[throwaway293290]

Another person that worked at scaleway here.

The whole ISO27001 thing is false advertisement, the scope is very restricted and scaleway, online.net, dedibox or whatever are NOT ISO27001 certified.

The certification only applies to a very restricted range of products which are not even pubicly available.

> What about their access control policy and network access control policy?

A joke, many critical services were only firewalled to the outgoing ip address of their corporate wifi network which practically anyone entering the building was given the password.

The private network on online.net dedibox offering was just ACLs that were applied with a loop on every switch without much error handling it happened that what was displayed on the console was not the real configuration applied to a switch. What a joke.

And this is just a starter, this kind of things goes on and on. Scaleway is a terrible company.