I just watched an informative talk from 36C3 by Julian Oliver: https://media.ccc.de/v/36c3-11008-server_infrastructure_for_global_rebellion
At around minute 28 he begins talking about the specific server software, datacenter hosting, and other aspects of their operational security implementation. This description goes to around minute 44, and then there is some Q&A that is also quite informative. Nobody asked him why they didn't use TOR -- presumably it wasn't even a contender. For sysadmin activity they use VPNs to countries with strict data protection laws (Switzerland and Iceland are mentioned). Data partitions are encrypted, and they have various contingency plans in the event a server is seized. At around minute 34, there is a list of the different software choices they made to support Extinction Rebellion. They chose alternatives to Slack, Google, Mailchimp, Zoom, etc. Some were found to be better than the better-known alternatives, and some were worse, for performance, scalability and usability. He mentioned that modern users are looking for something like a Google-based single sign-on, which is anathema to the anti-surveillance infrastructure they are focusing on. The software and configuration choices are today's best-of-breed for making surveillance and seizure more difficult. This naturally includes not utilizing commercial solutions, and also naturally includes self-hosting the infrastructure. ER is a global movement that is highly decentralized and, according to the first 28 minutes of the talk, is having an impact. This is primarily through non-violent actions. They mainly seek progress on combating climate change. https://rebellion.global or https://organize.earth for more info.
