I rent cloud-computing services from a large and reputable company. Each year, I charge $500 into my account, and use the money to buy droplets, which cost between $5 and $20 per month (depending on their size). All went well for several years. But a few days ago, I noticed that my account has a debt of $681, which is much more than the monthly cost of all my droplets together. I checked and found out that someone hacked into one of my droplets, and used it for some activity with outgoing traffic at a rate of about 2 GB per second. The company charges extra outgoing traffic at a rate of 1 cent per GB, which means $72 per hour. I was lucky to catch this on time - if I had been in a vacation for a week, my debt would have been more than $10,000, which is way more than I can afford.

My questions are:

  1. Can I dispute this debt? My claim is that, when I pre-paid $500, I bought services for $500, and did not agree to buy any further services. When my balanced drops to $0, the company should just stop serving me (e.g. stopping all my droplets); it should not continue selling me services that I did not pay for.

  2. In the future, how can I rent cloud services without taking the risk of getting into an unaffordable debt? For example, would it help if I use an anonymous pre-charged debit card?

EDIT: here are the TOS. The most relevant section seems to be 6.3:

By entering into this TOS and using the Services, you agree to be billed on a recurring basis and to be automatically charged by us or our Payment Processors using your Payment Methods upon invoicing. If your Payment Method or payment of fees is subject to other terms and conditions, as set forth in order forms, invoices or otherwise, then those other terms and conditions apply in addition to this TOS. You may also be billed an amount up to your current balance at any time to verify the accuracy of your account information. We reserve the right to deactivate, terminate, prevent access to, disable services for, and/or delete any Accounts or access to the Websites and Services at any time at our sole discretion, including for nonpayment, late payment, or failure to charge your Payment Methods upon invoicing".

It does not say what happens when I have no payment method on file - only a previously-charged balance. Also, it does not explicitly discuss debt; it only says that, if I do not pay, they can delete my account (which is fair enough).

  • 3
    What does the contract say?
    – littleadv
    Commented Jul 9, 2023 at 1:11
  • 3
    This seems to be a server/service configuration question, not a personal finance question.
    – keshlam
    Commented Jul 9, 2023 at 2:58
  • 2
    Set up a billing alert at 75% your prepaid amount, so you can power down your droplets if you are in danger of exceeding your budget: docs.digitalocean.com/products/billing/billing-alerts. Commented Jul 9, 2023 at 18:50
  • 2
    @AKdemy I'd argue that understanding ToS of online service providers is pretty important for personal finance, this can be a good example.
    – littleadv
    Commented Jul 9, 2023 at 19:07
  • 3
    Azure and AWS both have ways to enforce budgets. Most/all also have alerts you can set up. There are services where you can rent a vm at a flat monthly rate. There are many stories about surprise cloud service bills, so at least you're not alone. You should contact the vendor and ask if they can help with the surprise charges, rather than trying to dispute the charges. You misunderstood how the service worked and didn't know you could get billed extra, they might be sympathetic and cut your bill even though they aren't obligated to.
    – Hart CO
    Commented Jul 10, 2023 at 4:52

2 Answers 2


You'll probably want a lawyer to help you, but here are some quotes from the ToS you linked to:

5.2 You are solely responsible for the activity that occurs on your Account, regardless of whether the activities are undertaken by you, your employees, any third party (including your contractors or agents), your End Users, your licensees, or your customers


5.9 You shall utilize proper security protocols, such as setting strong passwords and access control mechanisms, safeguarding access to all logins and passwords, and verifying the trustworthiness of persons who are entrusted with account access information. You are solely responsible for any unauthorized access to your Account, and must notify DigitalOcean immediately of any such unauthorized access upon becoming aware of it.

These say that they're not liable for the "hacker" who wasted your bandwidth.

6.1 ... You agree to pay us, through the Payment Processors or as otherwise agreed to by DigitalOcean, all sums for Services you select or use at applicable prices in accordance with our pricing and billing policies ...

This says that you agree to pay them what they say you owe them.

6.2 You must provide current, complete and accurate information for your Account and Billing Information, and must promptly update all such information in the event of changes

You have to have a valid payment method on file.

6.3 We reserve the right to deactivate, terminate, prevent access to, disable services for, and/or delete any Accounts or access to the Websites and Services at any time at our sole discretion, including for nonpayment, late payment, or failure to charge your Payment Methods upon invoicing.

They'll kick you to the curb for not paying.

13.1 In the interest of resolving disputes between you and DigitalOcean in the most expedient and cost-effective manner, and except as described in Section 13.2, you and DigitalOcean agree that every dispute arising in connection with this TOS will be resolved by binding arbitration.

You cannot sue them (except small-claims court, see 13.2), you have to go through arbitration.

13.5 Any arbitration hearing will take place at a location to be agreed upon in Manhattan, New York, NY, but if the claim is for $10,000 or less, you may choose whether the arbitration will be conducted: (a) solely on the basis of documents submitted to the arbitrator; (b) through a non-appearance based telephone hearing.


14.4 Governing Law. This TOS and any dispute related thereto (including under Section 13) is governed by the laws of the State of New York without regard to conflict of law principles.

The arbitration will be in NYC, based on the US and NYS laws.

Bottom line - nothing much you can do here, and I doubt you can find service providers with significantly different terms.

If it's important enough to you - engage a lawyer to review your contracts and explain them to you before you sign.

  • 4
    More importantly, don't run a server if you don't know how to secure it. Some services may let you set traffic limits so it just goes dead if overused rather than racking up a huge bill; understanding whether that exists and how to configure it is part of knowing how to secure your server.
    – keshlam
    Commented Jul 10, 2023 at 2:35
  • 3
    Don't leave servers running unmonitored. If you can't handle the management, go with more expensive services that do this for you. The reason why DigitalOcean is so cheap is precisely because you are liable for the servers. If you don't know what you're doing, pay someone else to do it.
    – Nelson
    Commented Jul 10, 2023 at 8:44
  • 1
    I use DigitalOcean also, and I absolutely turn things off immediately when I'm done. Nothing is kept running. The only way I'll keep a server running is if I have setup, at minimum, daily usage reporting. I would prefer to have configured extensive live alerts before I go live. The shortest amount of time it took before my servers were port scanned was an HOUR. The internet is hostile, by default. Your servers were absolutely being scanned for vulnerabilities this entire time, and they finally found one.
    – Nelson
    Commented Jul 11, 2023 at 0:35

Some cloud providers allow you to set a limit on your spending to safeguard against malicious attacks or even outright mistakes that may cause your bill to skyrocket. For example, AWS has "AWS Budgets".

Assuming you're using DigitalOcean, there does not appear to be a way to set a cap on usage for billing safety:

https://www.digitalocean.com/community/questions/limiting-droplet-bandwidth https://www.digitalocean.com/community/questions/how-to-set-a-traffic-limit-to-avoid-unwanted-charges

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .