01Purpose and scope

Ident.ink uses deterministic controls to detect high-confidence breaches of its Terms of Use, Community Guidelines, security rules and product terms before affected plaintext content is stored or published. The controls protect direct messages, Network posts and comments, commerce listings and other explicitly connected surfaces.

Detection is not a declaration that a person committed an offence. Contract enforcement and criminal law are different. Ident.ink does not use this system to invent fines, determine criminal guilt or replace a court, regulator or competent human reviewer.

02Logic used

Each detector has a stable rule identifier, controlling document and clause, match type, action and plain-language explanation. Current detectors use bounded exact phrases and narrowly defined credential patterns. User-supplied regular expressions and arbitrary executable rules are not permitted.

Before matching, text is length-limited, control characters are removed and Unicode and spacing are normalised. The system records the rule, surface, action, detector version, time and a one-way evidence hash. It does not put an exposed credential into the enforcement ledger.

03Automatic actions

• Block: a high-confidence submission is rejected before plaintext storage.
• Quarantine: content is withheld from publication and an enforcement event is created.
• Rate and security controls may separately reject abusive repetition, injection attempts, unauthorised access or infrastructure attacks.
• Serious account, payment, employment or other legally significant consequences are not inferred solely from a phrase match. Those require the safeguards and review applicable to that decision.

04Limits and protected contexts

Automated matching can be wrong. It does not inspect end-to-end encrypted message plaintext because Ident.ink does not possess that plaintext. It also does not treat a user reporting a prohibited phrase through Support as the person committing the reported conduct.

Rules are intentionally narrow. Ident.ink may update them for new abuse patterns, but a rule must remain connected to a published policy and cannot download code, contact an arbitrary destination or execute user input.

05Notice, challenge and human intervention

A blocked or quarantined submission returns a policy reference and explanation. The affected account can challenge the event through the authenticated appeal endpoint or Ident.ink Support, explain context and request human intervention. An upheld or dismissed outcome is recorded with the reviewer and time.

Requesting review does not disadvantage an account. Urgent temporary safeguards may remain while a credible safety, fraud or security risk is assessed. Mandatory rights, regulator access and court remedies are unaffected.

06Significant automated decisions

A deterministic content block is normally a product-safety action, not a solely automated legal finding. If Ident.ink proposes to make a decision based solely on automated processing that has a legal or similarly significant effect, it must identify a lawful basis and apply the safeguards required by the UK GDPR as amended by the Data (Use and Access) Act 2025.

Those safeguards include meaningful information about the decision, an opportunity to make representations, a route to human intervention and correction of inaccurate input. Special-category information receives the additional restrictions required by law.

07Privacy, retention and accountability

Policy events are project or account scoped where applicable, access controlled and included in security and moderation audit boundaries. Evidence hashes help identify repeated identical submissions without retaining a second plaintext copy. Operational retention follows the Privacy Notice and may be extended for a dispute, fraud investigation or legal hold.

Ident Group Ltd regularly tests the controls against expected allowed and prohibited examples. Material changes are versioned through the Legal Centre and Transparency record.