Dear Timo, all,

First off, I want to let you know that documents containing potential confidential member information - company registration papers, network plans, any document sent to the NCC in order to justify additional resources, etc. - are stored on premises in our Document Management System (Alfresco).

Registry information - including the history of all Internet Number Resources, plus all current and historical information about our members (legal address, company registration number, etc.) - is stored on our in-house-developed software, running on premises.

Ticketed communication with members is stored in Zendesk, which runs in the cloud using AWS infrastructure. No documents are stored directly in Zendesk, and any documents sent as attachments are automatically removed and stored in Alfresco.

For copies of IDs and passports, we use a third party (iDenfy) to identify our members. We don’t store any copies of IDs as part of this process, and IDs are deleted after 14 days.

For staff email we do use Gmail, and I note that copies of some Zendesk tickets might end up on staff email accounts. This came from an internal decision to fully use Google Workspace, which we were already using for other productivity tools. We also recently stopped paying for licenses for Zoom and now use Google Meet for video conferencing. Using Gmail for staff brings several benefits for us, including better spam and malware filtering as well as integration for staff with the rest of the Google Workspace tools.

As has been noted here, these decisions are largely cost- and resource-driven. We have undertaken serious efforts to reduce costs on the technology side of the organisation over the past two years, and this has resulted in some of the compromises that have been noted on this thread. An example of this is our recent efforts to reduce our data centre footprint, which have focused on providing quality services in a cost-effective way [1].

However, it's important to note that for most email we do in fact run our email infrastructure, including MTAs, community and membership mailing lists, and the ASO and NRO email systems. We operate on-premise MX servers, which handle all emails directed to ripe.net and route them accordingly. Emails sent to staff and role accounts are forwarded to Gmail, while those intended for support go to Zendesk. Emails directed to mailing lists are routed to our on-premise Mailman instances.

For outgoing emails, we use various services: Gmail for staff emails, Zendesk for support, AFAS for invoicing, and Brevo for some announcements. Any remaining emails, such as those from mailing lists and NCC services (like RIPE Database updates, RIPE Atlas, etc.), are sent through an on-premise mail server.

It is difficult to run our operations if we have to speculate on what governments can and cannot do. Instead, we apply a risk-based approach, paying close attention to the contracts we sign with these providers and ensuring that the obligations described in them give the highest possible level of privacy and security for our members.

Kind regards,