Thnkrr: Text Moderation — Industry Practice and Per-Surface Build Flows

Research document, 2026-09-15. Not a decision document — anything adopted from here becomes a D- entry in thnkrr-api/docs/07-decision-log.md.

It builds on, and does not restate, thnkrr-api docs/04 §7 (the pipeline), docs/10 (messaging), docs/12 (AI), docs/13 (cross-cutting) and decisions D-9 … D-65. Code references were verified against thnkrr-api main@8636bdb and thnkrr-web main@3b9823e. Nothing in either repository was changed.

Source tags: [Primary] the organisation's own publication, statute or regulator text · [Reported] press, secondary or search-summary source · [Analysis] inference. Research is not legal advice.

Contents

0. Summary · At a glance: what we use, for what, and where it runs
1. What is already settled
2. How the industry moderates text
3. The canonical flow every moderated surface implements
4. Per-surface flow cards
5. How to build a moderated surface
6. Verified gaps in the current build
7. Build sequence and schema impact
8. Decisions that need an owner
9. Not verified

0. Summary

• The timing is already stricter than the industry. Holding every item until it clears is stricter than LinkedIn, Roblox, Discord, Instagram or Xbox — only classroom tools (Seesaw, Padlet) hold by default. Structural limits on adult contact and undeletable messages also match best practice and the US preservation duty.
• The gap is context, severity, and flow completeness — not timing. Every serious child-safety stack adds, on top of a per-item filter: a conversation- or account-level pass for grooming, severity tiers with graduated enforcement, and a fast human/NCMEC lane. The build judges each item alone and gates on the model's self-reported confidence, which the research does not support for grooming or obfuscated contact details.
• Per-surface flows have holes the pipeline diagram hides. Verified in code: delayed human approvals deliver messages and comments without re-checking eligibility (blocked, disconnected, mentorship ended); profile text has no post-publication takedown (a user report's "Remove" is a no-op); self-harm holds show a generic "being checked" and the 988 line only appears after a human rejects; reviewers see no thread, parent post, or conversation kind; and nothing in the codebase ever sets suspended or banned.
• The legal duty is wider than docs/04 records. Since the REPORT Act (May 2024), 18 U.S.C. §2258A covers online enticement of a minor — a text-only harm — not only CSAM. A held, never-delivered message can still be a reportable attempt.
• Build shape: replace today's scattered per-surface branches (appliers, delivery hooks, flag routing, report branches, copy) with one surface definition per surface (§5), so every surface declares the same eleven concerns and nothing falls through.

At a glance: what we use, for what, and where it runs

Built = in the code today. Proposed = recommended in this document. The AI model provider is not decided. The code has one swappable connection point for it, and §2.4 compares the options by what the industry actually uses.

The parts

Which checks run on each surface

1. What is already settled (not reopened here)

The pre-send "reconsider" nudge is the one industry-standard pattern this design deliberately forgoes: it inherently reveals the trigger (docs/12 §3–4). The evidence is summarised in §2.3 for the record, not as a recommendation.

2. How the industry moderates text

2.1 LinkedIn

LinkedIn publishes one shared pipeline for all content; the only surface with a dedicated published model is private messaging.

The shared pipeline [Primary, DSA Systemic Risk Assessment, Aug 2025]: three layers — (1) at creation, ML services "filter out certain policy-violating content within 300 milliseconds of creation, meaning the content is visible only to the author"; (2) content "likely to be violative but for which the algorithm is not sufficiently confident" goes to human review; (3) member reports. Thresholds are set by risk: "For higher-risk content, LinkedIn prioritizes recall with lower thresholds… For lower-risk content, LinkedIn prioritizes precision" [Primary, DSA transparency report H1 2026]. Model scores feed a Drools rules engine whose actions are challenges, warnings, human queue or restriction [Primary, CASAL].

LinkedIn's headline automated precision (0.98) is computed as one minus the appeal-overturn share, so unappealed errors are invisible. [Analysis]

2.2 Platforms with large minor audiences

2.3 Cross-platform patterns

Industry-standard (≥3 platforms): structural limits on cold and adult contact before any text classification; request inboxes for first contact; recipient warnings driven by who the sender is; a fast per-item filter paired with a separate conversation/account-level grooming detector staffed by specialists; history-based graduated enforcement with visible standing.

The nudge evidence (recorded, not recommended): Twitter's RCT — 6% fewer offensive tweets (ICWSM 2022); Instagram — ~50% of warned comments edited/deleted; Nextdoor — 34% edited or withheld; OpenWeb/Perspective — secondary summaries report ~18% re-posting to test the filter. No published teen-specific effect size exists. Every platform that nudges does so only for incivility; PII, sexual content and grooming are blocked without explanation. [Primary/Reported]

2.4 Models, vendors, and what the industry actually uses

Checked 2026-09-15. "Adopted by" means a public statement that a platform uses the tool to moderate user content. Several vendor pages could only be read through search excerpts; those facts are tagged [Reported]. Prices are US$ per million input / output tokens unless stated.

What comparable platforms run

No public evidence was found for Duolingo, Quizlet, Brainly, Canva or Chegg.

What the evidence says

• There is no single industry-standard tool. The largest youth platforms build their own models, and those can't be bought.
• Platforms without large safety teams buy proven services: a general moderation classifier (OpenAI Moderation; Hive has the most named youth and social customers) and, for child exploitation, Thorn's Safer (80+ platforms — the most widely adopted tool for that harm).
• General AI models that follow a written policy are spreading, mostly through moderation vendors built on OpenAI (SafetyKit) or Google Gemini (Musubi). No youth or education platform has published which general model it calls directly.
• Open-weight guard models are emerging, not standard. gpt-oss-safeguard has the strongest backing (ROOST, tested by Discord) and no confirmed production user.
• No public adopter was found for moderating user content with Anthropic, Mistral, xAI or Cohere models. That measures adoption, not quality.

The building blocks, layer by layer

Layer 1 — deterministic rules, in our own code. Runs inside the Node API; nothing leaves our servers. No adoption data exists for libraries this small; these are the usual choices for each narrow job.

Layer 2 — hosted moderation classifiers. Ready-trained per-category scoring, usually one message at a time.

Layer 3 — general AI models that follow our written policy. This is what reads context: bullying aimed at a specific person, disguised contact exchange, grooming across a thread.

Hosted by the model's maker

Open-weight models — run on our own GPU, or on a host that keeps no data

Self-hosting means an inference server such as vLLM or SGLang (both Apache 2.0) on a rented GPU: roughly $358 a month for a RunPod L4 around the clock, or about €214 a month for a dedicated 24 GB Hetzner server [Reported]. At pilot volume (about 1.4 requests a minute) that GPU would sit more than 99% idle, while zero-retention hosts run the same open models for a few dollars a month. Hugging Face TGI is in maintenance mode.

Layer 4 — human review and rules infrastructure (open source).

Monthly model cost at pilot volume

Rough estimate for 2,000 items a day (about 36M input + 9M output tokens a month), before caching or batch discounts [Analysis]:

Provider terms that change the design

• Google's Gemini API terms exclude services likely to be used by under-18s, and Vertex AI is reportedly 18+ as well [Reported]. Using Gemini would need an explicit arrangement with Google.
• Meta's open-weight Muse Glimmer 30B usage policy says it is not intended for under-18s.
• Retention: OpenAI up to 30 days; Anthropic 30 days, with flagged content kept up to 2 years even under zero retention; Mistral 30 days, and its free tier trains on data. Groq, Fireworks, DeepInfra and Bedrock keep no data for open models by default.
• Blocking: Gemini always blocks child-safety content, including in what we send it; Azure's content filters are on by default; guard models are built to take harmful text. For every other provider, refusal on harmful input is unverified — the test set has to include it.
• Every service added receives student text and becomes a named sub-processor in school data agreements (§2.6).

Notes on the connector written today (Anthropic Claude)

• Opus 5 can return a refusal instead of a verdict; the connector already sends that item to a person.
• Structured output doesn't enforce the 0–1 confidence range; the code re-checks it and fails closed.
• The ~900-token policy prompt clears Opus 5's 512-token caching minimum.
• At low reasoning effort Opus 5 may skip reasoning entirely.
• Haiku 4.5, the cost lever named in docs/04 §7, is listed for retirement no sooner than 2026-10-15.

Can an AI model be trusted as the classifier?

Self-reported confidence is not a calibrated gate.

• Verbalised LLM confidence is overconfident; sampling-consistency helps but no method dominates [Primary, ICLR 2024]; verbalised confidence was only a weak error predictor (AUROC 0.522) [Reported, same].
• Guard models are badly miscalibrated across 12 benchmarks; temperature scaling and contextual calibration help [Primary, ICLR 2025].
• Meaning-preserving rewording of a safety policy flipped LLM-judge verdicts, 18–43% of flips on unambiguous cases [Primary, May 2026].
• Industry tools score severity, not confidence: Hive returns 0–3 per class, Azure Content Safety returns severity levels, Qwen3Guard grades Safe / Controversial / Unsafe, and Anthropic's moderation guide recommends 0–3 risk levels.

Adversarial text and injection. Universal appended phrases push LLM judges to maximum scores [Primary, EMNLP 2024]; zero-width characters, Unicode tags, homoglyphs and emoji smuggling evaded six guardrails with up to 100% success [Reported, 2025]; one injected invisible character significantly degrades commercial toxicity classifiers [Primary, IEEE S&P 2022]. Microsoft's "spotlighting" (delimit / datamark / encode untrusted text) cuts indirect-injection success sharply [Reported, 2024]. Classic classifiers (Layer 2) don't follow instructions, so injected text can't talk them into a verdict — but they are exposed to character-level tricks.

General models vs specialised classifiers. OpenAI says classifiers trained on tens of thousands of labels "can still outperform" its policy-reasoning model on complex risks [Reported, Oct 2025]. Zero- and few-shot LLMs underperformed fine-tuned encoders on real non-English data [Primary, May 2025]. On Gen Alpha slang the best model tested (an older Claude) recognised 42.3% of safety issues [Reported, FAccT 2025]. No current model has a published evaluation on teen DMs — the only real evidence will be a Thnkrr-labelled test set. [Analysis]

Context helps most where harm is conversation-shaped. Annotators without discussion context found 2.7× fewer violent-speech cases [Primary, 2022]; Roblox's PII classifier went from F1 63 to 90 with context; LLMs over-find grooming in harmless chats and are "led by the prompt to find non-existent risks" [Primary, 2024]; a turn-level grooming model reached 0.475 precision vs 0.047 for prior work, flagging in the first ~20% of a conversation [Primary, 2025].

The industry-standard stack at Thnkrr's size [Analysis]

Built only from the adoption evidence above:

1. Our own rules, using the standard libraries in Layer 1. Every platform has this layer.
2. A bought classifier for broad harms — OpenAI Moderation (free, used in education) or Hive (also covers contact details, off-platform redirection and child safety, with the most named youth customers).
3. A child-safety specialist for grooming and sextortion — Thorn Safer Predict, or Hive's Thorn-based grooming model. At pilot scale, layers 2 and 3 can be one vendor (Hive covers both).
4. A general AI model following our written policy, for context and nuance. Pick it by running the test set through a shortlist. The adoption evidence points to OpenAI models (used through moderation vendors) or the open-weight gpt-oss-safeguard on a zero-retention host. Google's API terms exclude us. Anthropic has no public moderation adopters but is already connected, so it stays on the shortlist and is judged on results.
5. People, working in our own review queue. Large platforms build their own; the open-source queues need far more infrastructure than our stack runs.

How the code supports it: the classifier connection (classifier.ts) is called once per item and returns one verdict, so a combined connector that calls layers 2–4 and merges their results fits behind it without changing the pipeline. Each service added is another company receiving student text, another sub-processor, and another test-set run.

2.5 Techniques for the hard parts

Conversation-level grooming and sextortion. Grooming (O'Connell's stages: friendship → relationship → risk assessment → exclusivity → sexual) uses the vocabulary of real mentoring in its early stages, so per-message judgement misses it. Sextortion looks different: rapid, scripted, often posing as a peer, pushing off-platform; 38% of reports with chat logs contained "ruin your life" threats [Primary, Thorn/NCMEC 2024]. Early-detection research scores sliding windows and only alerts when k of the last n windows are positive ("skepticism") [Primary, ACL 2021]. Benchmark numbers are inflated by decoy data; LLMs over-find risk. Production systems use these detectors as high-recall candidate generators for human investigators, never as enforcers (Sentinel README). [Primary/Analysis]

Obfuscation. Normalise before matching: strip zero-width/bidi/Unicode-tag characters (their presence is itself a signal); NFKC + casefold; TR39 confusable skeletons are for comparison, not display, and NFKC must run first; map leetspeak; collapse single-character spacing ("s n a p"); convert number words to digits; also match over the sender's recent messages joined, to catch splitting. Roblox's ML PII filter found 25% more PII with 30% fewer false positives than its rules. Evasion is not always malicious: algospeak grows from moderation perceived as unfair. [Primary/Reported]

Severity and enforcement. Ofcom's codes require a prioritisation policy weighing reach, severity (including harm to children) and likelihood of illegality, plus recorded speed and accuracy targets. Strikes that expire (YouTube 90 days, Xbox 6 months) and education-first first offences (YouTube's warning-plus-training; Discord's teen leniency; Meta restricting only from the seventh violation, with ~80% of low-strike users not reoffending in 60 days) are the norm; child exploitation is zero-tolerance everywhere. Explanations of removals correlate with fewer future removals, and bot explanations work as well as human ones [Reported, CSCW 2019] — which supports the existing category-level copy.

False positives on teens. African American English up to 2× more likely labelled offensive [Primary, ACL 2019]; reclaimed slurs and in-group queer speech misclassified by LLMs; keyword self-harm flags on a youth forum produced many false positives while missing worrying messages without keywords [Reported, 2022].

Evaluation at small scale. Build a golden set; blind model labelling; disagreements rewrite the policy (OpenAI's loop). Binomial arithmetic: ±5% precision at 95% confidence needs ~385 flagged items per category (±10% needs ~96); zero misses in n audited approvals bounds the miss rate below ~3/n. Rare categories (grooming) need synthetic/red-team sets with recall reported on those. Pin model versions; re-run on every prompt change.

Latency. 0.1 s feels instant, 1 s keeps flow, 10 s is the attention limit (Nielsen). Field experiments with news sites found algorithm-supported pre-moderation reduced toxicity without lowering engagement [Reported, 2025].

2.6 Regulation and standards that shape the method

US — applies to the pilot now.

Expansion only.

3. The canonical flow every moderated surface implements

3.1 Pipeline

3.2 The steps, today versus target

3.3 Lifecycles

Row-shaped surfaces (post, comment, message, request note) keep their own status; "held" is the row in pending_review with its review escalated.

Column-shaped surfaces (bios, career goals, experience description, school description) stage the candidate text in the review row; the previous approved value stays live until approval; clearing a field applies immediately.

3.4 Who sees what, by state

Row-shaped:

Column-shaped:

3.5 Severity model and decision table

The classifier returns a 0–3 severity per category; code decides.

Per-surface rules (examples; thresholds fitted on the eval set):

3.6 Human review lanes, reviewer actions, SLAs

Reviewer actions (today: approve, reject + categories + note):

Reviewer hygiene: mask slurs and sexual text until click-to-reveal (reduces impact without hurting accuracy [Reported, 2020]); never show reviewer notes to authors.

3.7 Enforcement ladder and the author hold

Author hold is the build's cheapest safety primitive because it needs no new UI: while a hold exists, processReview escalates every new item from that author with reason author_hold. The author sees the ordinary "being checked" state, so an S0 investigation is not tipped off, and nothing reaches anyone until a human clears it. It also answers filter probing: N flags in a window on one surface → temporary hold.

Ladder (education-first for minors; S0 skips it):

Strikes expire after ~90 days, are visible to their owner as standing (not a count), and a reversed decision removes its strike. Nothing is automatic from a model verdict alone.

3.8 Evidence, preservation, and the NCMEC lane

1. S0 escalation → author hold + safety case (additive table) linking the review, subject, thread excerpt, both accounts, timestamps.
2. Safety lead confirms or clears. On confirmation of apparent CSAM, trafficking or enticement: file a CyberTipline report (requires registering as a reporting provider), record the report id, start the 1-year preservation clock covering the thread context, restrict access to the case.
3. Only after the report: enforcement (suspension, mentor termination). Held never-delivered messages are included — rejection does not discharge the duty.
4. Account deletion (not yet built) must exempt anything under preservation.
5. School data agreements need an explicit carve-out for statutory reports.

The procedure is designed with counsel before pilot launch (docs/04 §7 already requires this for CSAM; the scope is wider).

3.9 Self-harm care flow

Today: stage 1 or the model marks self_harm → escalate → the author sees the generic "being checked" state. The 988 copy in REJECTION_MESSAGES.self_harm ("A person on our team is taking a look at this…") renders only on the rejected state (thread.tsx, post.tsx, mentorship.tsx), i.e. after a human rejects. In a DM, the one-undelivered rule also stops the student writing anything else in that thread until a human acts. Reviewers have approve/reject only.

Target flow (the options in step 2 and 4 are decisions, §8):

1. self_harm ≥ 1 → care lane with the safety-lane SLA.
2. At hold time, show support resources to the author for self-harm holds (the probing value of revealing this category is negligible; the cost of a student in crisis waiting for a human is not).
3. Reviewer chooses: deliver/publish (peer support and disclosure are often healthy), hold with a care message, or the imminent-risk protocol.
4. The imminent-risk protocol — who is contacted (school counsellor, guardian, emergency services) and when — is a counsel + school-agreement decision. It is an explicit expression by the student, not inference, so it does not cross docs/12 §8's mood-detection line, but it does surface a minor's disclosure to an adult and must be designed as its own decision.
5. self_harm never produces a strike.

4. Per-surface flow cards

Each card lists only what differs from §3. "Built" and "Gap" are verified against the code references at the top of this document.

4.1 Mentorship message — message.body, conversation kind mentorship

4.2 Mentorship request note — mentorship.request_note

4.3 Peer message — message.body, conversation kind peer

4.4 Comment — comment.body

4.5 Post — post.body (+ link)

4.6 Student bio and career goals — profile.bio (200), profile.career_goals (300)

4.7 Mentor bio and experience description — mentor.bio (300), mentor.experience (300)

4.8 Educator bio and school description — educator.bio (300), school.description (600)

4.9 Write-time gated fields

Display name (all roles, 50), major, minor, hometown, typed high school, experience title, organisation, typed college name, not-listed school name.

4.10 Future: connection request note

A documented known gap (docs/07: "needs its own policy pass, not a field"). Inputs for that pass: LinkedIn publishes no classifier for invitation notes; the industry handles first contact with request inboxes and sender signals; the shape (people not yet connected) is the highest-risk in the product. If built: row-shaped and held-invisible; guard = request still pending and no block; sender velocity caps (D-30); "I don't know this person" blocks (D-29); never deliver a note from a sender under hold or with a recent confirmed S1.

4.11 Not moderated by design

Report notes, appeal notes and reviewer notes are read only by staff, so they fall outside docs/12 §2's rule ("another human reads it" means another member). They stay out of the registry, are escaped on render, and are never shown to members.

5. How to build a moderated surface

5.1 What adding a surface touches today

A surface's behaviour is spread across: the contracts registry (moderatedText), its call site (submitForReview), COLUMN_APPLIERS or ROW_SURFACES + applyRowDecision, isAdultChannel, the post-approval if chain in applyDecision, the notifyAuthorOfFlag switch, REJECTION_MESSAGES (in contracts and duplicated in thnkrr-web/src/api/schemas.ts), ReportSubjectType + assertReportable + subjectPreview + resolveReport, getMyReviews' row-surface exclusion, the web composer and render states, and an e2e spec. What fell through: the user report no-op, school.description not reportable, delivery hooks without guards, and no per-surface policy text.

5.2 The surface definition

One object per surface, consumed by the pipeline; a contracts test asserts every registered surface has one. A design sketch, not an implementation:

interface ModeratedSurface {
  name: SurfaceName;                        // the moderatedText registry key
  shape: "row" | "column";
  authorRoles: AccountRole[];
  audience: "addressee" | "post_audience" | "profile_viewers" | "directory" | "school";
  channel(ctx: Ctx, review: ReviewRow): Promise<"peer" | "adult">;    // bar selection (D-49)
  gates: Gate[];                            // eligibility, caps, restriction, author hold, flag budget
  buildContext(ctx: Ctx, review: ReviewRow): Promise<ClassifierContext>; // role tokens, no identifiers
  policy: { addendum: string; decision: DecisionTable };               // per-surface prompt text + rules
  apply: { approve(tx: Tx, r: ReviewRow): Promise<void>; reject(tx: Tx, r: ReviewRow): Promise<void> };
  deliveryGuard(ctx: Ctx, r: ReviewRow): Promise<"deliver" | { cancel: string }>;
  onDelivered?(ctx: Ctx, r: ReviewRow): Promise<void>;                 // notifications
  flagDestination(ctx: Ctx, r: ReviewRow): Promise<NotificationTarget>;
  copy: { held: string; cancelled?: string; removed: string };         // category copy stays shared
  reviewerPanel(ctx: Ctx, r: ReviewRow): Promise<ReviewerContext>;
  report: { subjectType: string; preview: Preview; remove: Remover } | null;
  takedown: Remover;                        // moderator removal without a report
  rescreenOnPolicyChange: boolean;
  preservation: "undeletable" | "soft_delete" | "staged_history";
}

5.3 Web building blocks

• A moderated composer with the states idle · submitting · held · flagged · cancelled · restricted, reusing today's copy and D-19's "state, never content".
• A moderated content renderer: published · tombstone.
• Reviewer panels by audience type (thread excerpt; post + comment thread; profile diff), with click-to-reveal masking.
• Copy served from contracts only — remove the duplicate REJECTION_MESSAGES in src/api/schemas.ts.
• Polling backoff once an item has been pending for more than a few minutes.

5.4 Test matrix per surface

5.5 Metrics per surface

Volume · p50/p95 time-to-visible · auto-approve / flag / escalate rates · human decision time by lane · appeal overturn rate · weekly sampled missed-harm rate on approvals · sampled false-positive rate on flags · resubmit-after-flag rate · reports per 1,000 items · refusal rate from the model provider.

5.6 Changing the classifier safely

1. Golden set — ~100 items per category and per high-risk surface, including reclaimed terms, counter-speech, students discussing their own mental health, career-goal false positives, obfuscation, injection, and some non-English.
2. Policy version — a hash of the policy prompt, the surface addendum and the output schema, stored in model_verdict with the model and effort (no migration).
3. Shadow mode — a candidate policy or model runs beside the live one for a few days, its verdict stored in model_verdict.shadow, no user impact; a disagreement report decides promotion. At pilot volume this costs almost nothing.
4. Gate — no promotion without per-category precision/recall at or above the live version on the golden set.
5. Audit — weekly human review of a random 2–5% of approvals and a sample of flags per category.
6. Evidence — keep these results; they are what any accuracy claim to a school rests on (FTC Workado).

5.7 Definition of done for a moderated surface

• Registered through moderatedText with a surface definition (§5.2)
• Gates, context builder (no identifiers), per-surface policy addendum
• Decision table and channel selection
• Delivery guard with a cancelled state
• Author states: pending · held · flagged · cancelled · restricted, with copy
• Addressee and third-party visibility per state
• Reviewer panel and lane
• Report-as-itself, removal, takedown, tombstone or cleared-field notice
• Enforcement hooks and author-hold behaviour
• Preservation mode
• Test matrix (§5.4) and golden-set slice
• Metrics wired

6. Verified gaps in the current build (ranked)

7. Build sequence and schema impact

Every schema change below is additive; none is structural.

Before the first real student

During the pilot

Do not adopt for the pilot: ROOST Coop or Osprey as dependencies (they need Redis/ScyllaDB/ClickHouse or Kafka/Druid), a dedicated self-hosted GPU (idle at pilot volume), Google's Gemini API without an explicit under-18 arrangement, Perspective API (shutting down), Azure custom categories (retired), Hugging Face TGI (maintenance mode), engagement-velocity or ranking-based moderation, automatic closure of member reports.

8. Decisions that need an owner

9. Not verified

• Thorn Safer Predict and Hive pricing, eligibility, retention and languages.
• Adoption evidence comes from public statements, several read only as search excerpts; data terms for Hive, Thorn, Google Cloud, Azure, Amazon, Mistral and xAI; Vertex AI's minors terms; OpenAI Moderation's retention on its own page.
• For any hosted model: whether the provider's own safety filters refuse sexual, grooming or self-harm text sent for classification, and whether moderation traffic could trigger enforcement on our account — under fail-closed that would halt publishing. Ask each candidate provider.
• Discord safety-alert triggers; whether Meta or Snap classify DM text for grooming.
• The Community Sift shutdown (single competitor source).
• Exact status and text of the reinstated EU interim derogation; Ofcom's pending proactive-technology statement.
• Default data retention for each hosted provider must be read from its current terms at contract time (for Anthropic, its privacy center says 30 days; a third-party source says 7).
• The SLA targets in §3.6 are proposals, not published norms.
• Lantern eligibility for a pilot-stage company.