"Secure enough" depends on your threat model. Many VPNs were poorly configured in the past and were leaking information. Only a few (like IVPN) were doing a proper job and had that verified by a third-party audit.

The next big question is jurisdiction. I would never trust a VPN that is based in the US, UK or a similar country where government access is virtually a given.