How can I rent cloud computing services without risking getting into a high debt?

Question

I rent cloud-computing services from a large and reputable company. Each year, I charge $500 into my account, and use the money to buy droplets, which cost between $5 and $20 per month (depending on their size). All went well for several years. But a few days ago, I noticed that my account has a debt of $681, which is much more than the monthly cost of all my droplets together. I checked and found out that someone hacked into one of my droplets, and used it for some activity with outgoing traffic at a rate of about 2 GB per second. The company charges extra outgoing traffic at a rate of 1 cent per GB, which means $72 per hour. I was lucky to catch this on time - if I had been in a vacation for a week, my debt would have been more than $10,000, which is way more than I can afford.

My questions are:

1. Can I dispute this debt? My claim is that, when I pre-paid $500, I bought services for $500, and did not agree to buy any further services. When my balanced drops to $0, the company should just stop serving me (e.g. stopping all my droplets); it should not continue selling me services that I did not pay for.

2. In the future, how can I rent cloud services without taking the risk of getting into an unaffordable debt? For example, would it help if I use an anonymous pre-charged debit card?

EDIT: here are the TOS. The most relevant section seems to be 6.3:

By entering into this TOS and using the Services, you agree to be billed on a recurring basis and to be automatically charged by us or our Payment Processors using your Payment Methods upon invoicing. If your Payment Method or payment of fees is subject to other terms and conditions, as set forth in order forms, invoices or otherwise, then those other terms and conditions apply in addition to this TOS. You may also be billed an amount up to your current balance at any time to verify the accuracy of your account information. We reserve the right to deactivate, terminate, prevent access to, disable services for, and/or delete any Accounts or access to the Websites and Services at any time at our sole discretion, including for nonpayment, late payment, or failure to charge your Payment Methods upon invoicing".

It does not say what happens when I have no payment method on file - only a previously-charged balance. Also, it does not explicitly discuss debt; it only says that, if I do not pay, they can delete my account (which is fair enough).

Answer 1

You'll probably want a lawyer to help you, but here are some quotes from the ToS you linked to:

5.2 You are solely responsible for the activity that occurs on your Account, regardless of whether the activities are undertaken by you, your employees, any third party (including your contractors or agents), your End Users, your licensees, or your customers

and

5.9 You shall utilize proper security protocols, such as setting strong passwords and access control mechanisms, safeguarding access to all logins and passwords, and verifying the trustworthiness of persons who are entrusted with account access information. You are solely responsible for any unauthorized access to your Account, and must notify DigitalOcean immediately of any such unauthorized access upon becoming aware of it.

These say that they're not liable for the "hacker" who wasted your bandwidth.

6.1 ... You agree to pay us, through the Payment Processors or as otherwise agreed to by DigitalOcean, all sums for Services you select or use at applicable prices in accordance with our pricing and billing policies ...

This says that you agree to pay them what they say you owe them.

6.2 You must provide current, complete and accurate information for your Account and Billing Information, and must promptly update all such information in the event of changes

You have to have a valid payment method on file.

6.3 We reserve the right to deactivate, terminate, prevent access to, disable services for, and/or delete any Accounts or access to the Websites and Services at any time at our sole discretion, including for nonpayment, late payment, or failure to charge your Payment Methods upon invoicing.

They'll kick you to the curb for not paying.

13.1 In the interest of resolving disputes between you and DigitalOcean in the most expedient and cost-effective manner, and except as described in Section 13.2, you and DigitalOcean agree that every dispute arising in connection with this TOS will be resolved by binding arbitration.

You cannot sue them (except small-claims court, see 13.2), you have to go through arbitration.

13.5 Any arbitration hearing will take place at a location to be agreed upon in Manhattan, New York, NY, but if the claim is for $10,000 or less, you may choose whether the arbitration will be conducted: (a) solely on the basis of documents submitted to the arbitrator; (b) through a non-appearance based telephone hearing.

...

14.4 Governing Law. This TOS and any dispute related thereto (including under Section 13) is governed by the laws of the State of New York without regard to conflict of law principles.

The arbitration will be in NYC, based on the US and NYS laws.

---

Bottom line - nothing much you can do here, and I doubt you can find service providers with significantly different terms.

If it's important enough to you - engage a lawyer to review your contracts and explain them to you before you sign.

Answer 2

Some cloud providers allow you to set a limit on your spending to safeguard against malicious attacks or even outright mistakes that may cause your bill to skyrocket. For example, AWS has "AWS Budgets".

Assuming you're using DigitalOcean, there does not appear to be a way to set a cap on usage for billing safety:

https://www.digitalocean.com/community/questions/limiting-droplet-bandwidth https://www.digitalocean.com/community/questions/how-to-set-a-traffic-limit-to-avoid-unwanted-charges