I was a bit angry because they didn't mention this at the time of signing up. It might be somewhere in the t&c but I think this kind of information should be explicitly told viz. we require your passport and credit card photo to sign you up with our service.
I didn't like the callousness with which they request the information. Another commenter mentioned he talked to them and they said only last 4 digits of the card would do for the photo. Now isn't this the kind of information they should be providing along with the request?
I understand I am giving them my card data for payments and the photo of my card contains less data than what is already there with them. But there are legal requirements for storing credit card info on which I can count. There are no such requirements for a photo of credit card exchanged over mail.
> The data I'll be putting on hetzner servers is much more valuable than the image of my passport
I was more concerned about credit card. I did find the passport request a bit weird, but then I had the same line of thought as you - a copy of my passport is with my employer, my landlord, custom offices and a bazillion other places. Identity theft is a possibility but an established business comes very low on the list of threats.
> I understand why you would be hesitant to give these things up as an american-- when I first started doing business internationally, I was very hesitant as well.
I am an Indian living in India. India as a nation is a late entry in online playgrounds, and as a result, most of us are skeptic when dealing online. As I detailed in my parent post, I mostly use my virtual credit card to make the payments with the limit set to the amount I am going to be charged to avoid being scammed(page says x, you charge me 100x). That is not a concern with established businesses though.