server software regularly.

• Server software updates are released simultaneously with or after client updates.
• Updates installation is performed manually or using scripts by the organization’s system administrator, partner, or technical support, or eXpress implementation specialists.
• Server software lagging behind the client app by more than 3 versions may cause errors, and vice versa.
• An administrator can enable server software release notifications.

For detailed update installation instructions, see the administrator guide. If you have technical support — technical support contacts.

❓ Related Topics:
• Keep Your App Updated
• UI Alerts (RTS and ETS)
• Update Notification
• Desktop App Does Not Search for Updates Despite a New Version Being Released
• App updates on: Android | iOS/iPadOS | Aurora | Windows | macOS | Linux | Web | Server

Network Configuration

For Administrators: About Network Accesses for Clients & Servers, Traffic Inspection

• If traffic inspection or filtering systems (NGFW, DPI, proxy) are used in the infrastructure, WebSocket connections must be allowed.
• Additionally, VPN tunnel configuration, WAF rules, or proxy server settings may be required.
• Depending on the application's architecture and the specifics of the organization's network infrastructure, the list of necessary access permissions may expand—it is recommended to consult the project documentation and test the connection in an isolated environment before deployment.

Common Issues with Traffic Inspection

What is configured	How it manifests	What to do
NGFW or DPI drops long-lived connections	The app periodically shows Connecting, messages arrive with delay, the session drops	Allow WebSocket, increase the idle TCP session timeout for eXpress traffic
TLS inspection with certificate substitution (MITM), including on DLP systems	Connection errors and certificate errors, on Android — SSL error	Add eXpress addresses to inspection exclusions or install the corporate root certificate on devices — learn more. The Android app uses only built-in and system certificates
WAF in front of the corporate server	Some app requests are rejected with server errors	Configure WAF rules for the app API, allow WebSocket upgrade
Proxy server with authentication	The app doesn't connect	The app does not support proxies with username and password — learn more
Media traffic is routed through inspection	Calls fail to establish or drop	Media traffic cannot be inspected — it is end-to-end encrypted. Exclude connections to the Media server from inspection

For more details about the required network access on the client and server side, see the networking guides (in Russian).

For Administrators: Network Requirements

Client-Server Channel Requirements

Activity	Consumed Traffic
Messages	2 kbit/s per user
Files	100 kbit/s per user

Call and Conference Requirements

Bandwidth calculation for calls and conferences:

Traffic	Formula
Incoming traffic	1.5 Mbps × number of participants
Outgoing traffic	Depends on the call type: Video mosaic: 140 kbps × number of tiles (max. 20) Audio: 16 kbps Screen sharing: from 30-50 kbps (static content) to 2 Mbps (dynamic content)

Minimum Requirements for SIP Voice Calls: 16 kbps per participant.

Recommended Network Ping

Activity	Recommended Ping
Calls and conferences	No more than 100 ms
Messages and files	No more than 150 ms

When these values are significantly exceeded, the app may be unable to connect to the server — for example, when using satellite internet.

Client Device Bandwidth Requirements

Platform	Average Traffic
PC	Outgoing: 1.5 mbit/s Incoming: 2 mbit/s
Mobile Devices	Outgoing: 1.5 mbit/s Incoming: 1.6 mbit/s

Does the App Work When the Mobile Network in Russia Is in Whitelist Mode?

• For
  RTS
  and
  Lite
  — yes, as these servers are included in the whitelists.
• For
  CTS
  ,
  ETS
  /
  eCTS
  — check with your organization's support.

Where App Traffic Goes

The app uses not one connection but several independent ones. Based on what exactly stopped working, you can immediately determine which access is blocked.

Proxy Server

You can use the app through aт open proxy set up in your device's network settings (works on mobile and PC).

Can I Use Proxies That Require Login?

Proxy servers with authentication are not supported by the app itself. If such a proxy is used on your network, contact your network administrator — it may be necessary to use it as a system proxy, or configure an exception for eXpress traffic, or use an open proxy.

Open Proxy Server Configuration for Desktop App

1. Close the desktop app.
2. Launch the app via terminal or command line:
   "app_path" "--proxy-server=IP:port"
3. It is recommended to create a shortcut to launch the desktop app with a proxy.
   For example, on Windows: "C:\Program Files\eXpress\eXpress.exe" "--proxy-server=192.168.1.1:8080"

VPN

When connecting to the network through VPN services, message delivery delays, call drops, and server connection errors may occur. It is recommended not to use a VPN with the app, or to add eXpress to the exception list (split tunneling) of your VPN client, or to contact your organization's support for a correct corporate VPN client configuration.

For Administrators: What Are the Limitations When Routing All eXpress Traffic Through a VPN Tunnel?

eXpress has no technical restrictions on using VPN. However, in practice, performance depends heavily on the VPN channel's bandwidth and the specifics of network protocols. Experience shows that routing all traffic, including media data, through VPN can lead to call quality issues. It is recommended to avoid routing traffic through VPN to ensure stable operation.

What Must Reach the Servers Through the Tunnel

If traffic is still routed through VPN, it is not enough to allow only HTTPS to the corporate server — otherwise messaging will work, but calls will not. Connections to the Media server, including UDP, must also pass through the tunnel. For the list of ports, see the list of network accesses and the networking guides.

Common Reasons Why Media Traffic Does Not Pass Through VPN

Reason	What to do
The tunnel works only over TCP (for example, a TLS tunnel on port 443), UDP is not transmitted	Either route media traffic outside the tunnel, or enable the Allow TCP ICE setting in the VoEx section of the admin panel — learn more. Note that TCP for media provides worse quality than UDP
The UDP port range of the media server is not fully open	Open the entire range — it is used for SRTP streams
Direct peer-to-peer (p2p) connection between clients is blocked, and TURN is not used	Enable the Use relay ICE candidates only setting in the VoEx section — all media traffic will go through the TURN server
Reduced MTU in the tunnel, UDP packet fragmentation	Check MTU and MSS clamping settings on the VPN gateway. Symptom: the call connects, but audio and video break up or work only in one direction
Double NAT (corporate NAT over provider NAT, CGNAT)	Verify correct NAT IP-to-IP mapping for the Media server and external addresses in TURN/STUN settings

Browser Restrictions in the Web App

The web app operates according to browser rules, not operating system rules. Even if all network accesses are open, the browser may block some connections. The most common restriction is local network access.

What Is Local Network Access and Why Does It Interfere?

Modern browsers consider it dangerous when a website from the internet accesses devices inside your network and require separate permission for this. The rule is triggered by the destination address: if the site is opened via a public address but accesses a private address (10.x.x.x, 172.16–31.x.x, 192.168.x.x), localhost, or a domain in the .local zone — the browser shows a permission prompt, and if denied, drops the connection.

For eXpress, this looks like this: the web app is opened via a public address (for example, https://corp.express/), while the corporate server and Media server are located in your organization's network. This leads to the following typical symptoms:

• everything works in the office or from home, but not when the corporate VPN is enabled (over VPN, server addresses become private);
• chats work, but calls and conferences don't connect or have no audio or video;
• the web app doesn't connect at all and endlessly shows “Connecting”;
• the desktop app on the same computer and in the same network works fine.

How to Grant Local Network Access Permission

You can wait for the browser prompt when opening the web app and click Allow. If the prompt was already denied, grant the permission manually and reload the page:

Other Browser Settings That Affect Operation

• Check other browser permissions — microphone, camera, notifications, clipboard, autoplay in Safari — and ad-blocking extensions: they are listed in the system requirements for the web app.
• Do not use incognito mode or private windows for regular work: some permissions and session data are not preserved in them.

For Administrators: Centralized Local Network Access Deployment (Policies)

Relying on each user to respond correctly to the browser prompt is not advisable: the denial is remembered, and no error message is shown. The permission can be distributed via group policies.

Chromium-Based Browsers

The policy is called LocalNetworkAccessAllowedForUrls, type — list of strings. It contains the source addresses, that is, the eXpress web app address, not the server addresses.

Browser	Windows: registry key	Linux: policies directory
Google Chrome	HKLM\SOFTWARE\Policies\Google\Chrome\LocalNetworkAccessAllowedForUrls	/etc/opt/chrome/policies/managed/
Chromium	HKLM\SOFTWARE\Policies\Chromium\LocalNetworkAccessAllowedForUrls	DEB or RPM package (Astra Linux, RED OS, and others): /etc/chromium/policies/managed/ ⚠️ Snap package (how Chromium is installed by default in Ubuntu): /var/snap/chromium/current/policies/managed/. Files in /etc are ignored in this case
Microsoft Edge	HKLM\SOFTWARE\Policies\Microsoft\Edge\LocalNetworkAccessAllowedForUrls	/etc/opt/edge/policies/managed/
Yandex Browser	HKLM\SOFTWARE\Policies\YandexBrowser\LocalNetworkAccessAllowedForUrls	/etc/opt/yandex/browser/policies/managed/
Vivaldi	HKLM\SOFTWARE\Policies\Vivaldi\LocalNetworkAccessAllowedForUrls	/etc/vivaldi/policies/managed/
Opera	Not supported: policies are not applied on Windows. The permission is granted manually by the user	/etc/opt/opera/policies/managed/

Each address in the Windows registry is a separate string value (REG_SZ) with a numeric name. Example:

reg add "HKLM\SOFTWARE\Policies\Google\Chrome\LocalNetworkAccessAllowedForUrls" /v 1 /t REG_SZ /d "https://corp.express" /f

Example for Linux — file /etc/opt/chrome/policies/managed/express.json:

{
  "LocalNetworkAccessAllowedForUrls": ["https://corp.express"]
}

On macOS, the same policy is distributed via a configuration profile for the preference domains com.google.Chrome, com.microsoft.Edge, and similar.

You can verify that the policy has been applied on the browser's internal page: chrome://policy, edge://policy, browser://policy, vivaldi://policy. The policy should be displayed with the status OK and indicate the source — the directory or registry key from which it was read.

Mozilla Firefox

The policy LocalNetworkAccess is used with an array of exceptions SkipDomains. The policies.json file:

{
  "policies": {
    "LocalNetworkAccess": {
      "SkipDomains": ["corp.express"],
      "Locked": true
    }
  }
}

The same via Windows group policies:

Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\1 = "corp.express"

The pattern *.corp.express includes both the domain itself and all subdomains. An entry without *. applies only to an exact match.

Apple Safari

There is no per-site local network access policy. Management is possible only at the macOS level — through the permission in the Local Network section of privacy settings, which Safari obtains automatically.

Temporarily Disabling Checks

While the infrastructure is not ready and the permission has not been distributed, checks can be disabled entirely — both centrally for all browsers in the organization and manually on a single computer for diagnostics. This should be an emergency measure, not a permanent setting.

Browser	Centrally (for administrators)	Manually on a single instance
Chrome, Edge, Yandex Browser, Vivaldi	The same registry key or policies directory as for LocalNetworkAccessAllowedForUrls above — add the LocalNetworkAccessRestrictionsTemporaryOptOut parameter (REG_DWORD on Windows, boolean on macOS and Linux) with the value 1 / true	chrome://flags/#local-network-access-check > select Disabled and restart the browser. In Edge — edge://flags/..., in Yandex Browser — browser://flags/..., in Vivaldi — vivaldi://flags/...
Opera	On Windows, it cannot be distributed centrally; on Linux — the same policies directory as above.	opera://flags/#local-network-access-check > Disabled
Mozilla Firefox	The same policies.json file as above — the LocalNetworkAccess policy with the parameter "Enabled": false disables all checks completely	about:config > parameter network.lna.enabled > false
Apple Safari	Not applicable — WebKit has not yet implemented local network access restrictions, so there is nothing to disable

The value 1 / true for LocalNetworkAccessRestrictionsTemporaryOptOut does not just hide the warning: it disables the blocking of local network requests itself — instead of blocking, the browser only outputs a warning in the developer console when a potential violation occurs.

⚠️ This policy itself is also temporary: according to current plans, Google will remove it from Chrome after version 156. It was created as an emergency valve during migration, not a permanent solution — it should not be kept enabled on all workstations permanently. The long-term way to lift the restriction for a specific site is LocalNetworkAccessAllowedForUrls.

What to Consider for the Future

• The restriction is gradually being extended to more connection types. Initially it affected regular requests to the server, then WebSocket connections, and application to WebRTC is in development. When that happens, media connections will also stop working directly without the granted permission.
• The restriction does not apply if the web app itself is opened via an address within your network. If the organization deploys its own instance of the web app in a closed network segment, the problem does not arise.
• The restriction is determined by the destination IP address, not by the domain name. The same web app address may require permission in one network and not in another — this is expected behavior.

Time Sync Configuration

For proper operation, time synchronization is required on all client devices and servers. Otherwise, users may encounter login errors, user online status may have wrong future timespamp, or messages will display incorrect timestamps.

How to Configure Time Settings on My Device?

Remote Desktop & Virtual Desktop

When using VDI (such as VMware Horizon or Citrix) or connecting via the RDP protocol, preliminary configuration is required.

Why Do I Have to Sign In to the App Again After Ending a VDI Session?

The sign-in screen may appear again because VDI provides a new empty browser profile or a new user folder the next time the user connects. The solution is to configure folder persistence between VDI sessions.

Calls and Conferences via VDI/RDP

Why do calls via VDI work worse than on a physical computer?

For Administrators: Blocking Calls in VDI for the Desktop App

If your VDI environment does not support calls, you can forcibly disable them in the application. The application does not always correctly detect a VDI environment, so this mode must be set separately:

Desktop Platform	Steps
Windows	Add Vdi="true" to AppConfig.ini in the application folder, under the [AppConfig] section, and restart the application. There is also a special MSI installation key.
macOS	Add Vdi="true" to AppConfig.json in the folder /Users/username/Library/Application Support/app_name: { "Vdi": true } Restart the application.
Linux	Add Vdi="true" to AppConfig.json in the folder /home/username/.config/app_name: { "Vdi": true } Restart the application.

Requires version 3.64 or higher. After enabling, when attempting to call, the user will see a notification “Calls are not available on this device” or “Conferences are not available on this device”.

Configure Sound in the VMware Horizon Client

In the Horizon client settings, you need to select specific audio and video input/output devices. If you don't do this, some devices might not work in the desktop application.

How to select devices:

1. In the VMware Horizon client, select Settings.
2. In the Real-Time Audio-Video section, instead of All in the fields, select the devices that will be used for communication.

Select devices in the settings of the desktop application installed on the virtual machine:

1. Microphone: Microphone array (VMware Virtual Microphone).
   You might need to switch to another device and then select this one again for it to work (the indicator "comes alive").
2. Output device: Specify the default device used in the system.
3. Camera: There might be several options, but only one will work.

Configure Sound in the RDP Client

For sound to work in conferences when connecting via RDP, allow access to your computer's audio devices in the connection settings:

Certificate Management

❓Related Topics:
• Certificate installation: Android | iOS/iPadOS | Windows | macOS | Linux | Web | Server
• Unhandled_service_error | “An Error Occurred” After Entering SMS Code
• “Network Error, Check Server Connection”, “Server with Specified Hostname Not Found”, “Pairing Error” When Scanning QR Code
• “SSL Error”, “Server Connection Error”, “Connection Error” on Android When Entering Phone Number, Email Code, or Corporate Server Address
• The app stopped connecting after a certificate change
• The server certificate has been revoked or has expired

Ministry of Digital Development National Certification Authority Certificates

If your organization's server has switched to a TLS certificate from the Ministry of Digital Development National Certification Authority (Russian Trusted Root CA and Russian Trusted Sub CA), some devices will require manual installation of this authority's certificates — otherwise the app will not be able to connect to the server.

Whether any action is needed depends on the operating system:

Where to Get Ministry of Digital Development Certificates

The root and intermediate certificates are published on the Gosuslugi portal: gosuslugi.ru/crt. Both are needed.

If the organization's server uses a regular (non-GOST) certificate, take the non-GOST option. GOST certificates require a separate cryptographic provider on each device and are not suitable here.

eXpress & Branded ETS Apps

Supported: Russian, English, French, German, Spanish, Arabic, Turkish, Indonesian, Uzbek, Malaysian.

Administrator Panel

Interface language is initially determined by browser settings. Supported: Russian, English.

Outlook Add-In

The language used depends on the Outlook interface language. Supported: Russian, English. Contact eXpress support if you need additional languages.

Uses built-in spell checking from Outlook.

System Requirements for Android

Installation on Android

Where to get the eXpress app:

• Google Play (except USA and Canada)
• Huawei AppGallery
• RuStore
• APK Installation File

Certificate Installation on Android

⚠️ Starting with version 3.24, the Android app only uses certificates built-in by the developer (Russian Ministry of Digital Development, Let's Encrypt, GlobalSign, Harica). Manually installing these is not required.

You will only need to install the certificate in the OS when SSL Pinning is enabled:

1. Request the certificate files from your organization's support.
2. Open the device settings.
3. In the settings search, type certificate.
4. Select Trusted CA Certificates or Trusted Certificates > User or Install Certificates.
5. Install the pre-downloaded root and intermediate certificates.

Updating on Android

Automatically via the app store or manually (tap Update in the store or install a new APK).

Does the APK Update Automatically Outside of an App Store?

Uninstallation on Android

Settings > Apps > select the app > Uninstall.

❓Related Topics:
• Issues After Migrating to Another Device
• ROOTED DEVICE Error
• Notifications on Android
• App Logs
• Connection Issues on Android 9+

System Requirements for iOS/iPadOS

Installation on iOS/iPadOS

The app is available in App Store (except for China, the USA, and Canada).

Does the App Work on Apple Silicon Macs?

No, the iOS app is not supported on Mac with Apple Silicon. Use the desktop app for macOS.

Certificates on iOS/iPadOS

To work with corporate certificates:

1. Download the root and cross-certificates.
2. Confirm the download when prompted “The website is trying to download a configuration profile. Allow?”.
3. Select the device for installation (if there are several).
4. Go to Settings > Profile Downloaded > Install.
5. Enable trust: Settings > General > About > Certificate Trust Settings > turn on the toggle for the installed certificate.
6. Fully quit the app and start it again.

If your organization's server has switched to Ministry of Digital Development National Certification Authority certificates, see the instructions.

Updating on iOS/iPadOS

Updates are installed automatically (if enabled in App Store settings) or manually via the Update button in the App Store.

Uninstallation on iOS/iPadOS

Settings > General > Storage > select the app > Delete App.

Complete Uninstallation on iOS/iPadOS

Required for critical errors. Before uninstalling, disable app backups in iCloud. Otherwise, corrupted data may be restored automatically after reinstalling the app: Settings > [Your Name] > iCloud > Manage Storage > Backups > Documents & Data > disable the app backup.

❓Related Topics:
• iOS Notifications Setup
• iOS Logs

System Requirements for Aurora

Installation on Aurora

Available installation methods:

Certificates on Aurora

Supported certificates:

• Russian Ministry of Digital Development (only in special
  ETS
  builds)
• Let's Encrypt
• GlobalSign

⚠️ Third-party certificates are not supported. Contact support for assistance.

Updating on Aurora

Manual updates are required for RPM installations. Automatic updates are available for RuStore installations.

Uninstallation on Aurora

To uninstall:

1. Open the list of all apps (swipe up from the bottom edge of the screen).
2. Long-press the app icon.
3. Click the cross that appears.

❓Related Questions:
• Notifications and App Badges on Aurora
• General Logs from Engineering Menu (Aurora)

System Requirements for Windows

App Formats for Windows

Auto-Launching the App on Windows Startup

In the app settings: Settings (avatar button) > Additional features > Auto launch app.

This setting can be managed during app installation or update.

Installation on Windows

Standard Installation

Certificate Installation on Windows

Installing corporate server certificates so that the connection works (not required by default):

1. Open the certificate file and click Install Certificate.
2. Select the store location:
   • Current User — the certificate will work for you. Administrator rights are not required.
   • Local Machine — the certificate will work for all users of this computer. Administrator rights are required.
3. Select Place all certificates in the following store > Browse.
4. Enable Show physical stores.
5. Select the store:
   • rootCA > Trusted Root Certification Authorities
   • interCA > Intermediate Certification Authorities
6. Confirm and complete the installation. The system will show a warning about installing a root certificate — you need to accept it.
7. Fully quit the app (it keeps running in the notification area) and start it again.

If your organization's server has switched to Ministry of Digital Development National Certification Authority certificates, see the instructions.

Credential Storage on Windows

Authentication data is stored in Windows Credential Manager under *desktop/auth.* entries.

Updating on Windows

For apps installed via EXE, automatic updates are available if enabled in settings (details): Settings (avatar button) > Check for updates.

For MSI-installed apps, manual installation of the new version is required.

Uninstallation on Windows

For Administrators: Complete App Removal on Windows

Required to resolve critical errors or for deleting credentials keys saved on PC.

For an

ETS

app, replace eXpress with it's name. To get the batch file to automate these steps on client machines, contact eXpress support.

1. Close the app and uninstall it (see parameters and keys above).
2. Delete folders:
   • Executable folder: %LOCALAPPDATA%\Programs\eXpress (EXE install) or %PROGRAMFILES%\eXpress (MSI install or EXE install to Program Files)
   • Cache folder: %APPDATA%\eXpress
     When uninstalling via the EXE uninstaller, the %APPDATA%\eXpress folder is removed automatically. Manual removal is required after installation via MSI.
   • Downloaded updates: %LOCALAPPDATA%\express-updater
   To navigate quickly: copy the path > Win+R > paste the path > Enter. If the folder doesn’t exist, an error will appear.
3. Start menu > search for credential manager > Credential Manager > Windows Credentials > delete all *desktop/auth.* entries.
   
   Alternatively, use a PowerShell script (admin rights required):

   1. Start menu > search for cmd > right-click Command Prompt > Run as administrator.
   2. In Command Prompt, run: powershell Set-ExecutionPolicy RemoteSigned This allows PowerShell script execution.
   3. Download PowerShell script > right-click it in Explorer > Run with PowerShell.
   4. Return to Command Prompt and run: powershell Set-ExecutionPolicy Restricted This restores the default PowerShell execution policy.
4. Delete eXpress.lnk shortcuts (optional) in:
   • %APPDATA%\Microsoft\Windows\Start Menu\Programs (%ProgramData%\Microsoft\Windows\Start Menu\Programs)
   • %HOMEPATH%\Desktop (%PUBLIC%\Desktop)
   • %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

System Requirements for macOS

App Formats for macOS

Is the App Available on the App Store?

Installation on macOS

• Double-click the downloaded .DMG file.
• In the window that appears, drag the app icon to the Applications folder.
• Launch the application. On the first launch, macOS will inform you that the application was downloaded from the internet and checked for malware — click Open.
• Allow the application to access devices on the local network — click Allow.
  ⚠️ Without this permission, connection issues may occur. If you accidentally clicked Deny, enable access manually: System Settings > Privacy & Security > Local Network > enable the toggle for the application, then restart it.

Installing Certificates on macOS

Installing corporate server certificates so that the connection works (not required by default):

1. Open the macOS Keychain Access app (use Spotlight search to find it).
2. Select System.
3. Drag the certificate file into the Keychain Access app.
4. Enter the computer administrator's username and password.
5. Double-click the added certificate, expand the Trust section, and for the When using this certificate option, select Always Trust. Close the window and confirm the change with your password.
6. Fully quit the app (it keeps running in the menu bar) and start it again.

If your organization's server has switched to Ministry of Digital Development National Certification Authority certificates, see the instructions.

Credential Storage on macOS

Authentication data is stored in the keychain. To view keys, open the macOS Keychain Access app (use Spotlight search to find it).

Updating on macOS

Automatic updates are available if enabled in the settings (details): Settings (avatar button) > Check for updates.

Uninstallation on macOS

Standard Uninstallation

1. Close the desktop app: select Quit in the Dock.
2. Open Finder > Applications > find the app and drag it to the Trash > empty the Trash.

For Administrators: Complete App Removal on macOS

Required to resolve critical errors or for deleting credentials keys saved on Mac.

⚠️ For an

ETS

app, replace eXpress with it's name. To get the batch file to automate these steps on client machines, contact eXpress support.

1. Uninstall the app using the standard method.
2. Open the macOS Keychain Access app (use Spotlight search to find it).
3. Delete keys starting with eXpress.
4. Delete the folder:
   /Users/CurrentUser/Library/Application Support/eXpress
   or:
   ~/Library/Application Support/eXpress
   You can quickly navigate to the folder via Finder: Go > Go to Folder... If needed, show hidden folders by pressing Shift + Cmd + ..
5. Delete the settings files:
   ~/Library/Preferences/ru.unlimitedtech.express.desktop.plist ~/Library/Preferences/ru.unlimitedtech.express.desktop.helper.plist ~/Library/Preferences/ru.unlimitedtech.express.desktop.helper.GPU.plist
   For an
   ETS
   application, the file names will be: *.manufacturer_name.app_name.desktop*.plist
6. Delete the network request cache and http-cookies folder:
   ~/Library/HTTPStorages/ru.unlimitedtech.express.desktop For an
   ETS
   application, the folder name will be: ~/Library/HTTPStorages/*.manufacturer_name.app_name.desktop
7. Delete the logs folder: ~/Library/Logs/eXpress

System Requirements for Linux

DEB Package Signing for Astra Linux With Closed Software Environment Enabled

If Astra Linux has the closed software environment (CSE, integrity control) mode enabled, the system blocks installation of packages that are not signed with a trusted digital signature. The standard eXpress DEB package does not have such a signature, so installation will fail.

For branded ETS apps, package signing for CSE operation is performed upon request — contact eXpress support. The obtained developer key must be added to trusted keys according to Astra Linux documentation.

App Formats for Linux

Installation on Linux

Standard Installation

Are There Repositories for Automatic Installation on Linux?

Public eXpress repositories for Linux are not available. Many organizations set up their own local repository: the latest package is automatically downloaded via permanent links (see Linux Application Formats), placed into the organization's repository, and then workstations are updated using standard package manager tools. The version and hash sums of the current package can be obtained automatically from the YML files listed in the same section.

Installation on ALT Linux

On ALT Linux, installing the RPM package with the apt-get install command may fail with unsatisfied dependency errors like (libXtst or libXtst6), because the ALT package manager does not support boolean dependencies in RPM. The libraries themselves are usually already installed.

Certificate Installation on Linux

Installing corporate server certificates so that the connection works (not required by default).

If your organization's server has switched to Ministry of Digital Development National Certification Authority certificates, see the instructions.

Credential Storage on Linux

Authentication data is stored in the system keyring, which provides the Secret Service. Which keyring is used depends on the desktop environment:

• gnome-keyring — in GNOME and most other environments. To view keys, open Passwords and Keys (Seahorse) in Ubuntu, Astra Linux, and others;
• KWallet — in the KDE environment (in Plasma 6, the service is provided by the ksecretd component). To view keys, open KDE Wallet.

Creating a Keyring

Removing App Keys from the Keyring

If you remove the app's authentication keys from the keyring, the authentication screen will open after the app restarts. With a standard app uninstall, the keys are preserved.

Updating on Linux

Automatic updates are available if enabled in settings (learn more): Settings (avatar button) > Check for Updates.

Standard Update

Manual updates are performed as a standard installation (see above).

Uninstalling on Linux

For Administrators: Uninstalling the App With Full Cleanup of Traces

1. Uninstall the app using the standard method (see the table above).
2. Open the keyring manager (Passwords and Keys in Ubuntu, KDE Wallet in KDE, Seahorse in Astra Linux, and others) and delete the keys that start with eXpress.
3. Delete the app profile folder in the file manager:
   /home/username/.config/eXpress
   or via the terminal:
   rm -rf ~/.config/eXpress
4. Delete the remaining local user data:
   rm -rf ~/.cache/eXpress ~/.local/share/eXpress ~/.local/state/eXpress
5. If the app was added to autostart, delete its shortcut:
   rm -f ~/.config/autostart/eXpress.desktop
6. Check for installation leftovers — the package manager usually removes them, but after uninstalling an RPM package, the /opt/eXpress directory remains empty:
   sudo rm -rf /opt/eXpress /usr/bin/express /usr/share/applications/express.desktop
7. For AppImage, additionally delete the eXpress.AppImage file, and if AppImageLauncher was used — the integration file in ~/.local/share/applications and the pinned shortcut.

The web app can be opened in any modern browser on a computer via this link: https://corp.express/.

System Requirements for the Web App

Browsers

⚠️ The web app does not work in mobile browsers.

Required Permissions

Browser Extensions

It is recommended to disable ad blocker/VPN/proxy extensions or add the web app site to their exceptions.

How Does Working in a Browser Differ from the Desktop App?

Installing Certificates for the Web App

Installing non-standard corporate server certificates is required for the server connection to work (not required by default). See the instructions for operating systems:

• Installing Certificates on Windows
• Installing Certificates on macOS
• Installing Certificates on Linux

Updating the Web App

Progressive Web App

The web app can be installed as a progressive web app (PWA): open the web app and click the install button in the address bar.

Web App Widget

A widget that can be embedded on the organization's internal corporate portal. The description and code are available in the repository (in Russian).

What Does the Web App Widget Look Like?

When adding the script to a page, a button will appear in the lower right corner, opening a special eXpress window through which an employee can log in to eXpress and contact a colleague.

Guest Access Using Web App

The web app is used for guests to join chats (PC only), as well as calls and conferences (on both PC and mobile devices).

There is a special add-in for creating conferences in eXpress using MS Outlook calendar.

Outlook Add-In Formats

There is a Windows version that supports NTLMv2 and Keycloak authentication methods, and an Outlook Web Access version (including macOS) which only supports Keycloak authentication.

System Requirements

Custom Branded Add-In Version

After Migrating the Android App to Another Device, It Doesn’t Work Correctly

It’s not recommended to migrate the app between devices using third-party data migration tools. If the app doesn’t work correctly after migration, reinstall it from the app store.

When Launching the Android App, the ROOTED DEVICE Error Appears

The app doesn’t support running on devices with ROOT permissions due to information security requirements. When attempting to launch on such a device, the Rooted Device error will appear with the reason:

In some cases, updating your device's operating system to a newer version may also help.

Connection to the Server Doesn’t Work on Android 9 and Newer

Update the app to the latest version.

Two Copies of the App on a Windows Computer

Two copies may appear if the app is installed in Program Files and in the profile folder. To avoid this:

• For MSI packages of versions below 3.13, use the keys ISAUTOUPDATE="false" UPDATE="false" or place AppConfig.ini in %PROGRAMFILES%\App_Name.
• Before installing the MSI, remove the app from the profile using the command: "%LOCALAPPDATA%\Programs\App_Name\Uninstall App_Name.exe" /S.

If two copies already exist:

1. Uninstall one or both copies.
2. Reinstall the app via EXE or MSI.

The Windows App Freezes on the Logo Screen or Doesn’t Launch

.NET Framework 4.8 is required. After installation, restart your computer.

Check the integrity of system files:

1. Launch Command Prompt as administrator: “Start” > type cmd > right-click Command Prompt > Run as administrator.
2. Run: DISM.exe /Online /Cleanup-image /Restorehealth (may take up to an hour).
3. Then: sfc /scannow.

MSI Installation Problem: Windows Installer Error | 1613 Error in SCCM

Installation Repair

• Use the Microsoft diagnostic package.
• Manually: Control Panel > Programs and Features (or Settings > Apps > Installed apps) > select the app > Repair
• Via command line: msiexec /f "path_to.msi" (more information on the Microsoft website)

If the error persists, check the installation log.

Error When Removing the Previous Version of the App

If the MSI cache is corrupted (error The feature you are trying to use is on a network resource that is unavailable):

1. Download the problematic version of the MSI package from the eXpress | eXpress Corporate previous versions archive.
2. Create a BAT file to copy the MSI to the InstallSource folder and remove it (example below).
3. Disable the antivirus (if it corrupted the cache previously) and run the BAT file.

---

How to find the product code.

There is another method — delete the previous MSI installation entry from the Windows registry (proceed at your own risk!). Here's an example PowerShell script for eXpress:

“Cannot Open the Program” Error on macOS

Check:

• Compatibility of the app version with the processor (Intel/Apple Silicon).
• Permission to launch: System Preferences > Privacy & Security > Allow.

Or run in Terminal:

The Desktop App Doesn’t Search for Updates

Check:

• Whether automatic updates are enabled: Settings > General Settings > Automatically Update the App.
• Whether the update server is accessible.
• A delay in updates is possible (details).
• If you haven't updated the eXpress desktop app for several years, it may still be using the old update server address. In that case, manually install the new version — subsequent updates will be checked automatically on the new server.

If the issue persists, collect logs and contact support.

After Updating the App on macOS, the Old Version Launches

After launching the update, close the app via Dock or Cmd+Opt+Esc, then open it again.

The Linux App Freezes on the Logo Screen

Install the required libraries. See system requirements.

Android App Doesn't Start on GrapheneOS

In the system app settings, enable compatibility mode for exploit protection.

Desktop App Does Not Start on Linux With a Sandbox Error

If starting from the terminal shows an error like “The SUID sandbox helper binary was found, but is not configured correctly” or mentions chrome-sandbox, it means that unprivileged user namespaces are disabled on the system, and the sandbox helper file does not have the required permissions.

1. Check the file permissions:
   ls -l /opt/eXpress/chrome-sandbox
   Expected: owner root:root and permissions -rwxr-xr-x (0755) when user namespaces are enabled, or -rwsr-xr-x (4755) when they are disabled.
2. Check whether user namespaces are enabled (Debian-based OSes, including Astra Linux):
   sysctl kernel.unprivileged_userns_clone
   Value 1 means enabled — the error should not occur. Value 0 means disabled — proceed to step 3.
   
   On Ubuntu 24.04 and later, additionally check: sysctl kernel.apparmor_restrict_unprivileged_userns
   If the first parameter is 1 and the second is also 1 — namespaces are formally enabled but restricted by AppArmor, and the error may still occur — proceed to step 3.
3. If user namespaces are disabled, set SUID permissions on the file:
   sudo chown root:root /opt/eXpress/chrome-sandbox sudo chmod 4755 /opt/eXpress/chrome-sandbox

If you cannot set SUID permissions (on some distributions, such as ALT Linux, SUID hardening policies may prevent it) — run the app with the --no-sandbox flag, for example:
./eXpress.AppImage --no-sandbox

“Cannot Satisfy Dependencies” Error When Installing DEB Package on Linux

The error may occur in the package installer (e.g., QApt Package Installer).

Solution: Install the package as superuser:

File Drag-and-Drop Doesn’t Work and Session Terminates After Installation/Update on Windows

The issue occurs if the app is running as SYSTEM or another user different from the current one. As a result:

• The app cannot find credentials and cache because it looks for them in another user’s profile, leading to session termination.
• Windows Explorer cannot interact with the app running with elevated privileges, causing file drag-and-drop to fail.

Solution:

1. Close the app via the system tray.
2. Launch it again using the shortcut—this will restore proper permissions.

“Application Does Not Work on Jailbroken Devices” After App Store Installation

Installing the App From App Store on Apple Silicon Mac?

The eXpress mobile app doesn't support Apple processor Macs and therefore isn't available in the Mac App Store. If you found your ETS-branded app in the Mac App Store on an Apple processor Mac, contact your organization's support to remove it from there, then download and install the desktop app using the DMG file for Apple Silicon Macs.

Installing the App From App Store on Jailbroken iPhone/iPad?

The app doesn't work on jailbroken Apple mobile devices. Verify your device isn't compromised.

"App Unavailable" When Installing eXpress From App Store

eXpress is unavailable in China's App Store region, and while visible in US/Canada stores, the app cannot be installed there.

Verify your App Store profile's country settings:

1. Open the App Store app and tap your profile icon in the top-right corner.
2. Tap your name at the top.
3. Ensure Country/Region isn't set to China, US, or Canada.
4. If the error persists after changing regions, reboot your device to refresh App Store.

Desktop App Fonts Are Hard to Read or Blurry

“Connecting” Is Constantly Displayed, the App Is Not Updating Chats and Contacts, Server Disconnected

What to Attach to a Support Request for a Network Issue

To avoid multiple rounds of clarifying questions, provide the following right away:

• Where the issue reproduces: desktop app, web app, mobile app — and where it doesn't.
• Where the user connects from: office network, home internet, corporate VPN, VDI, or remote desktop.
• Browser name and version, if the issue is in the web app.
• What exactly doesn't work: connection, chats, files, calls, screen sharing.
• Scope: one user, some users, all users.
• Client app and server software versions.
• Logs, HAR files, and web app media connection statistics for call issues in the web app (learn more).

The App Stopped Connecting After a Server Certificate Change

Symptoms: immediately after the organization replaced the server certificate, the app stopped signing in — it shows a network error, endless connecting, or a certificate error message. Before the replacement, everything worked.

Certificate installation: Android | iOS/iPadOS | Windows | macOS | Linux | Web

What Can You Do?

If nothing helped, contact your organization's support.

The Server Certificate Has Been Revoked or Has Expired

A server certificate can stop working for two reasons: its validity period has ended, or the certification authority revoked it early. For the user, it looks the same — the app stops connecting to the server, and sign-in fails.

What the user should do. Nothing can be done on the device: the certificate is changed on the server. Report it to your organization's support if they are not yet aware of the problem, and wait for the reissue.

After the reissue, the app usually starts working on its own. However, if the organization issued a new certificate from a different certification authority, a new root certificate may need to be installed on the device — see “The App Stopped Connecting After a Server Certificate Change”.

Desktop App Performance Issues (High PC Load)

Desktop App Remains in Full-Screen Mode