GOpenCSR organisation verification terms

What these terms are

These terms apply when you create an organisation in GOpenCSR, when you verify it, and for as long as you act for it while it is verified. They are part of the GOpenCSR terms and are accepted with them. What we process about the people involved is in the privacy notice.

Who counts as an organisation

Resources in GOpenCDR and GOpenCNR are held by people and by verified organisations. An organisation is one of these:

• a company, whatever its legal form;
• an association or a cooperative;
• a public body, such as an authority, a municipality or a university;
• a group that acts under a name of its own, such as a community network.

What it has to prove depends on whether it is entered in a register, as set out below.

When you create an organisation, you give its name, a handle, its kind (company, association, community network or other), its country and the domain it is to verify. The handle appears in public records. Whoever creates the organisation becomes its owner. Create an organisation only for one that you may act for.

Why an organisation is verified

Only a verified organisation can hold resources in the registries or a seat on a council. An organisation that is not verified can be created, but it cannot request names, addresses or ASNs. Its verified name and country are also what sanctions screening checks, as the GOpenCSR terms describe.

Proof by DNS

Every organisation proves that it controls a domain. GOpenCSR shows the record to add, with the organisation's identifier in it:

_gopencsr.<domain>. 3600 IN TXT "gopencsr-verify=o_<id>"

Add it to the zone of that domain at your DNS provider. GOpenCSR looks for the record about every 5 minutes, and you can ask for a check at any time. A new record can take up to an hour to be visible everywhere, so allow for that. The record must carry exactly the value shown; a record with another value is refused. The domain is verified as soon as the record is found, and the method and the date are recorded. From then on, the record is checked again every day.

Proof from a register

A registered entity, that is a company, a registered association or a cooperative, needs both proofs: the DNS proof above and an extract from its register, which is the commercial register, the register of associations, the register of cooperatives or the equivalent register in another country. Upload the extract as a PDF, and name the register court and the register number.

A person at Tier 0 checks:

• that the name in the extract is the organisation's name;
• the register court and the register number;
• that the person acting may act for the organisation, because the extract names them as entitled to represent it, or because someone it names has authorised them.

If any of this cannot be confirmed, the organisation is not verified on that evidence, and you are told why. Unregistered groups and public bodies need only the DNS proof.

What is published

About a verified organisation, anyone can see:

• its name and its handle;
• its verified domain, with the method and the date of verification;
• what it holds in GOpenCDR and GOpenCNR;
• its council seats, each with its representative;
• its abuse relay address.

The register extract, the register court and number, the organisation's people other than a seat's representative, and its admin and tech contacts are not published. The admin and tech contacts are seen only by Tier 0 and are redacted in RDAP. A person who holds resources as themselves shows only a handle and the abuse relay address.

Keeping the record true

• A change of name is made in the organisation and, for an organisation entered in a register, shown with a new extract.
• A new domain is verified in the same way as the first.
• Keep the TXT record in place for as long as the organisation is verified; it is checked every day. If the record or the domain is gone for 30 days, the organisation's profile shows "not verified". What it holds keeps working, but it obtains no new resources until it is verified again.
• If the organisation ends, for example because it is dissolved or struck from its register, an owner tells us, and what it holds is transferred or released as each registry's terms allow.
• If verification rested on false information, it is withdrawn, and the acceptable use policy applies to whoever gave it.

How long the evidence is kept

The uploaded register extract is kept while the organisation is verified and for 12 months after. The method and the date of verification, the register court and number, and the outcome of each check are kept for the same time. Then they are deleted.

Everything else

Verification is free of charge. What the GOpenCSR terms and the general terms of service say about liability, the governing law and changes applies here: a material change is emailed at least six weeks before it takes effect, and it applies to you only once you accept it at a sign-in, as the GOpenCSR terms set out under "Changes to these terms". Every version is kept in the document archive.