Thnkrr — Moderation Stack: Verified Research and Recommended Decisions

What this document is: the verification pass the founder's redlined page (docs/17) asked for. Five parallel research passes on 2026-09-19 checked every load-bearing claim in docs/15 §9's "Not verified" list plus the founder's new asks: Safer Predict, the Anthropic/OpenAI age terms, self-hosting gpt-oss-safeguard, TAKE IT DOWN, the NCMEC process, and review-queue SLAs. [Primary] = the source's own page/statute/report was read directly; [Reported] = secondary source or search excerpt. Dates of access: 2026-09-19 throughout.

This document feeds docs/15 §7 step 3a (the bake-off), docs/15 §8 (decisions needing an owner), and becomes D- entries in docs/07 once the founder signs off. It corrects two premises: the founder's self-hosting rationale (§3) and the assumption that NCMEC reporting covers India (§5.3).

Contents

1. The recommended stack — what we will use
2. The grooming gate: Thorn Safer Predict vs Hive
3. The general model: Bedrock changes the self-hosting answer
4. Provider terms for minors — the verdicts
5. Statutory duties — what must be built before the pilot
6. Human review: SLAs, staffing, wellbeing
7. The bake-off protocol
8. What this changes in docs/15
9. Still not verified
10. Images: avatars and banners (added 2026-09-21)

1. The recommended stack — what we will use

Built from the verified evidence below. Items marked (bake-off) are still chosen by docs/15 §7 step 3a's test, per the founder's "test before trusting"; items marked (quote) need a sales conversation the founder can start today.

The critical-path consequence (docs/17): the guardian consent notice names whoever screens students' writing. On this stack the notice names AWS (already named for hosting) plus, when the grooming layer lands, Thorn or Hive — and OpenAI Moderation if the bake-off keeps it. That list can be written into the privacy notice as soon as the bake-off and one grooming-vendor conversation conclude.

2. The grooming gate: Thorn Safer Predict vs Hive

The founder's one launch-holding item: conversation-level review + a grooming-specific model before mentors talk to students. Verified 2026-09-19:

2.1 Thorn Safer Predict (text)

• The founder's claims check out. Conversation-context analysis with per-message scores that route conversations to review [Primary]; current labels: CSAM, Child access, Sextortion, Self-generated CSAM, CSA discussion, Grooming [Primary] ("has-minor" appeared in the beta write-up; current status unconfirmed).
• Self-hosted deployment is genuinely offered ("self-hosted (integrated into your infrastructure) or Thorn-hosted (API-based)") [Primary]; packaging (container/K8s) not published.
• Languages: English + Spanish only. No Hindi/Hinglish [Primary] — a monitored gap for Indian schools; human review covers it.
• Engagement: Thorn talks to "any company", no minimum platform size [Primary]. Partnership criteria require adherence to national CSAM reporting mandates (we're building that, §5.2). Pricing quote-only; the one public anchor is the AWS Marketplace Safer Enterprise listing: 1M queries = $45,384/yr [Primary] — that's the self-hosted Enterprise bundle, likely out of pilot budget; the Thorn-hosted API tier is the realistic path. Data terms (DPA, retention, no-training) sit behind a Master NDA (trust.thorn.org) [Primary that it's gated].
• Adoption: 86+ platforms; X was the text-classifier beta partner; 318.6M lines of text processed in 2025 [Primary].

2.2 Hive (the one-vendor alternative)

• Hive's CSE Text Classifier carries Thorn's models: launched 2025-07-21 with seven labels, Thorn's grooming label added 2026-04-07 [Primary]. English + Spanish.
• "Conversation-level" is unverified for Hive's API: the documented input is a single ≤1024-char text sequence; no public multi-message input exists (CSE docs are gated). Treat as the deciding sales question — if Hive's answer is "single messages only, window them yourself", Thorn direct is the fallback.
• General text moderation: severity 0–3, self-serve, $0.50/1k requests, ~100ms latency claim, default retention 14 days, adjustable to zero on request [Primary].
• Two contract flags [Primary, Hive ToU]: (a) a licence to use customer content "for purposes of providing, developing and improving Hive Services" — must be struck or limited in the DPA (docs/15 gap #15); (b) customers must have verifiable parental consent under COPPA before submitting content involving minors — Thnkrr's consent flow (docs/14) must be live before student text flows to Hive.

2.3 Nobody else qualifies today

Roblox Sentinel is an Apache-2.0 library without grooming weights — you supply labelled conversations; viable later as a defence-in-depth layer trained on our own review decisions, not as the launch-gating model [Primary]. Alice (ex-ActiveFence/ Spectrum) and SafetyKit are enterprise demo-gated with unverified conversation-level claims; Musubi has no verified grooming model; academic models are 2012-era decoy-chat research [Primary/Reported]. Modern grooming corpora don't exist publicly (§7).

2.4 The outreach asks (founder can send these today)

To Thorn (safer.io demo form / aws-sales@getsafer.io): input unit — full conversation array with speakers/timestamps, or per-line only? API spec + p99 latency (we screen pre-delivery, fail-closed). Is the TEXT classifier available self-hosted, in what form? Thorn-hosted: retention, training, DPA naming Thorn as sub-processor for school agreements? Pilot-volume pricing; can an AWS Marketplace private offer apply (we hold credits)? Hindi/Hinglish roadmap. MNDA + Trust Center access. Image add (2026-09-21): quote Safer Match + the image classifier in the same contract — avatars/banners only, ≈5k images at signup then hundreds/month; Safer Essential lists at $30,720/yr for 1M queries/month [Primary — AWS Marketplace], far above our volume, so ask for pilot terms covering text + image together (§10.2).

To Hive (sales@thehive.ai): CSE + grooming label access, timeline, pilot pricing — usage-based? How does the grooming model consume conversation context, exactly? Zero-retention in writing; strike the "improving Hive Services" licence; DPA + sub-processor list. Confirm our school+parental consent flow satisfies the ToU's verifiable-parental-consent requirement. Latency SLO. Language roadmap. Image add (2026-09-21): pricing and access path for the Combined CSAM Detection API (hash + classifier, Thorn tech; Enterprise-only per the docs [Primary]) — is there a pilot-scale tier?

3. The general model: Bedrock changes the self-hosting answer

The founder asked for a serious look at self-hosting gpt-oss-safeguard, reasoning that only self-hosting keeps students' writing away from third parties. The premise turns out to be false once hosting is on AWS — and the numbers are lopsided.

3.1 The finding

Amazon Bedrock serves openai.gpt-oss-safeguard-20b directly (since 2025-10-29; 14 regions including us-east-1 and ap-south-1 Mumbai) [Primary], with:

• Zero data retention and zero operator access by default ("by default, Amazon Bedrock does not store model inputs or outputs") [Primary — AWS abuse-detection doc]; gpt-oss-safeguard is not on the list of models requiring retention, and its model card lists abuse detection as not applied [Primary].
• An account-wide data_retention_mode: none, enforceable with an SCP so nobody can loosen it; models that would require retention are then blocked, not silently retained [Primary].
• Model-provider isolation: "model providers don't have access… to customer prompts and completions" [Primary] — OpenAI never sees anything.
• No training on inputs/outputs by AWS or providers [Primary].

Since the app and database are moving to AWS (docs/18), Bedrock is the same processor already in the privacy notice. Using it adds zero new third parties — exactly the founder's goal, without a GPU. Only a non-AWS host (Groq, RunPod, Hetzner) adds a processor.

3.2 The numbers (monthly, at ~36M in / 9M out tokens)

Lightsail has no GPU option [Primary]; self-hosting means EC2. At pilot volume the GPU sits >99% idle and costs ~100–135× Bedrock. The credits buy the GPU under a year; they cover Bedrock usage indefinitely and stay earmarked for the Lightsail migration.

3.3 Model quality and configuration

• Keep the 20B: it matches the 120B on published classification benchmarks (F1 82.9 vs 82.9 on OpenAI Mod 2022; 79.9 vs 79.3 ToxicChat) and beats gpt-5-thinking [Primary — OpenAI technical report, 2025-10-29].
• OpenAI's own stated limits [Primary]: dedicated classifiers trained on tens of thousands of labels can still win on complex risks, and the model is compute-heavy — OpenAI itself pre-filters with small classifiers and sometimes runs it async. It is a screener feeding human review, not an oracle. No teen/grooming classification accuracy has been published by anyone.
• Policy format [Primary — OpenAI cookbook]: INSTRUCTIONS/DEFINITIONS/CRITERIA/EXAMPLES, optimal 400–600 tokens — our ~900-token policy should be trimmed or split per category. A reusable teen-safety policy pack ships with the cookbook. Reasoning effort: medium buys most of the gain; lower effort rather than capping output tokens.
• The one open risk is latency: the only Bedrock measurement is base gpt-oss-20b at 10k-token inputs (TTFT ~20s, P50) [Reported]; our ~1.4k-token requests should be far faster but nobody has measured the safeguard variant. Gate adoption on one week of our own benchmarking; the Priority tier (+75%, still <$8/month) is the fallback, then the human queue (fail-closed already absorbs an outage: ~80–100 items/hour).

Recommended setup: Bedrock us-east-1 primary → us-east-2 client-side failover → human queue; ap-south-1 if India data residency is ever required; retention mode none

• SCP; binary-or-JSON output at low/medium effort.

4. Provider terms for minors — the verdicts

The founder asked for "the same read on Anthropic." Verified 2026-09-19:

India (DPDP Act): §9 requires verifiable parental consent for any processing of a child's (under-18) personal data and bans tracking/behavioural monitoring of children [Primary — statute text]; children's provisions reported enforceable 13 May 2027 [Reported]. Student free text must be assumed to contain personal data even with names stripped. Bedrock's Mumbai region supports in-country processing if asked [Primary].

5. Statutory duties — what must be built before the pilot

Full build checklists with statute citations live in the research record; this is the build-facing summary. A cross-cutting finding that changes the build: India amended IT Rules 3(2)(b) in Feb 2026 — the NCII takedown clock on complaint is now 2 HOURS, not 24 [Primary — MeitY consolidated rules, G.S.R. 120(E)]. One takedown pipeline built to the 2-hour clock satisfies the US 48-hour duty automatically.

5.1 TAKE IT DOWN Act (NCII removal) — build the dedicated flow

Working assumption (counsel to confirm): Thnkrr is a covered platform — the FTC reads the definition broadly ("social media, messaging, image or video sharing…") [Primary], its first warning letters (2026-05-20) went to services with no removal process at all [Primary], and any user can complain at TakeItDown.ftc.gov. Penalty: $53,088/violation, FTC-stated [Primary].

Build (before pilot):

• Public page /remove-intimate-image, usable logged-out, plain language, linked from footer, login page, safety page and every report menu; teen reading level, English + Hindi.
• Form mirrors §3(a)(1)(B): requester name + role (self / parent-guardian / authorized), contact, content locator, good-faith non-consent statement, electronic signature (typed name + date, stored with IP/UA). No government ID demanded.
• Clocks: validity triage ≤2h; removal ≤2h internal target (India's mandatory clock; US statutory max 48h), received_at on submission, request ID + confirmation
  • status updates to the requester.
• Identical copies: hash every image at ingest (cryptographic + perceptual); on removal, sweep stored media for matches and add to an upload-time blocklist.
• When in doubt, remove: §3(a)(4) gives good-faith-removal immunity; refusal is the risky path. Immutable audit log per request, retained ≥3 years.
• On Thnkrr every user is a minor, so almost any NCII request is also apparent CSAM → the flow auto-opens the NCMEC lane (§5.2). Removal takes it off the surface; preservation keeps the evidence — they are not in conflict.

5.2 NCMEC CyberTipline (18 U.S.C. §2258A, as amended by the REPORT Act 2024)

Verified corrections to docs/15 §3.8's basis:

• Preservation is now 1 YEAR after submission (was 90 days), in a secure store with limited access and NIST-CSF-aligned security [Primary — statute text].
• Text-only grooming/enticement (§2422(b)) and minor sex trafficking (§1591) are now mandatory-reportable — the duty is broader than images, which matters for a text-screening platform [Primary].
• Penalties for knowing/willful failure at our size (<100M MAU): $600k first / $850k subsequent [Primary].
• §2258B makes the CyberTipline the only legally protected channel for handling CSAM: staff never re-transmit content to schools, parents, police or anyone else; tickets carry references and hashes, never media.
• Registration is concrete: esp.ncmec.org/registration → credentials → REST API with a test environment (exttest.cybertip.org/ispws). 1,600+ ESPs are registered including small ones; no minimum size found. Submit registration this month, pre-pilot; ask NCMEC about onboarding timeline and Take It Down hash-list participation in the same conversation.
• Internal SLA (judgment call, counsel to bless): human confirmation ≤4h of a CSAM/enticement flag; CyberTipline submission ≤24h of confirmation; queue alarm on any CSAM-suspect item older than 4h.
• Two named handlers only; blurred-by-default viewer, no export, all access logged; written one-page runbook (detect → quarantine → confirm → file → preserve 1yr → India dual-file → account action → log).

5.3 India: NCMEC does NOT discharge POCSO

• The Supreme Court held it explicitly (Just Rights for Children Alliance v. S. Harish, 2024): reporting to an NGO cannot absolve platforms of POCSO §21 liability, and non-compliance forfeits IT Act §79 safe harbour [Primary — judgment text]. Every CSAM case involving an Indian child is dual-filed: CyberTipline AND local police/SJPU + cybercrime.gov.in.
• POCSO §19/§21: any person with knowledge must report; a person in charge of a company who fails to report a subordinate's finding faces up to 1 year — personal criminal exposure for the founder; name the filer in the runbook [Primary].
• IT Rules 2021 (no size floor): published Grievance Officer (name + contact, prominent), 24h acknowledgment, 72h resolution for removal-type complaints; NCII/ impersonation (incl. morphed images) takedown 2h from complaint (§5 header); info to authorities within 72h of lawful order; ToS must mirror Rule 3(1)(b) categories [Primary]. Rule 4's SSMI duties don't apply below 5M Indian users [Primary].

5.4 Crisis lines — two corrections to the redlined page

• US: 988 call/text + chat.988lifeline.org (+ Crisis Text Line: HOME to 741741). The LGBTQ+ "Press 3" option was discontinued 2025-07-17 — do not display it [Primary — SAMHSA]; optionally list The Trevor Project.
• India: Tele-MANAS 14416 / 1800-891-4416, 24/7, 20 languages [Primary — PIB]. KIRAN has been merged into Tele-MANAS — do not list it.
• Display practice (SAMHSA toolkit, #chatsafe, platform patterns): supportive non-punitive card to the author on any self-harm flag, whether or not the item is held (the founder's decision, docs/17); tap-to-call links; no method details; a "worried about someone?" variant for reporters; quarterly number re-verification.

6. Human review: SLAs, staffing, wellbeing

The honest headline: no regulator or framework publishes a numeric SLA for a proactive-review queue. Every legislated clock is complaint-triggered (India 2h/24h/ 72h, eSafety 24h, EU TCO 1h). The numbers below are therefore commitments we choose, anchored where anchors exist — which answers docs/15 §9's caveat that §3.6's SLAs were proposals.

Anchors: Snap publishes measured medians (self-harm 18 min, CSE 37 min, bullying 13 min — US H2 2024) [Primary]; Discord publishes the only youth-platform commitment ("high harm… within 24 to 48 hours") [Primary]; Roblox's EU filing shows a 10-minute median on illegal-content notices [Primary].

On-call model: named primary + named backup, scheduled against the US and India school days (near-continuous coverage between the two); imminent-harm pages outside coverage; supervised signup sessions only while a reviewer is on shift; AI outage = publication freeze (already fail-closed) + both reviewers activated.

Staffing math (no published text-only figure; replace with week-1 measurement): at ~10–20s/item, the steady human slice (5–15% of 2,000/day) is 1–3 reviewer-hours/day. The binding constraint is surge: a 300-item signup dump ≈ 1.5–2.5h; a full AI outage ≈ 10–17h/day — which is why outage mode is "freeze + both reviewers", not heroics.

Wellbeing minimums (grounded in the Tech Coalition resilience guidebook, DTSP, TSPA, CHI 2021; non-optional even for a one-person queue): written pre-hire exposure disclosure; licensed-counselor access from day 1; click-to-reveal masking (already in docs/15) and blur-by-default for imagery; ≤~2h continuous queue work with rotation; a named second person on any CSAM/enticement case (escalation + welfare); the NCMEC runbook so nobody improvises under stress. No evidence-based daily exposure cap exists — the literature says so explicitly.

Enforcement ladder: docs/15 §3.7's education-first ladder matches the only published youth-platform philosophy (Discord: severity-weighted, ~90-day expiry, warnings-first for teens, first-offence permanent ban + NCMEC report for adult grooming/sextortion) [Primary]. No platform publishes parent/school notification practice — Thnkrr's school-visibility choice has no precedent to copy; it's a contract/counsel decision (docs/15 §8 #7).

7. The bake-off protocol

Methodology to copy: OpenAI's moderation-classifier paper (Markov et al., AAAI 2023 — active learning, hard negatives, public data as noisy seed only), the gpt-oss-safeguard policy guide, HateCheck/XSTest functional suites, and the Llama Guard comparison-table format with its cross-taxonomy caveat [all Primary].

1. Policies (1–2 days): one 400–600-token policy per category (Instructions/ Definitions/Criteria/4–6 borderline examples) + a vendor-taxonomy mapping table; "not covered" is a result, not a test gap.
2. Set construction (~2,500–4,000 items): ≥100 positives/category (±10% CI at 95% confidence; 200+ for grooming, sexual/minors-adjacent, self-harm); ≥1,000 benign teen-register items for the wrong-block rate — career goals, banter, dark humour, sex-ed questions, identity self-reference, mental-health self-disclosure, in US teen voice and Hinglish. Public seeds ≤30–50%; the decisive half is written in-house. Seed datasets and licences are catalogued in the research record; the verified negatives matter most: no lawful CSAM text corpus exists (do not attempt one); no public dataset exists for drugs, contact-exchange, impersonation, or modern grooming (PAN12-era corpora are 2006–2012 adult decoys — sanity checks only).
3. Obfuscation lane: generate variants of our own positives — TextAttack DeepWordBug/TextBugger, UTS#39 confusables, zero-width insertion, emoji substitution, spelled-out/leet digits.
4. Label QA: written guidelines, two labelers where possible, calibration sessions, audits of positive-labelled samples (accuracy on negatives is meaningless at these base rates).
5. Run the same items through OpenAI Moderation, Hive, Claude-with-policy, Bedrock gpt-oss-safeguard, and Thorn (grooming lanes) if access lands; record raw scores, mapped verdicts, client-side latency p50/p95, $/1k.
6. Report per category: precision/recall at the operating threshold, AUPRC, FPR on the benign set, obfuscated-vs-clean recall delta, Hinglish-slice recall, functional suite scores. Differences inside the confidence interval are ties.
7. Thresholds: fix a precision/FPR budget per action, then compare recall (Hyperconnect's published pattern). Suggested budgets: auto-reject ≥0.95 precision; child-safety categories tuned for recall (a false positive costs minutes in the human lane, not speech); self_harm and grooming never auto-resolve.
8. Shadow mode: store the runner-up's verdict in model_verdict.shadow on live traffic (docs/15 §5.6). Size the window by positives needed, not calendar: rare lanes need ~3–6 weeks at pilot volume; common lanes converge in days.
9. Decision rule, in order: compliance gate (retention/training/minors terms) → child-safety recall at fixed FPR → benign FPR → obfuscation robustness → latency and cost as tie-breakers. A stack, not a single winner, is the published pattern: cheap fast classifier on everything + policy reasoner on the uncertain band — which is what §1 recommends.

8. What this changes in docs/15

9. Still not verified

Rolled up from all five passes: Thorn's API spec/latency and text-mode data flow when self-hosted (MNDA-gated); Hive CSE conversation-array input (gated docs); whether "has-minor" is still a current Safer Predict label; any latency measurement of the safeguard variant on Bedrock/Groq (base-model numbers only — hence the benchmark gate); any teen/grooming classification-accuracy evaluation by anyone; any production adopter of gpt-oss-safeguard; TIDA's "publish"/private-message scope (undefined per CRS); NCMEC ESP vetting steps/timeline for a pre-launch platform; POCSO Rules Rule 11 exact wording (image-scan gazette) and the extraterritorial reach of Indian duties; DPDP children's-provision commencement (13 May 2027 is [Reported]); OpenAI's usage policy page itself (Cloudflare-blocked; child-safety text is [Reported]); Groq's Services Agreement no-training text; the 988 "Press 3" restoration ("end of 2026", [Reported]); $53,088 adjusts annually in January.

10. Images: avatars and banners (added 2026-09-21)

The founder's September revision asks whether profile photos and banners are shipping. They are: avatar (2MB) + banner are the only uploads in the product (docs/06 §12), and the pipeline is already built and fail-closed — presigned PUT to a quarantine bucket, worker strips EXIF/GPS and resizes, and every image is staged for human review before it can attach to a profile (src/modules/media/service.ts). Three research passes on 2026-09-21 (same [Primary]/[Reported] convention, access date 2026-09-21 throughout) scoped what to add: an AI pre-screen, text-in-image detection, the CSAM layer, and the image-specific legal deltas. Hard constraint from docs/06/12: no facial analysis, no biometrics, anywhere — including inside a vendor's pipeline.

10.1 Where the build already stands vs the industry

Pre-publication review of every profile image exceeds mainstream published practice. Only two platforms publish anything comparable: Yubo ("all profiles are reviewed", 22M+ profile pictures checked) [Reported — site firewalled; search-excerpted from yubo.live] and Roblox (uploaded images "go through a multi-step review process before appearing", marketplace pre-review "up to 24 hours" [Primary — create.roblox.com]) — that 24h is the only published pre-review latency benchmark; set ours at or under it. LinkedIn, Discord, and Instagram all moderate avatars post-hoc [Primary/Reported]. Discord's rule that profile surfaces get the strictest content standard because they cannot be age-gated [Primary] maps exactly to our avatars/banners. This is a differentiator to state in school-facing safety docs — with sources.

10.2 The recommended image stack

The prerequisite that cannot slip: Rekognition "may store and use image and video inputs processed by the service … unless you opt out … to improve and develop the quality of Amazon Rekognition and other Amazon machine-learning/artificial-intelligence technologies" [Primary — Rekognition FAQ]. The AWS Organizations AI-services opt-out policy reverses this account-wide and "deletes all of the associated historical content" [Primary — Organizations doc]. It must be applied before the first student image is processed — otherwise student avatars can be retained to improve AWS AI, possibly out-of-region, contradicting the notice. Same enforcement pattern as §3's SCP.

Costs (at ≈5,000 images in the signup surge, ≈300/month after): Rekognition moderation + text $1.00/1k each [Primary] ≈ $10 month one, ~$0.60/month steady; Nova Lite ≈$0.0002/image [token counts Primary — AWS Nova doc; $/MTok Reported] — under $1 total. ≈$11 month one, then <$2/month, all inside the credit-covered AWS account. Latency: DetectModerationLabels is synchronous, 50 TPS us-east-1 / 5 TPS ap-south-1 [Primary]; both APIs available in Mumbai if residency is ever required [Primary].

10.3 The options that lost, and why

• Azure AI Content Safety — the runner-up. The best data terms of any vendor: "No input texts or images are stored … not used to train" and "not stored or made available for human review" [Primary — Microsoft data-privacy doc], in-region (eastus/southindia), K-12 filtering is a documented first-class use case [Primary], and the F0 free tier (5k images/month) covers the pilot. Loses on taxonomy — only sexual/violence/hate/self-harm severities, no drugs, weapons, gambling, or specific hate-symbol classes, and no OCR — so it would sit beside Rekognition DetectText anyway, adding a second cloud without removing an AWS component. Pick it only if the Rekognition opt-out posture is ever judged unacceptable.
• OpenAI omni-moderation (images): free and zero-retention on /v1/moderations [Primary], but images are scored only for sexual/violence/self-harm — hate, illicit, and sexual/minors are text-only categories [Primary — OpenAI moderation guide], and there's no OCR. Usable as a free cross-check, not a primary.
• Hive visual: the most granular taxonomy (5 domains, 26+ sexual heads, hate imagery, moderation-grade OCR) [Primary], $3.00/1k + $1.50/1k OCR, retention adjustable to zero on request [Primary] — but a new non-AWS third party at ~2× Rekognition's price for 300 images/month. Enters only if the text bake-off already picks Hive.
• Google SafeSearch: the under-18 ban lives in the Gemini API terms, not Google Cloud's — Cloud Vision is contractually usable [Primary — both terms read directly; corrects a possible over-generalisation of docs/17's "Google is out"]. Capability is what kills it: five coarse scores, no hate/drugs/weapons.
• Sightengine — avoid. Its "minor detection" is explicitly face-based age estimation ("determined solely using the face" [Primary]) — the platform's core offering conflicts with the no-biometrics commitment even if we never enable it.
• Self-hosted (NudeNet/OpenNSFW2/Falconsai): nudity-only — no gore, hate symbols, drugs, weapons, or OCR; NudeNet is AGPL-3.0 and outputs FACE_FEMALE/FACE_MALE detection classes [Primary — GitHub], an avoidable argument about the no-face-analysis claim. Compute isn't the blocker; coverage and accountability are.
• Cloudflare CSAM Scanning Tool: now free for any customer without NCMEC credentials [Primary — Cloudflare blog 2025-09-24], but it scans content being served from cache — post-publication, wrong shape for a fail-closed ingest gate, and we're on CloudFront, not Cloudflare.
• Rekognition is not a CSAM detector — its docs disclaim it explicitly ("don't detect whether an image includes illegal content, such as CSAM" [Primary]), and AWS has no native equivalent; hence the dedicated CSAM layer below.
• Bedrock Guardrails image filters ($0.00075/image, 4 categories, GA us-east-1) [Primary] — a cheap supplement if ever needed, not a replacement.

10.4 The CSAM layer for images

Industry standard confirmed: hash-match (known CSAM) + classifier (novel) + human review is how Thorn, Google, and the Tech Coalition all describe the complete stack [Primary/Reported] — at our volume, at ingest, it's proportionate; anything more is redundant. The four free applications, and the trade-off between the first two:

• PhotoDNA Cloud Service (Microsoft): free for qualified organizations, REST API, vetted application; "your images are instantly converted to secure hashes and are never retained by Microsoft"; "PhotoDNA is not facial recognition software" [all Primary — microsoft.com/photodna]. It also provides an NCMEC-reporting API that dovetails with this month's CyberTipline registration [Primary]. The one cost: image bytes go to Microsoft — a new named processor in the privacy notice (zero retention, but named).
• NCMEC hash-sharing + local PDQ matching — the zero-new-processor route. NCMEC shares 12.1M+ triple-verified hashes with 78 ESPs, and its Hash Sharing API serves PDQ format [Primary — lesp.ncmec.org] — which our TAKE IT DOWN ingest hashing (§5.1) can match locally, so no image ever leaves our infrastructure. Access is a discretionary credential grant on the ESP relationship (no published criteria); ask in the registration conversation this month, alongside Take It Down hash-list participation (contact: TakeItDown@ncmec.org [Primary]; Meta/Yubo/OnlyFans participate [Reported]). Meta's open-source HMA matcher is "ready-to-deploy … for AWS" [Primary — GitHub] if we want the matching machinery pre-built.
• IWF Image Intercept: free under 1M checks/month, checks every upload against IWF's database using PhotoDNA + cryptographic hashing, application-gated [Primary — iwf.org.uk]. Shield by Project Arachnid (C3P): free API on request [Primary]. Three independent hash ecosystems (US/UK/Canada) for a US+India platform.
• Classifier: Thorn's Safer Predict image classifier — same product family as the text CSE work, deployable self-hosted or Thorn-hosted [Primary]; new price anchor: Safer Essential $30,720/yr at 1M queries/month [Primary — AWS Marketplace], wildly oversized for our volume → pilot-terms ask now in the §2.4 Thorn email. Small-platform precedent: Bluesky has used Safer since 2023 [Primary — safer.io]. Fallback: Google Content Safety API — free, application-gated, teen-platform precedent (Yubo), but no public case of a pre-launch platform being approved.

10.5 Legal deltas for minors' images — the verdicts

• COPPA: a photograph is "personal information" only for under-13s [Primary — 16 CFR 312.2]; the 2025 amendments kept that line and added faceprints/facial templates as biometric identifiers [Primary]. Our 13+ neutral age gate keeps avatars outside COPPA unless we gain actual knowledge of an under-13 user (then: existing delete flow). Policy addition for the reviewer rubric: no third-party minors in avatars — not a COPPA trigger, but the review queue enforces it anyway.
• BIPA/CUBI — content moderation is not biometric collection, on the settled reading. BIPA's identifiers are things that "can be used to identify a person"; "biometric identifiers do not include photographs" [Primary — statute as quoted in Zellmer v. Meta, 9th Cir. 2024: face signatures that "cannot identify … are not biometric identifiers"]. The liability line is crossed when a faceprint/template is computed from a photo (Sosa v. Onfido, ~$28.5M; the Rivera/Shutterfly line) [Reported] — and vendors are directly liable. Consequences: (a) the moderation endpoint must never compute face geometry/embeddings/attributes — Rekognition's moderation + text responses contain no face fields [Primary — API reference], and the face APIs are IAM-denied; (b) the DPA must bind the vendor to the same and carry an audit right; (c) keep the vendor's pipeline documentation on file — Zellmer was won on technical evidence. Texas CUBI: AG-enforced, $25k/violation, and the most aggressive enforcer in the country ($1.4B Meta settlement) [Primary/ Reported] — treat any Texas school as the risk ceiling. Restate the public commitment as: "neither Thnkrr nor any processor acting for it computes face geometry or facial attributes."
• POCSO Rule 11 — largely settles §9's open item. The Supreme Court's 2024 judgment characterizes it authoritatively: a report-and-hand-over duty on knowledge — report to SJPU/local police/cybercrime.gov.in AND "hand over the necessary material including the source" [Primary — Just Rights for Children Alliance v. S. Harish, para 255] — not a proactive scanning mandate (none found in any source). Build consequences: the flagged-avatar runbook preserves the image, uploader identity, and device/UA metadata for hand-over; the report clock starts at reviewer sighting; the §5.3 dual-filing rule applies to images unchanged. The gazette's exact sub-rule wording remains unread (scanned copies only) — but the question that mattered (scan duty or not) is answered.
• India DPDP: avatar + banner are a child's personal data, full stop — name them in the consent notice and deletion flows; nothing image-specific exists in the Act or Rules [Reported].
• US states: nothing photo-specific is in force for a 13+ service. Texas SCOPE Act: filtering duties still enjoined, but the age-registration provision is enforceable (5th Cir., July 2026) [Reported] — track if a pilot school is in Texas. Texas SB 2420 (app stores) is enforceable [Reported] but burdens app stores — relevant only if a native app ships.
• The avatar-likeness policy: verifying "this photo is really you" without face analysis is impossible — every real verifier (Tinder FaceMap, Yubo/Yoti) is biometric [Reported]. The only face-analysis-free model at scale is LinkedIn's: "your profile photo must reflect your likeness", enforced by removal, with a published removal taxonomy (logos, emojis, landscapes, animals, text, flags, baby photos, others' likenesses) [Primary]. Adopt that taxonomy nearly verbatim for the reviewer rubric — amended by docs/06 §12's stricter "real photography or nothing" (LinkedIn allows self-illustrations; we don't). Initials fallback stays first-class; teen platforms deliberately don't force real-face avatars.

10.6 What this changes elsewhere

10.7 Still not verified (images)

PhotoDNA Cloud's free-tier transaction cap (no number published); NCMEC hash-sharing eligibility criteria and Take It Down onboarding (contact-email only); whether AWS promotional credits apply to Marketplace SaaS (Safer Essential); Thorn pilot/nonprofit pricing below list; Hive CSAM API pricing (Contact Sales); IWF Image Intercept and Shield data flows (do image bytes leave our infra, or hashes only?); Google Content Safety API post-approval terms and pre-launch approval odds; Rekognition free-tier per-API scope and any latency SLO; Nova Lite Bedrock $/MTok from AWS's own page (JS-rendered; $0.06/$0.24 is [Reported]); Azure southindia S0 image meter; the POCSO Rule 11 gazette text itself; whether Hive trains on customer visual data; Yubo/Roblox claims (both sites firewalled — search-excerpted).

*When the founder signs off on §1, each row becomes a D- entry in docs/07, the bake-off (§7) starts, and the two vendor emails (§2.4) go out. The statutory builds in §5 do not wait for any of that. On §10 sign-off: the four free hash-list applications go out, the AI-services opt-out lands before any image processing, and the Rekognition

• Nova pre-screen is built behind the existing human queue.*