GOpenCNR transit operator agreement

This agreement

This agreement is between Gelhaus Solutions, as Tier 0 of GOpenCNR, and a member that gives transit to other members, the transit operator. It takes effect when both sides have signed it and the operator has passed its first audit. Publishing it here is not an offer: transit is opened only under a signed copy of the version current at the time.

The GOpenCNR terms, the acceptable use policy and the network participation agreement bind the operator as a member, as they bind everyone else. The GOpenCNR charter rider gives the operator its council seat. Warranty, liability and law are governed by the general terms of service.

What transit is in GOpenCNR

A transit operator carries other members' open prefixes. Members name it in the registry as a provider of their ASN, it carries their routes onward, and traffic to and from their space crosses its network. Transit never carries traffic between the internet and members: both ends of every packet the operator carries for others are in GOpenCNR's ranges or behind a named interconnect.

• Only what the registry names. The operator carries the prefixes of the members that name it as a provider, as their route objects describe them, and nothing more specific.
• Generated filters and ASPA. The operator's filters are generated from the registry by the agent, and the ASPA objects of the members it serves name it as their provider. The operator changes none of it by hand.
• Source filters on every interface. Each interface accepts only sources inside the registered space of whoever is behind it.

Closed prefixes never cross transit

A closed prefix never crosses a transit operator's network. Closed routes travel only through Tier 0's hubs and certified hubs. Agents strip them from the operator's sessions, and the operator never carries, re-announces or forwards one. A closed route that reaches its network is a leak: the hubs cut it at once, a case opens and the holder of the prefix is told.

The audit

Tier 0 audits the operator before it carries anything for others, and then once a year. The audit checks:

• that the operator's filters are the ones generated from the registry, and that they are in force;
• that the ASPA objects naming it match the provider relations it actually has;
• that every interface filters sources to the registered space behind it;
• that no closed prefix crosses its network;
• that its abuse contact is reachable;
• its security posture, including how it keeps its systems patched and its keys and access under control.

The rules for the audit are set by the GOpenCNR Operators Council. An operator that fails its audit, or breaks this agreement, may lose its audited status and then carries no transit. It is told why and may challenge the decision as it would a sanction under the abuse and sanctions policy.

Forward only, and no records

The same duties bind the operator as bind every hub in GOpenCNR.

• No inspection. The operator does not inspect, analyse, alter or divert the traffic it carries, and lets nobody else do so. Between members with agents, that traffic is the inner WireGuard layer, which the operator sees only as ciphertext.
• No traffic records. The operator keeps counters and the state of its sessions, and nothing else about the traffic it carries: no flow records, no packet captures, no record of who talked to whom.
• Flow sampling is Tier 0's alone, only inside an open case, for at most 7 days, at 1 in 1,000 packets, recording source, destination, port and size and never content. The operator never samples of its own accord.
• The secrecy of telecommunications. The operator, and every person it lets near the routers that carry transit, commits in writing to keep the secrecy of telecommunications under Section 3 TDDDG, wherever they are, before they get access. The operator keeps those commitments and shows them in the audit. GOpenCNR and the secrecy of telecommunications sets out what the secrecy covers in GOpenCNR.

Software and keys

The operator runs the GOpenCNR agent, in signed releases only, and installs a release marked as a security release within 14 days, as every member must. Its keys are made on its own routers and never leave them. The operator keeps them, and every enrolment token, secret.

Cases and security incidents

• Abuse contact. The operator keeps an abuse contact reachable. As the holder of its own space, it acts on a case within the times of the abuse and sanctions policy: 48 hours, or 12 hours for an active attack.
• Cases. The operator answers Tier 0's questions on a case without undue delay, from the counters and session state it keeps, and passes any abuse report it receives about a member it serves to abuse@gplatform.org.
• Security incidents. The operator reports to Tier 0 without delay, at contact@gplatform.org, every security incident: any suspected compromise of the routers that carry transit or of their keys, and anything that disrupts the transit or affects the traffic it carries. Tier 0 reports such incidents to the Bundesnetzagentur and the BSI under Section 168 TKG, within 24 hours, 72 hours and one month, and needs the operator's report to do so.
• Requests from authorities that concern GOpenCNR members or their traffic go to Tier 0, as the data protection section says, and are counted in the joint transparency report.

Sanctions and emergencies

The sanctions ladder of the abuse and sanctions policy applies to the operator as it does to any holder: a warning, reduced max-prefix, routes suppressed at the hubs, depeering from all Tier 0 nodes, and reclaiming the allocation. Each step lasts at least 7 days before the next. Tier 0's emergency suspension applies too, in the cases where the general terms of service let us act first, such as an attack on the network or on others, malware, a match on a sanctions list or a binding order of a court or an authority: it takes effect at once, may only suspend or tighten, never loosen, and lapses after 90 days unless it is reaffirmed, after one year at the latest. The operator receives the statement of reasons no later than when it takes effect, unless the law forbids telling it, is heard afterwards, and may appeal within six months to the GOpenCNR Registry Council. The courts remain open.

No fees, either way

• Neither side pays the other anything. The operator carries transit at its own cost.
• The operator does not charge members for GOpenCNR transit or traffic.
• What the operator gets in return is standing in GOpenCNR's governance, described below, and nothing else.

The council seat

• The operator's group holds one ex officio seat on the GOpenCNR Operators Council, exercised by its representative, for as long as it is an audited transit operator.
• It casts one ballot in elections to the GOpenCNR Registry Council, through its designated voter.
• After 90 days in the transit role, it may also vote in elections to the GOpenCNR Community Council.
• An operator group that also runs a certified hub still counts once: one seat and one ballot.

Data protection: the operator as our processor

For members' data, the operator is our processor under Art. 28 GDPR. It carries the members' transit on our behalf, and Gelhaus Solutions is the controller, as the GOpenCNR privacy notice describes. This section is the agreement Art. 28(3) GDPR requires.

• Subject matter and duration. Carrying transit for the GOpenCNR members that name the operator as a provider, for as long as this agreement lasts.
• Nature and purpose. Forwarding the traffic of those members; running the sessions that carry their routes; filtering and counting as the generated configuration says; and reporting counters and session state to GOpenCNR. Nothing else.
• Kinds of data. The public keys, prefixes, ASNs, provider relations and sessions of the members it serves; the addresses their tunnels come from; counters; and members' traffic while it crosses the operator's network.
• Data subjects. The members it serves, the people who use their networks, and anyone whose communication crosses the operator's network.
• Our instructions only. The operator processes members' data only on our documented instructions: this agreement, the configuration the registry generates, and what Tier 0 instructs in writing in a case. That covers transfers to a third country too. Where the law that applies to the operator requires other processing, the operator tells us before it acts, unless that law forbids it. If it believes an instruction infringes data protection law, it tells us at once.
• No disclosure of its own accord. The operator discloses members' data to nobody, authorities included. A request from an authority goes to Tier 0. Where the law that applies to the operator compels it to disclose, it tells us first, unless that law forbids it.
• Confidentiality. Everyone the operator lets process members' data, or lets near the routers that carry transit, is bound to confidentiality and has committed in writing to the secrecy of telecommunications, as "Forward only, and no records" sets out.
• Security. The operator takes the measures Art. 32 GDPR requires, and at least those this agreement and the audit set: generated filters, source filters on every interface, signed releases, keys made on its own routers, systems kept patched with access limited and logged, and no traffic records.
• Sub-processors only with our authorisation. The operator engages another processor, including the provider of a server, a data centre or a line that carries the transit, only with our prior written authorisation, specific or general. Under a general authorisation it tells us in advance of every intended addition or replacement, so that we can object. It binds each sub-processor by contract to the same obligations and remains liable to us for it.
• Assistance. The operator passes every request from a data subject to us without undue delay and answers none itself, and helps us meet our duties under Arts. 32 to 36 GDPR, breach notices and data protection impact assessments included.
• Breaches. The operator tells us of a personal data breach without undue delay, at contact@gplatform.org, with what Art. 33(3) GDPR asks for as far as it knows it, so that we can notify the supervisory authority and, for telecommunications data, the Bundesnetzagentur and the BfDI under Section 169 TKG.
• At the end. When this agreement ends, the operator deletes all members' data it holds, unless a law requires it to keep them, and confirms the deletion to us in writing. There is nothing to return: the registry holds what GOpenCNR needs.
• Audits. The operator makes available everything we need to show that this section is kept, and allows and contributes to audits, inspections included, by us or by an auditor we mandate. The yearly audit is such an audit.
• Outside the EU and the EEA. An operator established outside the EU and the EEA, in a country without an adequacy decision, signs the EU standard contractual clauses with us, module 2 (controller to processor), as part of this agreement. Where the clauses and this agreement conflict, the clauses prevail. The privacy notice tells members.
• The operator's own logs. The operator is a controller in its own right only for the logs of its own infrastructure, its hosts and its network. It gives the information the law requires for them and keeps no record of members' traffic in them.
• Endpoint addresses are never made public.

Where the operator may run, and its own legal duties

• Its own notification. Tier 0's notification to the Bundesnetzagentur covers the network Tier 0 operates, not the operator's. Where the operator's activity needs a notification of its own (Section 5 TKG), the operator files it and meets the duties that come with it.
• Outside Germany, the operator answers for its own local law, including any telecommunications notification or licence it requires.
• Never in a sanctioned country. A transit operator may run anywhere except in a country subject to EU sanctions. Like every holder, it is screened against the EU consolidated financial sanctions list from the moment it first became a holder, and every day after. An operator outside the EU and the EEA, in a country without an adequacy decision, signs the standard contractual clauses as the data protection section sets out.

Ending the agreement

• The agreement runs without a fixed term.
• Either side may end it with three months' notice, without giving reasons. Tier 0 then tells the members that named the operator as a provider.
• Either side may end it at once for cause. For Gelhaus Solutions, cause includes the operator losing its audited status and a breach not remedied after notice.
• Gelhaus Solutions may suspend transit at once only as an emergency suspension under "Sanctions and emergencies".
• When the agreement ends, the operator stops carrying other members' prefixes, its ex officio seat ends unless its group still runs a certified hub, and it deletes what it holds about the members it served and confirms the deletion in writing. What we keep about the operator afterwards, and for how long, is in the GOpenCNR privacy notice.

Everything else

No service level applies, in either direction. Warranty and liability, including the cap for businesses, are as set out in the general terms of service; for what is given away, liability is limited to intent and gross negligence (Section 521 BGB). German law applies, and where the operator is a merchant, the courts at Gelhaus Solutions' seat have jurisdiction. A material change to this agreement, including one the GOpenCNR Operators Council makes on the topics the fence allows, is emailed to the operator at least six weeks before it takes effect, and at its next sign-in the operator is asked to sign the new version, which is shown in full and linked in the document archive, without a list of what changed. A new version applies to the operator only once it signs it. Until then, the version it signed stays in force until the agreement ends as "Ending the agreement" sets out, and the operator is not restricted for not signing.