Scaleway asked me for a copy of my Dutch passport too which I refused, and then they limited the services available to the long-time active business account this was for.
Neither their docs or two separate support agents I spoke had any information on why it was necessary, where the copy would end up, how long it would be kept, etc. which seemed very fishy and is totally illegal.
Yeah the verification process initiation including document upload all went through the account control panel. The account audit log also contains records related to the incomplete verification process, and there's a permanent banner telling me to complete the thing too.
Since both are EU businesses, these were "Intra-Community Acquisitions"[1] so the VAT was reverse-charged.
Either way, they knew the business' VAT ID, Chamber of Commerce ID, etc. and had been billing us successfully using that info for a good while, there were no outstanding bills, and there was nothing nefarious or questionable going on our servers or with the associated traffic (just running legacy applications and services).
All in all a super weird experience, which was a shame since we were otherwise and up until then quite happy with them.
Neither their docs or two separate support agents I spoke had any information on why it was necessary, where the copy would end up, how long it would be kept, etc. which seemed very fishy and is totally illegal.
This was about a year ago.