The document request, and what it costs
Very few hosts advertise verification. They advertise instant setup, and then a scan of your driving licence turns out to be a condition of the second invoice. The request is rarely malicious. It is expensive to you all the same.
What a verification request really is
The moment you upload a document, you have made an irreversible decision on behalf of every future employee, contractor and acquirer of that company.
A photograph of your passport in a ticket system is a permanent object.
A copy that outlives the relationship
Identity scans land in helpdesk software, get attached to tickets, get backed up, and are retained under a policy written for accountants. Cancelling the server three months later removes none of it.
A gate arriving at the worst moment
Verification is usually triggered by an event, not at sign-up: a larger top-up, a refund, an order from an unexpected country. By then the workload is live and the balance of power has moved with it.
An asymmetric refusal
Decline to provide the document and you often lose the service and the prepaid balance together. There is no equivalent cost on the other side of the desk.
A breach surface you do not control
A support desk holding thousands of identity documents is a target with obvious value. Your risk there is entirely a function of somebody else’s patching schedule.
Why hosts ask, which is worth understanding
Almost none of this is about wanting your data. It is about who can reverse a payment, and about what the entity moving the money is obliged to do.
Cards can be reversed months later
A chargeback arrives long after the server has been used, and the host pays the fee whichever way it goes. Verification is the cheapest defence available against a stolen card ordering fifty instances.
The payment processor sets the rules
Merchants inherit obligations from the rail they use. When a processor requires identity on unusual transactions, the host complies or loses the ability to take money at all.
Abuse costs a host its transit
Repeated complaints threaten upstream relationships, so many operators use identity as a deterrent. It works, in the narrow sense that a determined abuser will simply buy elsewhere.
Some jurisdictions require it
A few countries impose customer identification on communications providers directly. That is a legal fact rather than a policy choice, and it is one reason to read where a company operates from.
We avoid all four by not touching cards at all. Crypto settlement through OxaPay has no reversal mechanism, so there is nothing for identity to protect against.
Sign-up, compared
| Step | A host that verifies | Here |
|---|---|---|
| Account creation | Name, address, phone, sometimes a company registration number | An email address |
| Payment method | A card or a bank transfer in your own name | Roughly 30 crypto assets, settled through OxaPay |
| Trigger for a document request | Unusual order, refund, chargeback, or at our discretion | None. The clause does not exist in our terms |
| Typical delay before the server exists | Hours to days while a human reviews the file | 47 seconds, median, from settled invoice |
| If you decline | Order cancelled, and the balance is frequently held | Not applicable |
| What is stored about you | Identity documents, retained for years | Email, password hash, invoices containing no identity |
| Panel access log retention | Commonly twelve months or longer | Seven days, then deleted |
| IP address at sign-up | Recorded and kept | Never written to disk |
| Invoice in a registered company name | Standard, and sometimes required | Not possible. We do not know your company |
When a host that verifies you is the better choice
Anonymity is a feature with costs, and some of those costs are administrative.
Procurement needs a real invoice
Finance departments often require a document showing the buying entity, a tax number and a matching payment trail. Ours shows an account reference and an amount, because that is all we have.
You want a named counterparty
If the plan involves contracts, indemnities or a jurisdiction in which to sue somebody, deal with a company that publishes its registration. A relationship built on an email address cuts both ways.
A signed data-processing agreement is mandatory
Some customers must name their processors with full corporate details. That paperwork exists precisely to attach identity to infrastructure, which is the opposite of what we are for.
Somebody else is paying by card
Expense systems, corporate cards and reimbursement flows all assume a card receipt. Buying crypto to pay a hosting bill is a conversation with your finance team that you may not wish to have.
What we hold, and for how long
The policy is short enough to print. Everything we know about an account is here, and each line has a duration next to it.
Email address, life of the account
Used for password resets and invoice delivery, and nothing else. Throwaway domains work, your own mail server works, and we do not verify who is behind either.
Password hash, life of the account
scrypt at N=2^16, never reversible, never exported. If you lose both the password and the mailbox, the account is genuinely unrecoverable, which is the trade the design makes on purpose.
Panel access log, seven days
Kept only long enough to detect an account takeover, then discarded on a schedule rather than on request. Nothing is aggregated out of it first.
Invoices, twenty-four months
So you can prove what you bought and when. They contain a plan, a site, an amount and a date, and no identity at any point.
Payment reference, until settled
A crypto payment is matched to an invoice, and the reference is purged once settlement completes. We do not keep a record of the addresses you paid from.
If this ever has to change, the warrant canary changes before the policy does, and existing accounts would be grandfathered rather than migrated quietly.
Questions
No. Not at €29, not at €5,000, not on a refund, and not on a balance top-up. There is no threshold in the system because there is no code path to reach it.
We answer what the law of the relevant site requires and nothing beyond it, and where we are permitted to notify you, we do. What can actually be handed over is short, because there is very little held in the first place.
Yes, downloadable from the panel, with the plan, the site, the period and the amount. What it will not carry is a company name or a tax number, since we have neither of yours.
Then recovery is difficult, and in some cases impossible. That is the direct consequence of not holding a phone number or an identity document, and it is the one part of this policy that genuinely costs customers something.
An address that receives mail. That is the whole form.
Pick a city, pick a size, pay in coin. Nobody reviews your order, nobody asks what the server is for, and nothing is ever requested afterwards.