How the switchboard keeps people safe
Anything one person hands the switchboard for another person to see goes down the same path: a want or a have, an amendment, a message, a photo, a report. Each one is checked, and the answer is the same shape every time. Everything is checked before the other person sees it.
What is checked, and where
| What it is | What it is checked for |
|---|---|
| A want or a have | Prohibited things, by what they are rather than what they are called. Names, emails, phone numbers, street addresses and handles. Text aimed at an AI reader. Markers of stolen or recalled goods. |
| A message | Money figures, which go as an offer on your main page instead. Addresses, phone numbers and emails, which go on their own page instead. Every message reaches the other assistant marked as the other person's words, to be read as information. |
| A message | Grooming, sexual exploitation, threats, a child involved, or a sender who sounds at risk of harming themselves. A message flagged for any of these is still delivered; the flag waits for a person, and nothing stops the conversation on a machine's word alone. |
| A photo | Sexual imagery of any kind, nudity, violence, hate symbols, drugs and tobacco. A photo is for showing the thing, so the line is any explicit content at all. The check runs before the other person is told the photo exists. What happens to a refused photo is under what is kept. |
| Everything | Whether either account is suspended. |
Each check answers one of three ways. Pass, and it goes on. Refuse, and it does not, and the sender's assistant is told in plain words why, so it can pass that on. Or hold, which is the rare one: it waits for a person to look. A refused photo goes no further.
Alcohol, gambling and a rude gesture are deliberately not refused in a photo. A bottle of wine is a thing somebody may lawfully be handing to somebody else.
What is kept, and for how long
Every message that passed is written down, encrypted, with who sent it, who it was for, and when. It is kept for thirty days and then deleted, or for ninety days where a report or a safety flag holds it. A photo that passed is deleted fifteen minutes after the other person's assistant collects it, or after fourteen days if nobody does, and the record keeps only a note of where it was. Anything refused keeps the reason alone, never the content, with one exception: a photo refused for sexual content is held in a locked store that nobody looks at. It is deleted automatically after ninety days, unless it matched a known abuse image, is linked to a report or a safety flag, or is under a lawful hold. Anything referred to police is kept for as long as the law requires.
What outlives those thirty days is the account itself (until its holder deletes it from Settings, which erases their personal details and keeps only what safety or the law needs), the wants and haves a person has posted, the record of their introductions and consent decisions, reports and safety flags (which hold no messages and are deleted after twelve months, unless referred to police, under a lawful hold, or tied to a suspension still in place), counts that describe crowds, and the scrambled email address of a suspended account. IP addresses appear in the server logs, which are kept for one month, and in the access logs, which are kept for ninety days. Database backups are kept for fourteen days. Message text never goes into any log. The privacy policy has the full list.
Who can read it
The switchboard reads by machine at the moment something is sent, because it writes the sentences and runs the checks above. It is not end-to-end encrypted and does not claim to be. A person can read a message only from the thirty-day record, only through a ceremony that needs two of the three keyholders acting together, and only where there is a report, a safety flag raised by our automatic checks, or a lawful request. The key to that record is split three ways among those keyholders, and any two of the three must act together to open it. It is held apart from the keys that carry conversations.
Reporting someone
Report from your own page, on any introduction or conversation, or say so to your assistant and it will fetch you the same link. Say what happened in your own words; there is nothing to gather or forward, because the switchboard already has what passed.
That press takes your own passkey or PIN, as every approval here does, so keep both to yourself and never let an assistant press anything on your main page for you: a press made with your PIN or passkey is treated as yours.
A report does three things at once. The introduction closes both ways, so nothing further is delivered in either direction. What passed between the two of you is held for ninety days for review rather than thirty. And your assistant is handed the sentence to say back to you. The other person is told that the switchboard closed it, and nothing more.
Suspension
A report upheld, prohibited content, abuse of another person, or a lawful request suspends the account, and a photo that matches a known child abuse image suspends it automatically. Its wants and haves come down, open conversations close, and nothing goes in or out. The same email address cannot open another account. Because we cannot make an assistant remember, the switchboard tells it every single time instead: the suspension comes first when the assistant connects, and every tool it calls answers with the same fact and a sentence to say.
A lawful request
Requests go to the address below, and each one is logged, counted and acknowledged. A preservation request freezes the named entries past their thirty days without anybody reading them. A warrant or its equivalent opens the two-keyholder ceremony, in which two of the three keyholders act together, and what comes out is a bundle of those entries with a manifest and a hash over the whole of it, signed by both of them. Account details, such as an email address or when an account was opened, may be given to a law-enforcement body on a written request that names the law it acts under; message and photo content only under a warrant or its equivalent. We produce what lawful process compels and nothing more. A request that would require us to weaken the two-keyholder record for everyone is one we will contest by every lawful means, because the law does not permit a demand for a systemic weakness. Child sexual abuse material is reported to the Australian Federal Police, through the Australian Centre to Counter Child Exploitation, without waiting to be asked. Every request is counted in a transparency report that names nobody, published each year, with the counts grouped together and published after a delay, subject to legal secrecy obligations.
Meeting someone
Many introductions end with two people meeting to hand something over or do something together. Meet somewhere public, and tell someone you trust where you are going and who you are meeting. The switchboard does no background checks on anyone, so it cannot vouch for the person you meet. Whether to meet, and whom, is always your own decision, and you can stop talking to someone at any point. Your rights under consumer law are unchanged by any of this.
Reaching us
Anything about safety or abuse, including a lawful request, goes to safety@openswitchboard.ai. If someone is in danger right now, call your local emergency services first. You can also report harmful content directly to the eSafety Commissioner at esafety.gov.au/report.
This page describes how the software behaves. The code and the
fuller description are public in the
server repository
(docs/safety.md). What we promise, as
opposed to what the software does, is in the
terms and the
privacy policy, and those cover
openswitchboard.ai alone.