Trust & Safety architecture · scope reviewed April 2026

We built compliance-first from launch.

Chatalystar documents the controls that are deployed, the surfaces they cover, and the gaps that remain. This page is written for members, creators, regulators, and safety reviewers—not as a promise that one control applies everywhere.

See the architecture →AB 1705 upload safeguards Transparency data Read the white paper Report content

The landscape

Adult content is hosted everywhere from anonymous Telegram channels to verified mainstream subscription platforms. Here is where meaningful control tiers sit — and where Chatalystar documents its posture. Hardware-rooted provenance is shown as a dashed future direction; it is not a capability we claim to have deployed.

Dark net / Telegram channels

0% verified · No accountability

Vibe-coded AI sites

Anonymous prompts · No identity binding

Tube sites (legacy)

Bulk uploaded · After-the-fact moderation

Mainstream subscription platforms

ID at signup · No per-upload binding

Post-reset Pornhub

Verified-uploader-only after 2020 purge

Chatalystar

Per-session attestation · Per-upload HMAC chain · 24h SLA

Theoretical maximum

Hardware-rooted provenance standards (future direction)

Export:SVG PNG PDF MP4

How creator uploads are anchored

The creator upload path uses identity and session binding, upload-time moderation, and responsive infrastructure. The labels below describe what each layer does and what it cannot prove.

Export:SVG PNG PDF

Identity bindingScoped control
Veriff identity verification (21+)
Creator publishing is gated by a third-party government-ID and age-verification flow with biometric liveness.
Prevents: Anonymous accounts, underage creators, stolen identities.
Identity bindingScoped control
Wallet binding (EIP-712)
Where a wallet attestation is present, it binds the Veriff session hash, wallet address, and accepted Creator Agreement version. Historical and delegated paths do not uniformly carry a fresh creator wallet signature.
Prevents: Identity-spoofed accounts, wallet hijacks producing content under another creator's identity.
Identity bindingScoped control
Vault PIN (out-of-band)
An additional second factor required to enter the upload vault, separate from wallet keys.
Prevents: Stolen-device uploads, key compromise leading to direct vault access.
Cryptographic bindingScoped control
Per-session signed attestation
The signed-session path binds wallet → identity → agreement version → session ID. Grandfathered and delegated paths can have different or absent creator attestations; email verification and a separate upload declaration are distinct controls.
Prevents: Some replay and attribution risks on the signed path; not proof of every depicted person's age or consent.
Cryptographic bindingScoped control
Per-upload binding
Governed upload records link the asset to available session and chain-of-custody evidence. Some historical fields can be absent. The AB 1705 per-file declaration design separately identifies the actual declaring uploader and covered storage version; approved cutover and production verification remain pending.
Prevents: Attribution gaps where records exist; does not independently establish age or consent for every depicted person.
Cryptographic bindingScoped control
HMAC chain of custody
Each upload row is HMAC-linked to the previous row in the creator's history; tampering breaks the chain.
Prevents: Silent edits to history; selective deletion of incriminating uploads while keeping the rest intact.
Upload-time moderationScoped control
Container & EXIF inspection
Image and video metadata is extracted, normalized, and inspected. Suspicious tooling, missing capture timestamps, or embedded GPS can soft-flag a creator upload.
Prevents: Some metadata anomalies and review gaps; this inspection is not proof that an upload is authentic or consented.
Upload-time moderationScoped control
Sightengine NSFW & minor screening
Two-tier automated scanning of every upload; minor-likelihood matches are hard-blocked and queued for human review.
Prevents: CSAM, even at upload-time before any view occurs.
Upload-time moderationScoped control
Public mission, banned-niches, 2257
Plain-English public policy pages stating creator/member age floors, banned content, and 2257 records custodian.
Prevents: Plausible-deniability defenses; the platform's standards are public, dated, and auditable.
Responsive infrastructureScoped control
Triage queue + 24-hour SLA
Reports route to a moderation queue with severity-based routing; acknowledgement under 24 hours, action target under 24 hours for severity-1 cases.
Prevents: Stale reports, content lingering for days while a person tries to get it removed.
Responsive infrastructureScoped control
NCMEC + IWF + StopNCII integration
Hash-matching against industry CSAM and NCII hash lists; confirmed matches are reported to NCMEC under 18 USC § 2258A.
Prevents: Re-circulation of known harm material; failure to report under federal mandate.
Responsive infrastructureScoped control
Quarterly transparency reports
Anonymized quarterly stats on removal requests received, response times, action rates, appeal outcomes, NCMEC reports filed.
Prevents: Opaque moderation; regulators / press / partners cannot independently audit posture.
Responsive infrastructureScoped control
Law enforcement liaison
Dedicated legal@chatalystar.com inbox for valid legal process; preservation requests honored; subpoena response under SLA.
Prevents: Investigators stuck behind a contact form; preservation requests dropping on the floor.

Implemented in developmentCounsel approval and production rollout unverified

California AB 1705: upload safeguards

Chapter 890 was approved September 30, 2026. Under the ordinary effective-date rule in Government Code §9600, its effective date is January 1, 2027. Sources and implementation were reviewed October 7, 2026. This is a plain-language account of scoped safeguards—not counsel review, a legal conclusion, or a blanket compliance claim.

Enacted AB 1705 (Chapter 890) (official source)California Government Code §9600 (official source)

Current rollout boundary

Default declaration enforcement is off pending an approved cutover. That does not mean every safeguard is off: retention guards depend on migration and application deployment. No production record inventory or production rollout verification has been performed for this explanation.

§22614(a)(2): statement and contact

Actual control: A separate, explicit typed-name assent is tied to one identified file, not a generic future batch. A server-allocated asset slot is bound to the final immutable storage identity/version and any server-verified derivative. File selection, filename, or other client metadata is not proof of age or consent.
Scope: For each individual depicted, the three certifications are that they were adults when the content was created; they consented to being depicted; and they consent to the content being uploaded to Chatalystar. Adulthood at creation is distinct from our creator’s current 21+ publishing rule. Each is made under penalty of perjury. This is a plain-language summary, not final declaration wording. Exact wording and execution need counsel approval.
Status: Code reviewed; declaration enforcement remains off pending approved cutover.

§22614(c): verified email

Actual control: Before supported uploads after approved cutover, the declaring person uses their own verified contact email and a reusable server-verified PIN. A fresh PIN is not required for every file. In Crew Mode, the person making the declaration uses their own verified contact and assent; this is not automatically the creator’s signature.
Scope: Supported creator direct, presigned, and multipart uploads; long-form uploads; alternate Vault; custom thumbnails; voice clips; and Crew Mode. Ambiguous, direct-admin, member, and API-key ingress is paused at cutover unless it has an explicitly reviewed attributable path.
Status: Supported-path code reviewed; deployed ingress coverage and cutover are unverified.

§22614(b): records readily available for at least seven years

Actual control: The restricted archive is designed to preserve the exact declaration text/version/hash, typed signature, server submission time, verified contact and email evidence, and linkage to the immutable content version and derivatives. Founder-only authorized retrieval/export is checked server-side and audited; these are never public or customer evidence.
Scope: The seven-calendar-year floor runs from submission, not content creation or short-lived session/token expiry. It is independent of ordinary account deletion, session revocation, and Vault cleanup. In the implemented design, archive failure blocks destructive creator deletion.
Status: Retention guards depend on migration and application deployment; production schema, archive, and access are unverified.

§§22612 and 22614(a)(1): ordinary care

Actual control: Declaration evidence complements performer releases, creator identity verification, moderation, ordinary care, reporting, and removal. Identity verification and cryptographic provenance support attribution; neither independently proves every depicted person’s age or consent, and a declaration is not immunity.
Scope: Publication and republication checks require evidence plus existing moderation and consent review at cutover. There is no blanket AI or private-message exemption. No blanket grandfathering, automatic recertification, mass removal, or fabricated historical evidence is intended.
Status: Control mapping reviewed; legal scope, historical policy, and production operation remain pending or unverified.

Records, retention, and disposal

The statutory minimum is seven years after submission; the implemented calendar-based floor follows that starting point. Separate longer guards apply while content is accessible or its availability is unknown, during a legal hold, or while a longer obligation applies. The criteria for longer retention are proposed and require counsel approval; they are not an approved policy. Disposition requires confirmed, reviewed removal, an expired minimum period, and no hold or longer obligation. There is no automatic purge and no promise to retain media or all personal data forever. Backups, recovery, and deployed coverage are unverified.

Archive and retention do not override unrelated privacy rights or constitute a general media-retention policy. For the current notice, see upload-evidence retention, Terms, and 2257 records.

Historical review is evidence review, not a verdict

A read-only inventory can classify available evidence as complete, incomplete, contradictions, or unknown. These are evidence statuses, not legal verdicts. There is no blanket grandfathering, automatic recertification, or mass removal. A new truthful review or declaration must carry its real current timestamp; it cannot prove that a declaration was received before a past upload.

Complete: Evidence appears present for review.
Incomplete: One or more expected records or links are missing.
Contradictions: Available evidence conflicts and needs investigation.
Unknown: The evidence does not establish the relevant fact.

What remains before reliance

Legal scope, exact declaration wording and execution, retention criteria, and historical-review policy still require counsel approval. Operational checks still include enabled-ingress coverage; production schema and migration; archive behavior; backups and recovery; server-side access and audit; deletion, holds, and disposition; and a verified cutover. These checks have not established a production rollout.

No blanket AI or private-message exemption is claimed. Identity verification and cryptographic provenance support attribution, but do not independently establish every depicted person’s age or consent. These safeguards complement performer releases, moderation, ordinary care, and reporting and removal processes; they do not provide immunity.

To report a concern, use Trust reporting or contact the Trust team.

Sources and implementation reviewed October 7, 2026. This section describes development controls and intended scope; it does not certify legal compliance, production deployment, complete historical records, or universal coverage. Effective dates, applicability, final execution language, and operational coverage remain subject to current law, counsel review, and actual deployment.

How we compare

An internal composite comparison across identity binding, per-upload accountability, response SLA, NCMEC integration, and transparency. It is illustrative—not an independently validated percentile—and the methodology is documented in the white paper.

Where every platform sits

Internal composite index: identity binding · per-upload accountability · response SLA · NCMEC integration · transparency

Internal assessment · Q1 2026

Future hardware-rooted provenance

Aspirational future direction, not a deployed control

100

Index 100

Chatalystar

Internal illustrative assessment · per-session attestation · HMAC chain · 24h SLA

Index 92

Pornhub (post-2020 reset)

Verified-uploader-only after the December 2020 purge

Index 84

OnlyFans

Identity at signup; bulk-uploads not per-asset bound

Index 78

Fansly

Identity at signup; reactive moderation queue

Index 72

Mainstream subscription median

Industry baseline for paid creator platforms

Index 65

XVideos / XHamster

Bulk-uploaded; after-the-fact moderation only

Index 35

Vibe-coded AI companion sites

Anonymous prompts; no identity binding; no audit trail

Index 8

Telegram channels / dark net

Zero verification; zero accountability

Index 1

Scores are Chatalystar's own internal composite assessment based on selected platforms' published policies and observable behavior at content-upload, takedown, and reporting moments. They are illustrative, not an independently validated percentile or legal ranking. Methodology is in the white paper.

Standards and controls we map to

The table is a product mapping to relevant principles and duties. It does not establish unconditional legal compliance, certification, or universal coverage.

Standard / framework	Requirement	Chatalystar control / scope	Status
Tech Coalition (Voluntary Principles) /banned-content · /trust/whitepaper	Adopt safety-by-design and transparency for child sexual exploitation	Sightengine minor screening hard-blocks at upload; quarterly transparency reports; public banned-content policy	Existing mapping
NCMEC (18 USC § 2258A) /trust#contact · legal@chatalystar.com	Mandatory reporting of apparent CSAM to NCMEC CyberTipline	Automated CyberTipline submission for confirmed matches; preservation per § 2258A(h); LE liaison inbox	Existing mapping
EU DSA Article 14 /trust/report	Notice-and-action mechanism with statement of reasons	Public /trust/report form; tracking reference; SOR returned to reporter and content owner	Existing mapping
EU DSA Article 16-17 /community-guidelines	Trusted-flagger priority + restriction reasoning	Trusted-flagger lane in triage queue; restrictions accompanied by published policy citation	Existing mapping
EU DSA Article 24 (transparency) /trust#transparency	Annual transparency report with quantitative moderation data	Quarterly cadence (exceeds annual minimum); per-category counts; appeal outcomes; mean response time	Existing mapping
EU DSA Article 34 (risk assessment) /trust/whitepaper	Annual systemic-risk assessment for VLOPs (and voluntary for smaller platforms)	Risk register published with /trust whitepaper Annex C; reviewed and re-published quarterly	Existing mapping
UK Online Safety Act (Illegal Content Duty) /trust/report	Proactive measures to prevent illegal content; risk assessment; reporting routes	Pre-publication minor screening; banned-content public list; direct in-content reporting with /trust/report fallback; 24h SLA	Existing mapping
UK Online Safety Act (Children's Safety Duty) /why-21 · /community-guidelines	Highly effective age assurance for adult content	Veriff government-ID + biometric liveness for creators; age-confirmed gate at member NSFW unlock	Existing mapping
California AB 1394 / SB 1381 (NCII) /trust#contact	Reasonable steps to remove non-consensual intimate imagery within 48 hours of report	Stop NCII hash integration; severity-1 routing; 24-hour action target (exceeds 48h floor)	Existing mapping
California AB 1705 (§ 22614) /trust#ab-1705	Before-upload sworn age/consent statement and contact information; verified email; readily available retention for at least seven years from submission	Identified per-file declaration, reusable server-verified email, deletion-independent restricted evidence archive. Supported ingress only after approved cutover; declaration enforcement defaults off. Counsel approval and production rollout unverified.	Development · review / rollout pending
18 USC § 2257 / § 2257A /2257	Records-keeping for performers in sexually explicit content	Veriff creator verification records; upload attribution through available session/provenance records; named custodian. Attribution alone does not verify every depicted performer's age or consent.	Existing mapping
Texas SB 12 / Utah SB 287 / Louisiana HB 142 (state age-verification) /age-verification	Reasonable age-verification before adult content access in regulated states	State-aware geolocation gate routes to commercial age verification flow before NSFW exposure	Existing mapping
Stop NCII (operational integration) /trust/whitepaper Annex B	Hash-match against industry NCII database before publication	Hash-check on upload; matches hard-blocked and routed to dedicated NCII queue	Existing mapping
IWF hash list (CSAM) /trust/whitepaper Annex B	Operational use of IWF hash list for known-CSAM blocking	IWF list integrated alongside Sightengine; matches hard-blocked + NCMEC report	Existing mapping

Live transparency data

Anonymized aggregates or published snapshots, depending on the provenance label returned by the report service. If no quarterly report has been published, this panel stays unavailable rather than showing synthetic fallback metrics.

Loading available transparency data…

Funds flow

How member-to-creator settlement works

This describes the deployed wallet controls for member-to-creator settlement.

Member-to-creator settlement

Members fund their own self-custody wallet, including through the Coinbase on-ramp or USDC Direct transfer. Crystals are the platform display name for USDC held in that member wallet at the disclosed fixed rate: 1 Crystal = $0.01 USDC.

Separate member-side contribution

The platform contribution is disclosed separately and added on top of the listed creator-side amount. It is not deducted from the creator's listed price.

Member

Self-custody wallet

Member-funded USDC / Crystal balance

Settlement

Direct Base transfer

On-chain USDC transfer at purchase

Creator

Self-custody wallet

Creator receives the creator-side amount

Chatalystar does not hold the member's Crystal/USDC balance, take custody of the creator's wallet, or control the creator's private key.
A confirmed on-chain transfer cannot be reversed by Chatalystar, and Chatalystar cannot withdraw from either wallet.

Part 2Scope reviewed against deployed controls

Digital Intimacy in the AI Age

Digital intimacy requires people to know what is real, what is fictional, and what is generated. The labels below describe the product modes and the limits of the safeguards we can verify today.

Real people

Stars

Stars are human creators. Creator publishing is gated by a 21+ Veriff verification flow and creator agreement. That verifies the creator account and age at the time of verification; it does not prove that every person depicted in an upload is the creator or that consent is universal.

Relevant law / duty: 18 USC § 2257 / § 2257A records framework

Fictional AI characters

Muses

Muses are original fictional adult characters created for the platform. They are not intended to represent a real person. Muse conversations are AI interactions, not conversations with a human creator.

Relevant law / duty: EU AI Act Article 50(1) (official source); California SB 243, where applicable (official source)

A consented Star-linked AI mode

Simulated Presence

Simulated Presence is an optional AI mode that a consenting Star can enable to respond on their behalf when they are unavailable. The system stores sender provenance and the member-facing experience identifies the reply as potentially AI-generated or human-authorized. Availability and disclosure are mode- and surface-specific, not a promise that every chat surface behaves identically.

Relevant law / duty: EU AI Act Article 50(1) (official source); California SB 243, where applicable (official source)

Generated images

Synthetic media

Server-generated images that pass through the image-provenance boundary receive a visible “CHATALYSTAR SYNTHETIC MEDIA™” footer and machine-readable Chatalystar provenance in XMP metadata before scanning and delivery. This path covers registered server-generation workflows; ordinary member or creator uploads are not silently relabeled as synthetic.

Relevant law / duty: EU AI Act Article 50(2) and applicable Article 50(4) duties (official source)

Synthetic media and real-person consent

Deceptive synthetic media that depicts an identifiable real person without that person's consent is prohibited. Fictional adult characters are not intended to represent real people. A provenance label helps people recognize a covered generated image; it is not proof of consent, authenticity, or legal compliance, and it does not make an otherwise prohibited depiction acceptable.

Relevant law / duty: California AB 1394 / SB 1381 NCII mapping

Crisis and self-harm safety

Crisis signals can enter the crisis-triage path, where the member response may include localized support resources and urgent cases can be routed to a safety queue. The system records minimal evidence for review and has retention and retry controls. It is not a diagnosis, therapy, treatment, or emergency response service. If someone may be in immediate danger, contact local emergency services or a qualified crisis provider.

Relevant law / duty: California SB 243, where applicable (official source)

Adult access is layered, not one universal switch

Members: must be 18+ only, must confirm they are 18+ and provide their date of birth, and must pass Veriff age verification using government ID and biometrics before viewing explicit adult content. These required initial age and date-of-birth gates do not replace the required Veriff verification.
Creators: must be 21+ and must complete the creator publishing verification flow with Veriff age verification using government ID and biometrics before publishing.
Public visitors: receive public-safe previews only. Adult-only items require authentication, completed Veriff age verification using government ID and biometrics, and a non-blocked region.
Adult-only media and interactions: require Veriff age verification using government ID and biometrics, in addition to the account, date-of-birth, entitlement, human moderation, age-attestation, and regional gates required by the specific surface. Human moderation and age-attestation controls prevent explicit content from being shown without the required Veriff verification.

See age verification, community guidelines, and banned content for the operational policies.

Relevant law / duty: EU DSA Articles 28 and 34 risk mapping; UK age-assurance duties (Online Safety Act) (official source); Texas SB 12 / Utah SB 287 / Louisiana HB 142 state age-verification mapping

Applicability disclaimer: these controls are aligned with or support transparency goals and duties only where the cited law applies. This mapping is not a legal conclusion or guarantee, and it is not a certification or blanket compliance statement. Product surface, user location, law in force, and implementation scope still require review. Coverage note: provenance, disclosure, crisis triage, public-safe gallery authorization, and age assurance are different controls. Their availability depends on the workflow, account state, region, and surface. Where a control is not universal, this page says so.

Direct lines

Each inbox routes to the appropriate ops queue with the SLA shown. If you are not sure where to send something, use trust@chatalystar.com — we will route it. To submit a removal report through a structured form, use /trust/report.

Report content

When the control is available, report directly from the content first. It preserves the exact content reference and surrounding context. If direct reporting is unavailable, use the public report form or the Trust contact surface to start an inquiry.

Open report form

trust@chatalystar.comstandard

Press, researchers, regulators, partners

Policy questions, transparency-data requests, briefing requests, due-diligence inquiries.

Replied within 48 business hours

legal@chatalystar.comurgent

Law enforcement and legal process

Subpoenas, preservation requests, emergency disclosure requests, service of process, and other legal correspondence.

Acknowledged within 24 hours · Emergency under 6 hours

dmca@chatalystar.comstandard

Standard DMCA notice elements (17 USC § 512(c)(3)) or international equivalent. See /dmca for the form.

Acknowledged within 48 hours

2257@chatalystar.cominfo

18 USC § 2257 records inspection requests

Written request to the records custodian per /2257; agency or counsel identifier.

Coordinated by appointment per § 2257 protocol

support@chatalystar.comstandard

Members and creators with account questions

Anything that isn't a takedown / policy / law-enforcement matter.

Replied within 1 business day

The white paper

v1.0 · April 2026

Technical document covering problem framing, scoped architecture (Phase 1 + Phase 2), threat model, mapping to standards, verification approach, risk register, and the future roadmap.

· Problem framing & scope
· Identity binding chain (Phase 1)
· Responsive infrastructure (Phase 2)
· Threat model & abuse cases
· Standards mapping (DSA · OSA · § 2257)
· Verification approach & methodology
· Annex A — cryptographic primitives
· Annex B — hash-list integrations
· Annex C — Article 34 risk register
· Annex D — methodology for comparison scores

Read in browser Download PDF

Embed our standards comparison

Free for editorial, research, policy, and creator-platform use. The iframe is sandboxed (no executable JS), ships with Schema.org structured data, and includes a do-follow backlink.

Use this comparison on your site

Sandboxed iframe + Schema.org structured data + do-follow backlink. Free for editorial, research, policy, and creator-platform use.

Bar chart with the top 5 platforms.

<iframe src="https://chatalystar.com/trust/embed?variant=medium"
        width="600" height="360"
        loading="lazy" referrerpolicy="no-referrer"
        sandbox="allow-same-origin"
        title="Chatalystar — Trust & Safety Comparison"
        style="border:0;max-width:100%;display:block"></iframe>
<p style="font:12px system-ui,sans-serif;color:#666;margin:6px 0 0">
  Powered by <a href="https://chatalystar.com/trust" rel="external" target="_blank">Chatalystar Trust &amp; Safety</a>
</p>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"CreativeWork","name":"Chatalystar Trust & Safety Comparison","url":"https://chatalystar.com/trust","publisher":{"@type":"Organization","name":"Chatalystar","url":"https://chatalystar.com"}}</script>

Open the live embed in a new tab →Read methodology in the white paper →

Related policies

Architecture baseline reviewed April 8, 2026; AB 1705 sources and related upload claims reviewed October 7, 2026. This is not a counsel review or production rollout verification. Sub-policy pages keep their own URLs for deep-linking; this page is the canonical parent. Need a briefing? trust@chatalystar.com

Trust & Safety architecture · scope reviewed April 2026

We built compliance-first from launch.

See the architecture →AB 1705 upload safeguards Transparency data Read the white paper Report content

The landscape

Dark net / Telegram channels

0% verified · No accountability

Vibe-coded AI sites

Anonymous prompts · No identity binding

Tube sites (legacy)

Bulk uploaded · After-the-fact moderation

Mainstream subscription platforms

ID at signup · No per-upload binding

Post-reset Pornhub

Verified-uploader-only after 2020 purge

Chatalystar

Per-session attestation · Per-upload HMAC chain · 24h SLA

Theoretical maximum

Hardware-rooted provenance standards (future direction)

Export:SVG PNG PDF MP4

How creator uploads are anchored

The creator upload path uses identity and session binding, upload-time moderation, and responsive infrastructure. The labels below describe what each layer does and what it cannot prove.

Export:SVG PNG PDF

Identity bindingScoped control
Veriff identity verification (21+)
Creator publishing is gated by a third-party government-ID and age-verification flow with biometric liveness.
Prevents: Anonymous accounts, underage creators, stolen identities.
Identity bindingScoped control
Wallet binding (EIP-712)
Where a wallet attestation is present, it binds the Veriff session hash, wallet address, and accepted Creator Agreement version. Historical and delegated paths do not uniformly carry a fresh creator wallet signature.
Prevents: Identity-spoofed accounts, wallet hijacks producing content under another creator's identity.
Identity bindingScoped control
Vault PIN (out-of-band)
An additional second factor required to enter the upload vault, separate from wallet keys.
Prevents: Stolen-device uploads, key compromise leading to direct vault access.
Cryptographic bindingScoped control
Per-session signed attestation
The signed-session path binds wallet → identity → agreement version → session ID. Grandfathered and delegated paths can have different or absent creator attestations; email verification and a separate upload declaration are distinct controls.
Prevents: Some replay and attribution risks on the signed path; not proof of every depicted person's age or consent.
Cryptographic bindingScoped control
Per-upload binding
Governed upload records link the asset to available session and chain-of-custody evidence. Some historical fields can be absent. The AB 1705 per-file declaration design separately identifies the actual declaring uploader and covered storage version; approved cutover and production verification remain pending.
Prevents: Attribution gaps where records exist; does not independently establish age or consent for every depicted person.
Cryptographic bindingScoped control
HMAC chain of custody
Each upload row is HMAC-linked to the previous row in the creator's history; tampering breaks the chain.
Prevents: Silent edits to history; selective deletion of incriminating uploads while keeping the rest intact.
Upload-time moderationScoped control
Container & EXIF inspection
Image and video metadata is extracted, normalized, and inspected. Suspicious tooling, missing capture timestamps, or embedded GPS can soft-flag a creator upload.
Prevents: Some metadata anomalies and review gaps; this inspection is not proof that an upload is authentic or consented.
Upload-time moderationScoped control
Sightengine NSFW & minor screening
Two-tier automated scanning of every upload; minor-likelihood matches are hard-blocked and queued for human review.
Prevents: CSAM, even at upload-time before any view occurs.
Upload-time moderationScoped control
Public mission, banned-niches, 2257
Plain-English public policy pages stating creator/member age floors, banned content, and 2257 records custodian.
Prevents: Plausible-deniability defenses; the platform's standards are public, dated, and auditable.
Responsive infrastructureScoped control
Triage queue + 24-hour SLA
Reports route to a moderation queue with severity-based routing; acknowledgement under 24 hours, action target under 24 hours for severity-1 cases.
Prevents: Stale reports, content lingering for days while a person tries to get it removed.
Responsive infrastructureScoped control
NCMEC + IWF + StopNCII integration
Hash-matching against industry CSAM and NCII hash lists; confirmed matches are reported to NCMEC under 18 USC § 2258A.
Prevents: Re-circulation of known harm material; failure to report under federal mandate.
Responsive infrastructureScoped control
Quarterly transparency reports
Anonymized quarterly stats on removal requests received, response times, action rates, appeal outcomes, NCMEC reports filed.
Prevents: Opaque moderation; regulators / press / partners cannot independently audit posture.
Responsive infrastructureScoped control
Law enforcement liaison
Dedicated legal@chatalystar.com inbox for valid legal process; preservation requests honored; subpoena response under SLA.
Prevents: Investigators stuck behind a contact form; preservation requests dropping on the floor.

Implemented in developmentCounsel approval and production rollout unverified

California AB 1705: upload safeguards

Enacted AB 1705 (Chapter 890) (official source)California Government Code §9600 (official source)

Current rollout boundary

§22614(a)(2): statement and contact

Actual control: A separate, explicit typed-name assent is tied to one identified file, not a generic future batch. A server-allocated asset slot is bound to the final immutable storage identity/version and any server-verified derivative. File selection, filename, or other client metadata is not proof of age or consent.
Scope: For each individual depicted, the three certifications are that they were adults when the content was created; they consented to being depicted; and they consent to the content being uploaded to Chatalystar. Adulthood at creation is distinct from our creator’s current 21+ publishing rule. Each is made under penalty of perjury. This is a plain-language summary, not final declaration wording. Exact wording and execution need counsel approval.
Status: Code reviewed; declaration enforcement remains off pending approved cutover.

§22614(c): verified email

Actual control: Before supported uploads after approved cutover, the declaring person uses their own verified contact email and a reusable server-verified PIN. A fresh PIN is not required for every file. In Crew Mode, the person making the declaration uses their own verified contact and assent; this is not automatically the creator’s signature.
Scope: Supported creator direct, presigned, and multipart uploads; long-form uploads; alternate Vault; custom thumbnails; voice clips; and Crew Mode. Ambiguous, direct-admin, member, and API-key ingress is paused at cutover unless it has an explicitly reviewed attributable path.
Status: Supported-path code reviewed; deployed ingress coverage and cutover are unverified.

§22614(b): records readily available for at least seven years

Actual control: The restricted archive is designed to preserve the exact declaration text/version/hash, typed signature, server submission time, verified contact and email evidence, and linkage to the immutable content version and derivatives. Founder-only authorized retrieval/export is checked server-side and audited; these are never public or customer evidence.
Scope: The seven-calendar-year floor runs from submission, not content creation or short-lived session/token expiry. It is independent of ordinary account deletion, session revocation, and Vault cleanup. In the implemented design, archive failure blocks destructive creator deletion.
Status: Retention guards depend on migration and application deployment; production schema, archive, and access are unverified.

§§22612 and 22614(a)(1): ordinary care

Actual control: Declaration evidence complements performer releases, creator identity verification, moderation, ordinary care, reporting, and removal. Identity verification and cryptographic provenance support attribution; neither independently proves every depicted person’s age or consent, and a declaration is not immunity.
Scope: Publication and republication checks require evidence plus existing moderation and consent review at cutover. There is no blanket AI or private-message exemption. No blanket grandfathering, automatic recertification, mass removal, or fabricated historical evidence is intended.
Status: Control mapping reviewed; legal scope, historical policy, and production operation remain pending or unverified.

Records, retention, and disposal

Archive and retention do not override unrelated privacy rights or constitute a general media-retention policy. For the current notice, see upload-evidence retention, Terms, and 2257 records.

Historical review is evidence review, not a verdict

Complete: Evidence appears present for review.
Incomplete: One or more expected records or links are missing.
Contradictions: Available evidence conflicts and needs investigation.
Unknown: The evidence does not establish the relevant fact.

What remains before reliance

To report a concern, use Trust reporting or contact the Trust team.

How we compare

Where every platform sits

Internal composite index: identity binding · per-upload accountability · response SLA · NCMEC integration · transparency

Internal assessment · Q1 2026

Future hardware-rooted provenance

Aspirational future direction, not a deployed control

100

Index 100

Chatalystar

Internal illustrative assessment · per-session attestation · HMAC chain · 24h SLA

Index 92

Pornhub (post-2020 reset)

Verified-uploader-only after the December 2020 purge

Index 84

OnlyFans

Identity at signup; bulk-uploads not per-asset bound

Index 78

Fansly

Identity at signup; reactive moderation queue

Index 72

Mainstream subscription median

Industry baseline for paid creator platforms

Index 65

XVideos / XHamster

Bulk-uploaded; after-the-fact moderation only

Index 35

Vibe-coded AI companion sites

Anonymous prompts; no identity binding; no audit trail

Index 8

Telegram channels / dark net

Zero verification; zero accountability

Index 1

Standards and controls we map to

The table is a product mapping to relevant principles and duties. It does not establish unconditional legal compliance, certification, or universal coverage.

Standard / framework	Requirement	Chatalystar control / scope	Status
Tech Coalition (Voluntary Principles) /banned-content · /trust/whitepaper	Adopt safety-by-design and transparency for child sexual exploitation	Sightengine minor screening hard-blocks at upload; quarterly transparency reports; public banned-content policy	Existing mapping
NCMEC (18 USC § 2258A) /trust#contact · legal@chatalystar.com	Mandatory reporting of apparent CSAM to NCMEC CyberTipline	Automated CyberTipline submission for confirmed matches; preservation per § 2258A(h); LE liaison inbox	Existing mapping
EU DSA Article 14 /trust/report	Notice-and-action mechanism with statement of reasons	Public /trust/report form; tracking reference; SOR returned to reporter and content owner	Existing mapping
EU DSA Article 16-17 /community-guidelines	Trusted-flagger priority + restriction reasoning	Trusted-flagger lane in triage queue; restrictions accompanied by published policy citation	Existing mapping
EU DSA Article 24 (transparency) /trust#transparency	Annual transparency report with quantitative moderation data	Quarterly cadence (exceeds annual minimum); per-category counts; appeal outcomes; mean response time	Existing mapping
EU DSA Article 34 (risk assessment) /trust/whitepaper	Annual systemic-risk assessment for VLOPs (and voluntary for smaller platforms)	Risk register published with /trust whitepaper Annex C; reviewed and re-published quarterly	Existing mapping
UK Online Safety Act (Illegal Content Duty) /trust/report	Proactive measures to prevent illegal content; risk assessment; reporting routes	Pre-publication minor screening; banned-content public list; direct in-content reporting with /trust/report fallback; 24h SLA	Existing mapping
UK Online Safety Act (Children's Safety Duty) /why-21 · /community-guidelines	Highly effective age assurance for adult content	Veriff government-ID + biometric liveness for creators; age-confirmed gate at member NSFW unlock	Existing mapping
California AB 1394 / SB 1381 (NCII) /trust#contact	Reasonable steps to remove non-consensual intimate imagery within 48 hours of report	Stop NCII hash integration; severity-1 routing; 24-hour action target (exceeds 48h floor)	Existing mapping
California AB 1705 (§ 22614) /trust#ab-1705	Before-upload sworn age/consent statement and contact information; verified email; readily available retention for at least seven years from submission	Identified per-file declaration, reusable server-verified email, deletion-independent restricted evidence archive. Supported ingress only after approved cutover; declaration enforcement defaults off. Counsel approval and production rollout unverified.	Development · review / rollout pending
18 USC § 2257 / § 2257A /2257	Records-keeping for performers in sexually explicit content	Veriff creator verification records; upload attribution through available session/provenance records; named custodian. Attribution alone does not verify every depicted performer's age or consent.	Existing mapping
Texas SB 12 / Utah SB 287 / Louisiana HB 142 (state age-verification) /age-verification	Reasonable age-verification before adult content access in regulated states	State-aware geolocation gate routes to commercial age verification flow before NSFW exposure	Existing mapping
Stop NCII (operational integration) /trust/whitepaper Annex B	Hash-match against industry NCII database before publication	Hash-check on upload; matches hard-blocked and routed to dedicated NCII queue	Existing mapping
IWF hash list (CSAM) /trust/whitepaper Annex B	Operational use of IWF hash list for known-CSAM blocking	IWF list integrated alongside Sightengine; matches hard-blocked + NCMEC report	Existing mapping

Live transparency data

Loading available transparency data…

Funds flow

How member-to-creator settlement works

This describes the deployed wallet controls for member-to-creator settlement.

Member-to-creator settlement

Separate member-side contribution

The platform contribution is disclosed separately and added on top of the listed creator-side amount. It is not deducted from the creator's listed price.

Member

Self-custody wallet

Member-funded USDC / Crystal balance

Settlement

Direct Base transfer

On-chain USDC transfer at purchase

Creator

Self-custody wallet

Creator receives the creator-side amount

Chatalystar does not hold the member's Crystal/USDC balance, take custody of the creator's wallet, or control the creator's private key.
A confirmed on-chain transfer cannot be reversed by Chatalystar, and Chatalystar cannot withdraw from either wallet.

Part 2Scope reviewed against deployed controls

Digital Intimacy in the AI Age

Digital intimacy requires people to know what is real, what is fictional, and what is generated. The labels below describe the product modes and the limits of the safeguards we can verify today.

Real people

Stars

Relevant law / duty: 18 USC § 2257 / § 2257A records framework

Fictional AI characters

Muses

Relevant law / duty: EU AI Act Article 50(1) (official source); California SB 243, where applicable (official source)

A consented Star-linked AI mode

Simulated Presence

Relevant law / duty: EU AI Act Article 50(1) (official source); California SB 243, where applicable (official source)

Generated images

Adult access is layered, not one universal switch

Members: must be 18+ only, must confirm they are 18+ and provide their date of birth, and must pass Veriff age verification using government ID and biometrics before viewing explicit adult content. These required initial age and date-of-birth gates do not replace the required Veriff verification.
Creators: must be 21+ and must complete the creator publishing verification flow with Veriff age verification using government ID and biometrics before publishing.
Public visitors: receive public-safe previews only. Adult-only items require authentication, completed Veriff age verification using government ID and biometrics, and a non-blocked region.
Adult-only media and interactions: require Veriff age verification using government ID and biometrics, in addition to the account, date-of-birth, entitlement, human moderation, age-attestation, and regional gates required by the specific surface. Human moderation and age-attestation controls prevent explicit content from being shown without the required Veriff verification.

See age verification, community guidelines, and banned content for the operational policies.

Relevant law / duty: EU DSA Articles 28 and 34 risk mapping; UK age-assurance duties (Online Safety Act) (official source); Texas SB 12 / Utah SB 287 / Louisiana HB 142 state age-verification mapping

Direct lines

Report content

Open report form

trust@chatalystar.comstandard

Press, researchers, regulators, partners

Policy questions, transparency-data requests, briefing requests, due-diligence inquiries.

Replied within 48 business hours

legal@chatalystar.comurgent

Law enforcement and legal process

Subpoenas, preservation requests, emergency disclosure requests, service of process, and other legal correspondence.

Acknowledged within 24 hours · Emergency under 6 hours

dmca@chatalystar.comstandard

Standard DMCA notice elements (17 USC § 512(c)(3)) or international equivalent. See /dmca for the form.

Acknowledged within 48 hours

2257@chatalystar.cominfo

18 USC § 2257 records inspection requests

Written request to the records custodian per /2257; agency or counsel identifier.

Coordinated by appointment per § 2257 protocol

support@chatalystar.comstandard

Members and creators with account questions

Anything that isn't a takedown / policy / law-enforcement matter.

Replied within 1 business day

The white paper

v1.0 · April 2026

Technical document covering problem framing, scoped architecture (Phase 1 + Phase 2), threat model, mapping to standards, verification approach, risk register, and the future roadmap.

· Problem framing & scope
· Identity binding chain (Phase 1)
· Responsive infrastructure (Phase 2)
· Threat model & abuse cases
· Standards mapping (DSA · OSA · § 2257)
· Verification approach & methodology
· Annex A — cryptographic primitives
· Annex B — hash-list integrations
· Annex C — Article 34 risk register
· Annex D — methodology for comparison scores

Read in browser Download PDF

Embed our standards comparison

Free for editorial, research, policy, and creator-platform use. The iframe is sandboxed (no executable JS), ships with Schema.org structured data, and includes a do-follow backlink.

Use this comparison on your site

Sandboxed iframe + Schema.org structured data + do-follow backlink. Free for editorial, research, policy, and creator-platform use.

Bar chart with the top 5 platforms.

<iframe src="https://chatalystar.com/trust/embed?variant=medium"
        width="600" height="360"
        loading="lazy" referrerpolicy="no-referrer"
        sandbox="allow-same-origin"
        title="Chatalystar — Trust & Safety Comparison"
        style="border:0;max-width:100%;display:block"></iframe>
<p style="font:12px system-ui,sans-serif;color:#666;margin:6px 0 0">
  Powered by <a href="https://chatalystar.com/trust" rel="external" target="_blank">Chatalystar Trust &amp; Safety</a>
</p>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"CreativeWork","name":"Chatalystar Trust & Safety Comparison","url":"https://chatalystar.com/trust","publisher":{"@type":"Organization","name":"Chatalystar","url":"https://chatalystar.com"}}</script>

Open the live embed in a new tab →Read methodology in the white paper →

The landscape

How creator uploads are anchored

Veriff identity verification (21+)

Wallet binding (EIP-712)

Vault PIN (out-of-band)

Per-session signed attestation

Per-upload binding

HMAC chain of custody

Container & EXIF inspection

Sightengine NSFW & minor screening

Public mission, banned-niches, 2257

Triage queue + 24-hour SLA

NCMEC + IWF + StopNCII integration

Quarterly transparency reports

Law enforcement liaison

California AB 1705: upload safeguards

Current rollout boundary

§22614(a)(2): statement and contact

§22614(c): verified email

§22614(b): records readily available for at least seven years

§§22612 and 22614(a)(1): ordinary care

Records, retention, and disposal

Historical review is evidence review, not a verdict

What remains before reliance

How we compare

Where every platform sits

Standards and controls we map to

Live transparency data

How member-to-creator settlement works

Member-to-creator settlement

Digital Intimacy in the AI Age

Stars

Muses

Simulated Presence

Synthetic media

Synthetic media and real-person consent

Crisis and self-harm safety

Adult access is layered, not one universal switch

Direct lines

Report content

The white paper

Embed our standards comparison

Use this comparison on your site

Related policies

The landscape

How creator uploads are anchored

Veriff identity verification (21+)

Wallet binding (EIP-712)

Vault PIN (out-of-band)

Per-session signed attestation

Per-upload binding

HMAC chain of custody

Container & EXIF inspection

Sightengine NSFW & minor screening

Public mission, banned-niches, 2257

Triage queue + 24-hour SLA

NCMEC + IWF + StopNCII integration

Quarterly transparency reports

Law enforcement liaison

California AB 1705: upload safeguards

Current rollout boundary

§22614(a)(2): statement and contact

§22614(c): verified email

§22614(b): records readily available for at least seven years

§§22612 and 22614(a)(1): ordinary care

Records, retention, and disposal

Historical review is evidence review, not a verdict

What remains before reliance

How we compare

Where every platform sits

Standards and controls we map to

Live transparency data

How member-to-creator settlement works

Member-to-creator settlement

Digital Intimacy in the AI Age

Stars

Muses

Simulated Presence

Synthetic media

Synthetic media and real-person consent