Report an abuse committed through Scaleway services

Scaleway has set up a form allowing you to report illegal content or behavior hosted on or committed through its services by one of its customers (below referred to as an “abuse”).
The aim of this notice for reporting abuse is to assist you, as plaintiff, with the submission of an abuse report and to indicate how the report will be processed. If you are one of Scaleway’s clients and do not know how to handle an abuse you received, a dedicated section is available at the end of this notice.

Who can report an abuse?

You can report an abuse whether you are one of Scaleway’s clients or not.
In case you are a foreign authority, we invite you to follow the usual judicial cooperation system between your country and France.

What types of abuse can I report?

You can report different types of content or behavior using Scaleway services in an abusive or illegal manner, as described below:
Most frequent:

Botnet – you notice a network of bots, connected programmes where at least one is hosted by Scaleway, that communicate between each other in order to trigger joint wrongdoing.
Brute force – you notice Scaleway services are being used for attempts to obtain your passwords and/or usernames via the mass testing of different password and username combinations.
Copyright – you notice content or behavior that infringes on intellectual property rights, such as copyright, is being shared or occurring via Scaleway services.
Denial-of-service (DoS) – you notice a joint attack from multiple Scaleway servers that neutralizes or attempts to neutralize your service, site or applications.
IPTV – you notice that Scaleway services are being used to share illegal IPTV.
Open Relay – you notice a Scaleway open SMTP server would allow spam campaigns to hide behind a source which does not belong to them.
Phishing – you notice a website or email simulating an official campaign is being hosted or sent using Scaleway services in order to gather banking information and/or usernames and passwords.
Security Hole – you notice a security hole, which has not been corrected, in a Scaleway service which would allow non-authorized persons to connect to your system, in particular to trigger DDOS/BRUTE FORCE attacks or to gather sensitive information.
Spam – you are receiving unwanted emails from a Scaleway-owned server.
Virus – you notice Scaleway services are being used to share or host a programme which disrupts the functioning of a computer and can rapidly spread between computers connected to a digital network.

Others:

Animal welfare – you notice unlawful content or behavior contrary to animal welfare is being shared or occurring via Scaleway services. This includes but is not limited to animal harm or unlawful sale of animals.
Child sexual abuse material (CSAM) – you notice content or behavior that consists in one of the offenses referred to in Articles 3 to 7 of Directive 2011/93/EUis being shared or occurring via Scaleway services.
Consumer information infringements – you notice content or behavior that infringes on consumer protection is being shared or occurring via Scaleway services.
Data protection and privacy violation – you notice content or behavior that infringes on your privacy is being shared or occurring via Scaleway services.
Illegal or harmful speech – you notice hateful content or behavior is being shared or occurring via Scaleway services. This includes but is not limited to hate speech and discrimination.
Malware – you notice Scaleway services are being used to share or host a programme which disrupts the functioning of a computer
Negative effects on civic discourse or elections – you notice content or behavior that infringes on laws relevant to civic discourse or elections is being shared or occurring via Scaleway services.
Non-consensual behavior – you notice bullying or harassment of any kind is being shared or occurring via Scaleway services.
Pornography or sexualized content – you notice unlawful pornography or sexualized content or behavior that is being shared or occurring via Scaleway services. This includes but is not limited to adult sexual abuse material.
Protection of minors – you notice content or behavior that represents a danger to minors is being shared or occurring via Scaleway services.
Risk for public security – you notice content or behavior that represents a risk for public security is being shared or occurring via Scaleway services. This includes but is not limited to terrorist content as defined in article 2(7) of regulation (EU) 2021/784 and offenses mentioned in article 421-2-5 of the French criminal code. We hereby remind all customers that, as per French and EU law as well as Scaleway’s general terms of services, it is strictly prohibited to host, make available, or share terrorist content via Scaleway services.
Scams and/or fraud – you notice fraudulent activity is being shared or occurring via Scaleway services.
Self harm – you notice unlawful content or behavior that depicts or promotes self-harm is being shared or occurring via Scaleway services.
Spamvertisement – you notice that a fraudulent website advertised by spam is hosted on Scaleway’s services.
Unsafe, non-compliant or prohibited products – you notice content or behavior that facilitates the illicit traffic of prohibited products is being shared or occurring via Scaleway services.
Violence – you notice violent content or behavior is being shared or occurring via Scaleway services.

We hereby remind you that reporting a content or activity as illegal in order to obtain its removal or to stop its distribution while knowing this information to be untrue or inaccurate, is punishable by a prison term of one year and a fine of EUR 15,000.
You can obtain information concerning the host and/or owner of the IP addresses, servers or websites on which the illegal content or behavior is hosted, by using an online IP address or domain name search tool, commonly known as the “Who Is” service.

How can I contact the Abuse team?

In case you consider that the abuse you submitted has not been handled appropriately or if you encounter any difficulty with submitting the abuse form, please contact the Abuse team. You can also use this contact form if you want to be considered a trusted source partner by our abuse services.
If you are an authority issuing a removal order under Article 3 of Regulation (EU) 2021/784, you can contact the Scaleway abuse team at the dedicated point of contact that was provided to you. As per Regulation (EU) 2022/2065 (also known as the Digital Services Act), EU Member States’ authorities, the Commission and the European Board for Digital Services can contact Scaleway’s abuse team via dsa@scaleway.com. This dedicated point of contact shall only be used by the authorities mentioned in this paragraph and communications shall be in English or in French. Scaleway will not process emails sent to this email address by any other entity.

Please note that any communication with our Abuse team, no matter the point of contact used, shall be in English or in French in order for it to be processed.

Abuses committed through Scaleway services must be reported via:

the form available here: https://abuse.scaleway.com OR
by letter to the following address: Scaleway – Equipe T&S – 8 rue de la Ville l’Evêque – 75008 Paris. We strongly recommend that you send your letter using registered mail with acknowledgement of receipt.

If your report concerns the following items, you can report them to the French Anti-Cybercrime Office (Ofac) via the PHAROS platform
https://www.internet-signalement.gouv.fr/PharosS1/ :

Child sexual abuse or corruption of minors on the Internet
Incitement to racial hatred or incitement to discrimination of persons because of their origin, gender, sexual orientation or disability
Threats or incitement to violence
Illicit trafficking (drugs, weapons, etc.)
Endangerment of persons
Incitement to commit crimes
Fraud
Terrorism (threat or apology)
Cruelty to animals

If you have received spam emails, you can report this to Signal Spam : http://www.signal-spam.fr, of which Scaleway is a member.

What information should be included in my report?

In order to analyze and process your request, Scaleway requires you to communicate certain information.
Reports which do not contain sufficient information will not be processed.
In order to help you provide the required information, please see the definitions provided below:

IP address or domain name – corresponds to the IP or IP address (a series of numbers allowing for the unique identification of a computer or internet network) source of your report, the complete domain name if the report concerns a domain name (alphanumeric name used to identify a computer (web server or email server) on the internet) or the URL.
Incident Date – corresponds to the publication date of the illegal content or the start of the illegal behavior. This information is essential as the services can be subscribed to and then canceled within a short amount of time. The same service can therefore be used by different customers on the same day.
Time – corresponds to the exact time of publication of the illegal content or the start of the illegal behavior. This information is essential as the services can be subscribed to and then canceled within a short amount of time. The same service can therefore be used by different customers on the same day.
Abuse Type – corresponds to the type of abuse you wish to report. The types of abuse are explained in detail under the question “What types of abuse can I report?” above.
Your Email – corresponds to your electronic mail address. Providing your email address will allow you to receive updates on the processing of your report.
Your Name – depending on the type of abuse you are reporting and in order to facilitate the submission of notices containing all the information required by Regulation (EU) 2022/2065, also known as the Digital Services act, you will be required to provide your name. Depending on your situation, it corresponds to:
-- if you are a natural person – your first and last name
-- if you are a legal entity – your corporate form and business name
-- if you are an administrative authority – authority name
Describe your issue – describe what you have observed in as much detail as possible and on which legal ground the disputed content should be removed or made inaccessible. Provide information such as logs, time zones, headers, the precise location and if applicable, the email addresses to which the content is made accessible. This information will allow our customer to find the source of the reported behavior or content and rectify it. This description will be directly forwarded to our customer, therefore do not include any confidential or personal information which you do not want them to access. Scaleway denies all responsibility for the use which could be made by third parties of any information that you provided in this field.
Bona Fide – You will be asked to tick this case to confirm that you believe, in good faith, that the information you are providing is accurate and complete to the best of your knowledge.
We would like to remind you that any incomplete report may not be considered.

How is my report processed?

If you have submitted your abuse by sending a letter:

The Abuse Team verifies the exactness of your report, that all the necessary information has been provided for the report to be processed, and whether the report indeed relates to explicitly illegal behavior or content with regard to French regulations, and the evidence and information you have provided.
If your report meets the above criteria, it will be approved by the Abuse team and forwarded to Scaleway’s customer so that the necessary corrective measures can be taken promptly.
The Abuse team will reply to let you know if your report has been processed and forwarded to the relevant customer or if it has been rejected.

If you have submitted your abuse using the form available at this address https://abuse.scaleway.com:

An email confirming the submission of your report is sent to the contact address provided in the form if you provided one.
The Abuse team verifies the exactness of the report, that all of the necessary information has been provided for the report to be processed, whether the report indeed relates to explicitly illegal behavior or content with regard to French and EU regulations, and the evidence and information you have provided.
If your report meets the above criteria, it will be validated by the Abuse team and sent to Scaleway’s customer so that the necessary corrective measures can be taken promptly.
If your report is rejected, you will be informed of the reasons why by email if you submitted an email address.
Once the abuse has been processed, you will receive an email confirming that the abuse has been treated and is now closed.

Should abuses not be handled properly by Scaleway’s customer, Scaleway reserves the right to suspend the services and/or terminate the contract at its discretion in case of abuse. If judged necessary and proportionate in order to protect the integrity and reputation of Scaleway's infrastructure or to abide by legal requirements, services can be locked immediately upon reception of the abuse by the abuse team.

Notifications provided by Scaleway’s trusted source partners are processed automatically and can therefore result in services being suspended automatically. Trusted sources are approved by Scaleway’s abuse team in order to ensure the abuse reports submitted are trustworthy and can therefore be processed automatically. The tool used to process these reports is developed internally by Scaleway’s teams. Even though these notifications are processed automatically, Scaleway’s abuse team can double-check the decisions taken automatically by this tool.
Abuses reported by sources other than trusted sources are processed manually by the abuse team and therefore do not result in automated suspension.

Scaleway strives to act in a diligent, objective and proportionate manner in applying and enforcing the restrictions, with due regard to the rights and legitimate interests of all parties involved, including the fundamental rights of the recipients of the service, such as the freedom of expression, freedom and pluralism of the media, and other fundamental rights and freedoms as enshrined in the Charter of Fundamental Rights of the European Union.
Please note that massively reporting the same practices or content forces the Abuse team to carry out unnecessary actions which have a negative impact on their work. As such, it is counterproductive to continuously report the same practices or content.

We would like to remind you that it is important to remain courteous when communicating with the Abuse team. Abuse reports shall not contain any offensive, vulgar or threatening language.

I am one of Scaleway’s customers and I received an abuse complaint – what should I do?

As a customer, you are responsible for taking appropriate measures to prevent the abusive use of your services. You can find more information on how to resolve abuses in the Scaleway FAQ.
If you consider that you received an abuse complaint that is not accurate or justified, please contact Scaleway’s abuse team immediately by opening a ticket to support from your account.
If you consider that your services should not have been suspended following an abuse report, you can submit your complaint by clicking on the link in the email you received to inform you about the suspension of your service and you can reach out to the abuse team with a ticket to explain the corrective measures you have taken following the abuse complaint.

How is the personal data I provide in the form used?

Scaleway collects the personal data that you provide in the form for the sole purposes of processing abuse reports, this includes the receipt of abuse reports via the dedicated form and the processing and monitoring of said reports.
This processing is based on our legal obligations as well as on our legitimate interest in providing a tool for reporting abuse.

Your personal data will be processed by Scaleway for the above-mentioned purposes only. The personal data and all information that you may have provided in the field “Describe your issue” will also be transferred to Scaleway’s customer concerned by the report, along with your email address if you ticked the box relating to this. Upon request, they may also be transferred to persons and authorities whose right of access to personal data is recognized by law, regulations or provisions issued by legally-authorized authorities.
Your personal data is kept for the time period necessary to fulfill the purposes for which it is collected or to comply with Scaleway’s legal obligations and/or to meet the demands of public and governmental authorities.
Scaleway places particular importance on the security of personal data, and implements appropriate technical and organizational measures to protect the personal data it processes. Your personal data is processed electronically and/or manually, in such a way that, in all cases, their security and confidentiality is assured with regard to their sensitive nature, via administrative, technical and physical measures which prevent their loss, theft, use, divulgence or unauthorized modification.

In particular, with regard to your personal data and as mentioned in Scaleway’s privacy policy, you may at any time access or rectify it, request its deletion if the data is no longer necessary or request its processing be limited for the specific reasons set out in the applicable regulations by sending an email justifying your identity to: privacy@scaleway.com.
You also have the right to object at any time, for reasons relating to your particular situation, to the processing of your personal data, as well as to define directives relating to the fate of your personal data after your death by writing to the above-mentioned e-mail address. Your personal data is processed on the legal grounds of legitimate interest to Scaleway. In the event of a complaint to which the company Scaleway did not give you a satisfactory answer, you can turn to the French National Commission on Information Technology and Liberties (CNIL) in charge of the respect of personal data obligations.

(EU) 2021/784 Transparency Report