Terms and policies
Account security
Protect the client area login and the guest. Both can lose the server.
If someone has your client area login, they can rebuild or cancel the VPS. If someone has RDP or SSH, they already have the guest.
Client area
Use a unique password. Turn on two-factor authentication if it is offered on your account. Treat ticket mail as sensitive.
Guest
Change the issued Administrator or root password on first login. Prefer SSH keys on Linux. Restrict RDP to known IPs when you do not travel.
Compromise
Reset both passwords, rotate keys, and open a ticket with timestamps. We can reinstall if the guest is not trustworthy anymore.