It's a good question. I've been in touch with Maxmind's legal team before and they were happy with what we were doing, but that was before we had started building out our custom data.

My thoughts are:

1) We're not modifying the maxmind DB. We download their MMDB file and leave it completely untouched. Our code basically does something like this:

    if ip in custom_db
        return custom_db[ip]
    else
        return maxmind_db[ip]

2) Our database is openly available via our API. Anyone can access it without needing to signup etc.

They're the principles I've been operating under, but I'm not a lawyer, and I'll definitely go consult with one to get a definitive answer on where I stand with this. If it turns out that we're not meeting the license terms then we'll certainly make whatever changes necessary to ensure we do.

That's one of the raw sources that go into the network data. There's also the routing tables (without which you can't always match ASNs to netblocks), other datasets, and a bunch of custom scripts that post-process the data, performing cleanup, heuristic matching and more. And then putting it all into a data format that supports handling 250 million requests a day, and serving over 90% of them in less than 10ms.