Moderation and security policy
This page describes Atrium Town’s current content safety practices. Space rules may set different score thresholds, blocked phrases, and behavior when a filter is unavailable. People with permission to manage a space can set its first-post scanning count, blocked phrases, and filter-unavailable behavior on the Moderation page in space settings.
Checks before publication
Atrium Town checks the first few posts from a person using local blocked phrases, a spam heuristic, and OpenAI’s Moderation API. For a post with photos, the image bytes may be sent to OpenAI. A clean history earns a trusted rating, after which remote checks are ordinarily skipped. Posts in a personal space, which only their author can read, are checked the same way but do not count toward that rating. Local rules still apply to every post. Scores are screening signals, not proof that a person violated a rule.
A post may be published, blocked, or held for an operator. Posts with more photos than the automated scan limit are held when the poster is not yet trusted. If a remote filter is unavailable, the applicable space’s failure rule determines whether the post is held, blocked, or allowed.
Reports, review, and blocking
Readers can report a message for prompt operator review and can block an account in their own view. A report immediately affects the author’s trust rating. One report does not automatically hide a published message from everyone. An operator may hide reported content, approve a held post, or dismiss a case. Repeated suspicious behavior may lead to stronger automatic action. Operators should review pending cases regularly; the queue does not itself guarantee a response time.
Deleted and flagged photos
Experimental avatar generation uses the image provider’s generation safeguards and may refuse a request. It does not run the separate message moderation scanner, identify a person, or create a facial recognition profile. Only a generated avatar you choose to save becomes profile content.
Uploaded profile avatars are not automatically screened by the message moderation checks described above. A replaced or removed avatar is erased during background cleanup, without the ordinary message-photo evidence retention period. Account deletion also schedules removal of the avatar.
Deleting a photo’s message, or editing the photo out, removes it from the conversation and schedules removal of its normal media path. Ordinary deleted photos move to a private evidence area with a seven-day purge deadline. Photos tied to a report, an automated moderation case, or an operator hide have a 30-day deadline from the relevant event. A later relevant event may extend that deadline. An hourly cleanup removes expired bytes; the actual removal may follow the deadline. A dismissed report does not by itself establish a violation. Content in an unresolved case stays unavailable to ordinary readers while held.
Evidence records contain the image identifier, account and conversation IDs, reason, relevant case ID when present, event time, and purge time. The image bytes are never written to application logs. Evidence storage is not served by the normal media route; only authorized operators can use the case-review path. After 30 days, case text and photo paths are removed while decision metadata remains. This standard schedule does not replace any applicable legal preservation duty. A separate restricted response to suspected child sexual abuse material is required before launch.
Security and accountability
Document text colors and highlights use a fixed Atrium palette. Document edits cannot store arbitrary CSS styles; pasted colors are kept only when they match that palette. Read-only views, public pages, and Markdown exports preserve these approved colors.
The message editor shows formatting as you type, using the same kind of editor as a document. Messages are stored as text with a limited set of styles, not as HTML. Pasted formatting is kept only for those styles; anything else stays text. The editor shows uploaded and pasted images inline, with a temporary loading bar while an upload is in progress. Image bytes are stored through the same private media service; drafts and messages contain checked media paths rather than embedded image bytes. Clickable message links accept web addresses, mailto links, and local Atrium paths, and reject executable URL schemes. Displaying a link does not request its destination. Only validated Atrium media paths render as uploaded message images. The composer can insert registered Atrium emoji; those shortcodes render Atrium’s own emoji images in the editor, the conversation, and guest pages. Any other shortcode stays text.
Uploads and retained evidence are stored privately. The Worker checks conversation access for normal image reads and operator status for review reads. The service records moderation decisions and review actions by stable IDs. Access to evidence is limited to the people handling safety cases. Operator consoles use separate pages and authenticated HTTP endpoints; they do not connect to workspace sync, presence, calls, or notifications. Operator pages and review endpoints check the server allowlist, and the platform and account-retirement control domains are unavailable through browser sync sockets. Deleted account IDs are replicated as an access policy to revoke existing connections and reject queued edits. Private deletion requests have a 30-day deadline and are completed by an operator only after verifying account, content, upload, history and retained-copy erasure; their receipt continues to show pending until then. Account deletion overrides ordinary photo-retention periods except where preservation is legally required. Atrium Town does not promise that an automated classifier will catch every harmful image; readers should report content that needs review.
Contact
Atrium is operated by Atrium Town Company. Send safety, security, or legal concerns to hello@atrium.town.
Last updated: