A trick i've started doing is encrypting my env vars, then hard-code the decryption key in the code

that way if the provider gets popped, they need my binary to decrypt it

it shouldn't be necessary and it sounds stupid, but in cases like this, it proves invaluable (it appears they don't have customer code/binary access, but maybe that wasn't important enough to mention)