Trust & safety operations

Respond quickly, quarantine first, and preserve only the evidence needed.

This runbook turns the current public report intake and owner review workflow into an operator response procedure for private VPS testing. It is operational guidance, not legal advice, and it must be reviewed against the final hosting jurisdiction, processor obligations, and public-launch terms before broader operation.

Scope

What this runbook covers now

Public /report intake, local takedown-report* commands, and gated /owner review of private report cases.
Synthetic adult media complaints, likeness/NCII concerns, rights/privacy complaints, illegal-content indicators, private member requests, payment/provider abuse signals, and platform policy complaints.
Private VPS and small private-test operations where one owner/operator is responsible for daily queue review.
Privacy-preserving handling: no default email collection, no ID documents, no uploads, no raw IP/user-agent capture, no public case posting, and no browser owner exposure of raw evidence paths or sensitive material.

Current implementation boundary: Nocturne can open/list/review cases, quarantine local targets, record private notes, and keep a minimal event trail. It does not automatically notify external authorities, processors, hosts, complainants, or members.

Severity model

Priority, SLA, and first action

Priority	Examples	Owner first response target	First action	Escalation posture
`urgent`	CSAM/child exploitation indicators, credible minor/age-ambiguity sexual-content claim, credible non-consensual intimate imagery or real-person likeness complaint with active media exposure, credible threat or coercion claim.	Within 4 hours while private testing is active; pause widening if this cannot be met.	Quarantine first, preserve minimal case metadata, stop related publishing, and begin external escalation assessment.	Use jurisdiction/provider-required reporting path when legally required or contractually required; consult counsel before public launch.
`high`	Rights/copyright claim against active content, privacy complaint, processor/provider warning, repeated unsafe request behavior, suspicious abuse pattern that could affect account/payment/platform integrity.	Within 1 business day.	Quarantine or restrict if credible; otherwise mark for focused review with owner notes.	Escalate to host, processor, provider, or counsel if obligations, account risk, or credible harm are present.
`normal`	Policy complaint, unclear likeness concern, user confusion, catalog/request moderation issue, non-urgent takedown request with limited detail.	Within 3 business days.	Review target, collect only necessary context, and decide reject/remove/resolve/archive.	Escalate only if review reveals severe content, rights, privacy, payment, or safety concerns.
`low`	Spam-like reports that pass intake controls, duplicate reports, non-actionable platform complaints, low-risk metadata corrections.	Within 7 business days or batch weekly during private testing.	Close, archive, or request more information only if a privacy-preserving contact reference exists.	No external escalation unless new facts raise severity.

Solo-operator rule: if urgent review cannot be monitored during a private-test window, reduce exposure: pause invites, keep public launch blocked, and avoid adding higher-risk participation surfaces.

Triage loop

Daily queue review

Open the gated owner dashboard or run cargo run --locked -- takedown-report-list --status open.
Sort mentally by priority, complaint kind, target type, and whether the target is still visible or accessible.
For any urgent or credible high-risk case, quarantine before deep review: use the owner dashboard action or takedown-report-review --report-id ... --status quarantined --quarantine-target --owner-note "minimal reason".
Check the reported local target only through owner/member-authorized paths. Do not paste raw logs, screenshots, private media files, reporter contact details, or provider material into git, docs, issue trackers, or browser owner notes.
Record the decision with the least sensitive useful note: quarantined, removed, rejected, resolved, or archived.
When external escalation is required or likely, record only that escalation occurred or is pending; keep external case numbers, raw evidence packets, legal correspondence, and provider ticket contents in the operator’s secure external custody, not in public docs or browser surfaces.

Escalation paths

When to leave the app workflow

Trigger	App action	External action to prepare	Do not store in Nocturne
CSAM or child exploitation indicator	Immediately quarantine related target, stop related publication, preserve minimal case metadata, and mark urgent.	Follow legally required reporting path for the operating jurisdiction and any provider/host/processor obligation; identify the official reporting endpoint before public launch.	Illegal images, raw contraband, unnecessary copies, ID documents, raw access logs, or speculative identity notes.
Credible NCII, likeness, or real-person sexualization complaint	Quarantine first when plausible; remove if credible or not worth contesting.	Prepare rights/likeness response path, complainant-safe acknowledgement outside the app if contact exists, and counsel/provider escalation if required.	Unredacted identity documents, reporter personal details beyond minimal contact reference, raw screenshots in git, or public discussion of the complainant.
Copyright, trademark, privacy, or publicity-right claim	Restrict target while reviewing if the claim is plausible or high-risk.	Use host/provider/counsel process based on jurisdiction and terms; record outcome metadata only.	Full legal notices, private correspondence, government IDs, or payment/customer identity.
Payment processor, host, or infrastructure provider warning	Freeze related rollout or checkout path if platform access could be affected.	Use provider support/escalation channel; preserve sanitized evidence hash or summary for internal readiness only.	Contracts, dashboard screenshots, raw processor logs, API payloads, customer identity, or support-ticket transcripts.
Credible threat, coercion, stalking, doxxing, or self-harm context	Lock or quarantine related request/account/content path and avoid engaging publicly.	Assess emergency/legal escalation outside Nocturne. The app report form is not an emergency service.	Raw IP/user-agent fishing, doxxing material, medical/legal speculation, or unnecessary identity enrichment.

Evidence minimization

What to record, and what to keep out

Record in Nocturne

Complaint kind, local target type/ID, priority, status, timestamps, and concise owner decision notes.
Optional SHA-256 evidence digest when the operator has an external artifact whose contents should not be stored in the app.
Whether a target was quarantined, removed, rejected, resolved, or archived.
Sanitized references such as an external ticket label or digest when needed for operator continuity.

Keep outside Nocturne

Raw logs, raw IP addresses, user-agent strings, session IDs, CSRF tokens, recovery keys, database URLs, owner keys, and storage keys.
Raw provider contracts, dashboards, payment payloads, customer identity, support transcripts, and legal correspondence.
ID documents, file uploads, contraband, unredacted evidence packets, and screenshots that expose private media or identities.
Backup IDs, evidence file paths, raw artifact paths, and private storage locations in browser owner surfaces.

Decision playbooks

Status choices

Status	Use when	Operator note guidance
`quarantined`	The target should be hidden/restricted while review continues.	Short reason only: credible likeness claim, age ambiguity review, rights review, provider warning.
`removed`	The target should stay unavailable because the claim is credible, legally risky, policy-violating, or not worth contesting.	State the policy/rights category and whether external escalation is pending/completed without raw details.
`rejected`	The report is reviewed and not credible/actionable, and no restriction is needed.	Record minimal basis: wrong target, duplicate, no local match, no policy issue found.
`resolved`	The issue was addressed without permanent removal, or no further operator action is needed.	Record outcome metadata only.
`archived`	The case is duplicate, spam, stale, or retained only for minimal audit continuity.	Avoid adding new sensitive details while closing.

Readiness gate

Before widening beyond private VPS

Daily owner queue review cadence is explicitly assigned and sustainable.
Urgent/high/normal/low SLA targets above are accepted or replaced with stricter operator commitments.
Official external reporting paths for the chosen jurisdiction, host, processor, and storage provider are bookmarked outside the repository.
Operator has a secure external evidence-custody location for legal/provider material that must not enter Nocturne or git.
Owner authentication/session posture is reviewed before relying on browser review during live incidents.
Public terms/privacy notice reflect the no-emergency-service boundary, synthetic-only policy, takedown path, privacy minimization, and possible external escalation duties.

Public-launch blocker: this runbook reduces private VPS risk, but public launch still requires jurisdiction-specific legal review, processor/host obligation review, production monitoring/WAF decisions, and a completed restore drill.