You have to place a lot of trust in a VPN provider (there is no way to verify a no-logging policy), and in the VPN provider's ISP.