The whole product
Every module, and why a safeguarding lead would want it
14 capabilities, grouped the way an organization thinks about them. Each one says what it is, what that means in practice, and what it changes for the people you are responsible for.
Safety and oversight
The part a consumer chat app cannot give you
Five capabilities that exist for one reason: an adult and a young person are talking, and somebody responsible has to be able to see it.
Open oversight
Every conversation between an adult and a young person is open to the leaders who oversee that young person's section — worked out at the moment somebody reads it, never from a list anybody has to maintain.
- What that means
- There is no private mode to switch on and no hidden thread to discover afterwards, because the platform never creates one.
- Why it matters
- When a parent asks who else can read this, you can answer straight away instead of going to find out.
Chat curfew
Conversations open and close automatically on the hours your organization sets, in the time zone that organization runs on.
- What that means
- The curfew is enforced on the server, so it holds whatever a phone, a modified client or a determined adult tries to do.
- Why it matters
- No volunteer is in a teenager's phone at one in the morning, and no volunteer has to decide alone whether to answer.
Message integrity and audit
Messages cannot be edited once sent. Deleting one removes it from the conversation and not from the record.
- What that means
- The deleted text, its sender and both timestamps are kept for leader review, and the thread shows plainly that something was removed.
- Why it matters
- If a concern ever becomes an investigation, the evidence is there because it was always there — not because somebody thought to save it.
Content moderation
A word list, six safeguarding patterns and a language model reading for hostility all run before a message is delivered, and a leader can step in on anything by hand. Pictures are built and deliberately switched off until the child protection agreements are in place.
- What that means
- Screening happens between the two people rather than in a report somebody reads the following week.
- Why it matters
- The thing you would never have let a young person see is stopped, instead of apologised for afterwards.
Concern alerts
Messages are checked for the six behaviours that precede harm: being asked to keep a secret, to move to another app, to hand over contact details, to meet up, to send a photo, and language suggesting a young person is at risk from themselves. Single messages, and a worrying direction building over weeks.
- What that means
- A flag goes to a named supervisor with its category, the full thread and the audit trail already attached to it.
- Why it matters
- The quiet signal a stretched volunteer might read past reaches somebody whose job it is to act on it.
Messaging
The conversations your organization actually has
Three tiers of reach and nothing beyond them. Every tier carries the same oversight, retention and curfew rules.
Messaging rules
Three tiers of conversation: one volunteer with one young person, one leader with a group, and organization-wide broadcast.
- What that means
- Who may open a conversation with whom follows your real reporting lines rather than whoever happens to be in a contact list.
- Why it matters
- Nobody has to police who is talking to whom, because the structure settled it before the first message.
Broadcast
One announcement to a full collective, with the audience chosen and the right to send it set per organization.
- What that means
- Deliberately an announcement channel and not an events product, so it stays small enough to keep under the same rules as everything else.
- Why it matters
- Word reaches everyone at once, so nobody has to start a group chat on the side to pass it on.
People and access
Who gets in, and on whose authority
A closed community is only closed if joining it is deliberate. These are the gates in front of the door.
Roles and access
Everyone holds one of five roles — organization owner, supervisor, leader, young person, or parent — and every screen, route and database policy is decided by the role the reader holds at the moment they ask.
- What that means
- There is no open signup. An account exists because somebody with authority invited it, and suspending a person closes their access on their next request rather than at their next sign-in.
- Why it matters
- The answer to “who could have seen this?” is a property of the system rather than a matter of trusting that nobody shared a password.
Invitation and enrolment
Membership is invite-only, every new member is approved by an admin, and invitations expire and can be revoked.
- What that means
- There is no public sign-up page, so nobody joins the community by finding a link to it.
- Why it matters
- The people in your organization's chat are the people you put there. That is checkable, not assumed.
Consent
Age is captured at sign-up, and parental consent is recorded before a young person can take part in anything.
- What that means
- Participation stays blocked until consent is valid, and the evidence is stored where a reviewer can actually retrieve it.
- Why it matters
- Nobody has to remember whether the form came back, and no young person slips into a conversation while it is still missing.
Guardian view-only access
A parent or guardian can be given read access to their own young person's conversations, and nothing beyond reading them.
- What that means
- Optional, and switched on per organization — a guardian never becomes a participant in a thread they are watching.
- Why it matters
- A parent can be reassured without being in the room, and their child can still speak freely to the leader who is helping them.
Administration
Configured for your organization, not rebuilt for it
One platform, many organizations. What differs between them is settings, and settings are changed by your own people.
Organization setup
Which tiers you use, who may broadcast, your curfew hours, your moderation rules and whether guardians get access are all settings.
- What that means
- That is configuration rather than a custom build, and every change to it is attributed to the person who made it.
- Why it matters
- Your chapters can differ where they genuinely differ, without waiting on a release to change one hour of one curfew.
Sections and hierarchy
A national body, its provinces, its local sections and the people in each — modelled as a tree, with everyone attached to the part of the organization they actually belong to.
- What that means
- Oversight and messaging rules travel that tree. A supervisor sees the sections beneath them and no others, and a rule written for one province leaves the rest untouched.
- Why it matters
- Nobody has to maintain a list of who watches whom. It falls out of the structure the organization already has, so it stays right when people move.
Separation between organizations
One platform serves many organizations, each isolated from the others in the database itself.
- What that means
- Isolation is enforced by row-level security rather than by application code remembering to filter every query.
- Why it matters
- Another organization's safeguarding records are not one forgotten WHERE clause away from yours.
What happens next
None of this is worth reading about if it does not fit your organization
Tell us how many young people you serve, how many countries you operate in and what your safeguarding requirements are. We will show you these modules configured for that, on a pilot with one chapter, before anything is signed.