Thanks for your comment. I understand where you're coming from, but that's an assumption. There's no actual assurance that someone's core business means that th

Thanks for your comment. I understand where you're coming from, but that's an assumption. There's no actual assurance that someone's core business means that they may be more secure. As for the issue regarding sniffers, in the UK if the VPN termination is in the UK and they're providing a service, then under the Regulation of Investigatory Powers bill they may be considered an ISP, and would therefore be required to keep traffic logs. In other countries YMMV. Likewise, if the endpoint is being used for malicious activity targeted against the critical national infrastructure of country foo, the provider is not necessarily going to have the option to become aware of the interception of their exit traffic. With your own server it may or may not be more secure, and may or may not be intercepted at the endpoint, but providing you can reasonably configure it the only person that would attract state-level interception (over and above other local connections) would be you.