Update, 21 October I opened a new account, this time with the right country. The original still says Equatorial Guinea, its ticket is still open, and I don't expect to go back to it.
This week I did what Brussels keeps asking founders to do: I chose a European cloud provider for an AI API workload instead of defaulting to a US hyperscaler. The provider was Scaleway, the French company that markets itself as Europe's sovereign cloud.
Within 24 hours of signing up I had an account with the wrong country on it, a phone form that insisted I was calling from Equatorial Guinea, and a support thread in which four replies gave me four different answers to the same question. Three days later, the field is still wrong.
Here is how it started. I selected Finland. When I pressed OK, the form saved Equatorial Guinea. I selected Finland again; the account ended up in Equatorial Guinea anyway, and there was no way back. The fix is a one-line database update. What follows is not a story about a bug. It is a story about what happens when a European company builds its process for the regulator first and the customer second, and why that single habit may matter more to Europe's cloud ambitions than any subsidy or data-residency law.
Four replies, three people, four answers
Here is the thread, in order. The support agents were polite throughout and none of this is their fault.
| # | What I asked | What support said |
|---|---|---|
| 1 | Please set my company's country to Finland. Here is the business ID and VAT number. | “Could you give me the full address of your account and the email address tied to it?” |
| 2 | Sent them — my Finnish address included. | “If I were to manually change the country to Finland I would also need a Finnish address to go with it. Could you please provide me one? I’ll update the account accordingly.” |
| 3 | Sent it again. | “Can you open a ticket directly from your Scaleway account to request the country field update. Our team will process the change for you.” |
| 4 | Opened the ticket. | “We are currently unable to make changes to your account. Please add a payment method and complete the KYC verification process. Then if you still have any trouble updating your information, we will be happy to assist you.” |
Read it once more and notice what moved. The first two replies treat the request as routine and ask for the data needed to fulfil it — the second asks for an address one message after I had sent it. The third reroutes it to a different channel. The fourth, from the “Support Elite Team”, says nothing on the account can change until I have handed over a card and passed identity verification on a record that says I live in Central Africa. It closes with a link to the company's GDPR page on managing personal data.
The obvious alternative, deleting the account and registering again correctly, was not offered either. I had to ask whether I could reuse my email address if I did. That question is still unanswered as I write this.
The fair part
KYC is not a European invention, and checks on cloud signups are tighter everywhere since GPU capacity became a target for fraud. The requirement itself is defensible.
What isn't is the sequence. I did add my card. My Finnish bank confirmed me through 3-D Secure, so Scaleway's own payment system now holds a bank-verified Finnish card — on an account its support says cannot be changed from Equatorial Guinea until I prove who I am. And the company's last reply pointed me to its own GDPR page, which raises a question it did not answer: why does correcting a wrong field about me require a card and an identity check first?
Each reply applied a reasonable rule. Nobody owned the outcome, which was that a founder with a valid EU VAT number, a verified card and a stated intent to pay could not get a one-field correction in three days of trying.
That is the pattern worth writing about, because it is not specific to one French cloud company. It is the default shape of European B2B process.
Friction is the real sovereignty tax
Europe's cloud strategy rests on a quiet assumption: that if the price and the capability are roughly comparable, customers will pay a small premium to keep data and dependency inside the EU. Call it the sovereignty premium. Most founders I know would pay it, in money.
What they will not pay is a premium in time. A solo founder or a three-person team evaluates a provider in an afternoon. If the afternoon ends with an open ticket and no API key, the evaluation is over, and it was not Brussels that lost, it was the provider. The US competitor's onboarding has been optimised by a decade of A/B tests on exactly this moment. The European one has been optimised by a decade of audits.
The cost compounds in a way that never appears on an invoice. Every hour a technical founder spends on a country-code field is an hour not spent on the product. Multiply by the thousands of small teams the EU says it wants to keep on European infrastructure, and the friction tax dwarfs any price difference. It is also regressive: a large enterprise has a procurement team to absorb it, a startup does not.
This is why I think the sovereignty debate is being had in the wrong place. The argument is about data residency, GDPR, the CLOUD Act and who can subpoena whom. Those are real. But a European provider that cannot change a customer's country without a committee has already lost the customer the policy was written to protect.
What a European provider has to get right
None of this requires lower standards. It requires putting the customer's path before the auditor's.
- Let users fix their own mistakes — and yours — before verification. A country, an address or a phone prefix on an unverified account carries no compliance weight yet. Make them editable until the moment KYC locks them.
- One owner per ticket. The agent who answers first carries the case to the end, or hands it over with a summary the customer can see. Four replies from three people with four answers is a process failure, not a staffing one.
- State the full requirement in the first reply. “To change the country we need A, B and C, in that order” costs one sentence and saves three days.
- Offer the reset. If the account is unverified and the user wants to start over, say so and say whether the email can be reused. Silence on that point is the single most expensive thing in the thread above.
- Measure time-to-first-API-call for self-serve signups, and treat a support ticket during onboarding as a defect with a root cause, not as a resolved case.
Most of these are a week of product work. The hard part is cultural: a company that has spent years proving to regulators that it is careful must now prove to customers that it is fast, and those two reputations are built by different people.
Where this leaves me
As of today the account still says Equatorial Guinea and the ticket is still open. I have not yet decided whether to complete KYC on a record I know to be wrong, delete the account and start over, or quietly register with a US provider and come back to the sovereignty question when I have more time than money. The honest answer is that a founder in that third position is exactly who Europe is losing, one afternoon at a time.
I will update this post when the ticket closes. If Scaleway reads this: the field is still wrong, and I would still rather pay you than the alternative.
The question for anyone writing European digital policy is simpler than the ones currently on the table. Before asking how to keep European data on European servers, ask how long it takes a European founder to give a European provider money. Then measure it.