Prove it. There’s gotta be some level of logging to maintain the system and performance. Even small levels of logging can give away information. Unless you can audit their system it’s not worth it imo.
The biggest nail gets hammered down, and for the past decade or so that’s VPN providers.