I added the word “reported” because I don’t trust VPN providers to not keep logs, but ideally they should report that they don’t keep logs and have an established history of not providing logs. Tor is really not ideal if you’re trying to download anything large and you’re still vulnerable depending on who controls the exit nodes.