DigitalOcean: Introducing Our London Region

I am a current DigitalOcean client and I was recommending DO to my friends and professional contacts.

New policy of requiring scanned documents is unacceptable in the environment of pervasive nation-state level monitoring and destruction of privacy. If this is a permanent change, I won't recommend DO any longer.

The solution is extremely simple: accept bitcoins for payments and/or fair use verification for free tiers. Also there is a market for forged document scans, just read krebsonsecurity.

I don't understand why a scan of a passport or ID of someone signing up is required when it cannot be verified.

The reasons are this:

Banks are legally required to conduct some kind of Know Your Customer where an individual has to physically present themselves so their provided ID is matched against their physical person. So KYC is done by a bank. And I'm paying with a bank / credit card.

In the case of someone opening an account by using a fraudulent card, it is trivial to attach what looks like a mediocre scan of a passport or divers licence.

Notarised IDs are not requested, so there is no way to verify with a lawyer. And Notarisation is expensive, so it will turn almost all customers away.

Closing circle: If the name on the card matches the ID provided and it is not a case of a fraudulent transaction, the individual can be pursued via their bank. This is probably not worth it at a time vs reward level, unless the abuse of the network is such law enforcement should be involved, but is not something for you to do, but for your bank, as correspondent bank, to do.

While obviously a liability in terms of information security and the risk of a breach, requiring such personal information is a precedent: If all companies did so for low value transactions, then this information would end up in thousands of online repositories (and therefore of large scale, opposed to, say, a hostel seeing a handful of customers per day keeping paper records) which would surely have leaks. The risk becomes systematic. Which increases fraud.

Let the banks do KYC. Let the hosting company ensure the network is monitored in the way they desire.

Edit: Having worked in a couple of banks at a middle management level, and covering regulatory, compliance and information security roles, what really helps when regulators or general law enforcement audit or inspect a function, what really matters is showing both internal policies showing banking regulations are drilled into employees, and anticipative policies where regulations are not yet set in stone are also followed. If you don't have internal policy documents on how your network is monitored and a kind of minimum standards dashboard, make one and keep records, as it can be invaluable as defense against accusations nonfeasance, misfeasance or even malfeasance.

SMS verification of a phone number?

Barring that, detect mining and terminate it with system monitoring tools, and prevent port scanning/flooding at your network border (your netops team is active on NANOG and seem to know what they're doing).

An idea to automate part of the verification process is to have a "fill as much as you can or want" form asking for public accounts (facebook, G+, twitter, github, personal web site, non-free email accounts etc) and then generating a confidence score used for a pass/no pass/id required. A service (API) for this is one of the multiple ideas I haven't acted on.

If capturing an ID is important, I'd suggest a solution like jumio.com which when integrated, is pretty seamless.

Why is mining in particular disallowed? Aren't you allocating a set amount of CPU to a paying customer?

But if you don't, it is pretty expensive:

80$/mo DO: 8GB RAM, 4 Core, 80GB disk, 5TB

163$/mo Softlayer: 8GB RAM, 4 Core, 100GB storage, 5TB

If by "a while" you mean less than a month: https://www.digitalocean.com/company/blog/announcing-ipv6-su....

I am a customer of DO's but I am not a happy one since I have to muck around with 6in4 tunnels just to get this basic stuff working.

Whether or not VAT is payable is independent of what currency is used to bill in. If you're using a VPS in the UK then there's almost certainly VAT payable by the vendor. If they are in another EU country, and you're VAT registered, and they have your VAT number they can zero-rate the transaction.

There is VAT to pay and these companies are required to register for VAT and charge it I believe. Eg see http://webarchive.nationalarchives.gov.uk/20110202144320/htt...

How is there a benefit at the 'current' exchange rate? If the price isn't set in GBP, what have you got to compare against, regardless of the rate right now?

I'm not sure how the dollar price would be in my favour, if you've not specified what the GBP price would be? Sure, once you've set the price it could go either way.

Anyway, as others have said, there are charges and spreads on foreign currency banking. It also adds complications to my otherwise very simple accounting needs.

AFAIK, every bank (including for instance Paypal) charges a fee for conversion.

At least, it's the case with my French and my Dutch bank.

That's one of the great benefit of the Euro when shopping in the EU (well, except for our British friends :) )

Edit: corrected a typo

I'm not speaking for Marco, but another issue with dollars is tax accounts (and especially VAT accounts) for British companies have to be in pounds, so there's overhead in doing the conversions, tracking the exchange losses/gains, etc. We also have to reverse charge the VAT on those transactions as well (though I'd be surprised if the majority of business owners know they have to do that).

About 90% of my company's expenses are in dollars, so I've had to become proficient at dealing with it, but I imagine it's more annoying for companies who only make the occasional USD transaction, especially as they may have smalltime accountants unfamiliar with or unwilling to deal with the exchange rate stuff properly.

Its not in our favour unless our exchange rate appreciates every month more than our fees. And yes we get charged just like you would if I charged euros to your card.

Regardless of the company, there is always a conversion charge around 2% and the rate applied is never the actual rate, banks usually calculate a rate using some kind of moving average.

My bank will charge £1.50 plus a variable commission for paying in anything but GBP.