After building Trust & Safety infrastructure at Amazon, Google, and TikTok, I've seen the same pattern repeatedly: investors underestimate Trust & Safety risk until it becomes an existential threat to portfolio companies.

Here's what investors should evaluate during Trust & Safety due diligence, and the red flags that signal serious problems.

Why Trust & Safety Matters for Investors

Trust & Safety failures can destroy company value faster than almost any other operational risk:

Financial Impact:

  • GDPR fines up to 4% of global revenue
  • DSA fines up to 6% of global revenue
  • AI Act fines up to €35M or 7% of global revenue
  • COPPA violations up to $51,744 per violation
  • Class action settlements (often 8-9 figures)

Operational Impact:

  • Platform bans (app store removal)
  • Payment processor suspension
  • Advertiser boycotts
  • Market access restrictions (especially EU)

Reputational Impact:

  • User exodus following safety incidents
  • Media coverage of safety failures
  • Difficulty recruiting talent
  • Lost partnership opportunities

Exit Impact:

  • Failed M&A due to unquantified safety liabilities
  • Delayed IPO timelines pending compliance work
  • Valuation discounts for identified safety risks

What to Evaluate During Due Diligence

1. Trust & Safety Team Structure

Red Flags:

  • No dedicated Trust & Safety headcount
  • Trust & Safety reports to Customer Support (not a peer function)
  • No Trust & Safety representation in product development
  • Entire safety function outsourced with no internal oversight

Green Flags:

  • Dedicated Trust & Safety leader at VP/Director level
  • Cross-functional safety review process for new features
  • Clear escalation paths for safety incidents
  • In-house expertise supplemented (not replaced) by vendors

Questions to Ask:

  • How many FTE dedicated to Trust & Safety?
  • What's the organizational reporting structure?
  • Who has final decision authority on safety vs. growth trade-offs?
  • How are safety considerations incorporated into product development?

2. Content Moderation Infrastructure

Red Flags:

  • No proactive content detection (purely reactive to reports)
  • Average response time to user reports >72 hours
  • No quality assurance on moderation decisions
  • Single moderation vendor with no backup
  • No audit trail of moderation decisions

Green Flags:

  • Hybrid human + AI moderation
  • Sub-24 hour response to high-severity reports
  • Regular quality audits (weekly/monthly)
  • Geographic and vendor diversification
  • Comprehensive decision logging and appeals process

Questions to Ask:

  • What percentage of policy-violating content is detected proactively vs. user-reported?
  • What's the average time to action on different violation types?
  • How do you ensure moderation quality and consistency?
  • What happens if your primary moderation vendor becomes unavailable?

Data to Request:

  • Volume of content moderated (last 12 months)
  • Action rates by policy category
  • Appeal rates and overturn rates
  • Moderator accuracy scores

3. Regulatory Compliance Posture

Red Flags:

  • "We don't operate in the EU so we ignore GDPR/DSA"
  • No regulatory monitoring system
  • Reactive compliance (waiting for enforcement)
  • Generic terms of service copied from competitors
  • No privacy policy or outdated by >2 years

Green Flags:

  • Proactive regulatory intelligence system
  • Regular legal counsel engagement on compliance
  • Market-specific compliance strategies
  • Regular policy updates reflecting regulatory changes
  • Clear data governance and privacy program

Questions to Ask:

  • Which regulations apply to your platform? (GDPR, DSA, AI Act, COPPA, CCPA, etc.)
  • How do you monitor regulatory changes?
  • Have you received any regulatory inquiries or enforcement actions?
  • What's your process for updating policies in response to new regulations?

Critical Documents to Review:

  • Privacy policy and terms of service
  • Data processing agreements (DPAs)
  • Any regulatory correspondence or submissions
  • Compliance roadmap for upcoming regulations

4. Safety Incident History

Red Flags:

  • "We've never had a safety incident" (usually means poor detection)
  • No incident response plan
  • Previous incidents handled inconsistently
  • Safety incidents not tracked or analyzed
  • Delayed disclosure of serious incidents

Green Flags:

  • Documented incident response playbook
  • Clear severity definitions and escalation triggers
  • Post-incident review process and learning
  • Regular crisis simulation exercises
  • Transparent communication with stakeholders

Questions to Ask:

  • What was your most serious safety incident in the last 24 months?
  • How did you respond?
  • What did you learn and what changed as a result?
  • Who is authorized to make decisions during a crisis?

Data to Request:

  • Safety incident log (past 24 months)
  • Post-mortem reports for major incidents
  • Metrics on incident detection and response time

5. Child Safety Program (If Applicable)

Red Flags:

  • Age verification is self-reported with no verification
  • No proactive CSAM detection
  • No dedicated child safety team or expertise
  • Generic safety features applied to all users regardless of age
  • No partnerships with child safety organizations

Green Flags:

  • Age-appropriate safety features
  • CSAM detection using PhotoDNA/hashing
  • Dedicated child safety expertise
  • Regular engagement with NCMEC, IWF, or equivalent
  • Proactive measures beyond legal minimums

Questions to Ask:

  • How do you verify user ages?
  • What additional safety measures apply to minors?
  • How do you detect and respond to CSAM?
  • How many CSAM reports did you file with NCMEC last year?

Critical for Platforms with Users <18:

  • COPPA compliance (US)
  • Age-Appropriate Design Code compliance (UK)
  • DSA obligations for protecting minors (EU)

6. Technical Safety Infrastructure

Red Flags:

  • No automated detection systems
  • Safety tools built entirely in-house (reinventing the wheel)
  • No API rate limiting or abuse prevention
  • Single-region infrastructure (no geographic redundancy)
  • No disaster recovery plan for safety systems

Green Flags:

  • Industry-standard tools (hashing, classifiers, etc.)
  • Layered detection (automated + human + user reports)
  • Rate limiting, CAPTCHA, email verification
  • Geographic distribution of safety infrastructure
  • Regular penetration testing and security audits

Questions to Ask:

  • What tools and vendors do you use for safety detection?
  • How quickly can you deploy safety updates in response to new threats?
  • What's your uptime SLA for safety systems?
  • How do you handle coordinated attacks or brigading?

Technical Assessment:

  • Review architecture diagrams
  • Understand data retention and deletion procedures
  • Evaluate logging and audit capabilities
  • Assess scalability of safety systems

7. Product Safety Roadmap

Red Flags:

  • No safety features planned in product roadmap
  • Safety features only added reactively after incidents
  • Product and safety teams don't communicate regularly
  • Safety considerations not part of launch checklist

Green Flags:

  • Safety review required for all new features
  • Dedicated roadmap for safety improvements
  • Regular product-safety sync meetings
  • Safety metrics tracked alongside growth metrics

Questions to Ask:

  • How do you balance growth and safety in product decisions?
  • What safety features are planned for next 6-12 months?
  • How do you decide which safety investments to prioritize?
  • Give an example of a feature that was modified or delayed due to safety concerns.

Red Flags That Should Stop a Deal

Some Trust & Safety issues are so severe they should pause or kill an investment:

Existential Red Flags:

1. Active regulatory enforcement action

  • Ongoing investigation by FTC, state AG, EU Commission, etc.
  • Unresolved COPPA violation
  • Open GDPR or DSA enforcement proceeding

2. Pattern of serious safety incidents

  • Multiple high-profile incidents in past 12 months
  • Incidents involving harm to minors
  • Incidents resulting in legal action or settlements

3. Fundamental architecture problems

  • No way to delete user data (GDPR "right to deletion")
  • No content moderation at all
  • No age verification for platform with child users
  • User data stored in insecure manner

4. Dishonest or evasive responses

  • Claiming compliance when clearly non-compliant
  • Refusing to provide safety metrics
  • Obvious gaps between stated policies and actual practices

How to Quantify Trust & Safety Risk

Include these in your investment models:

Known Liabilities:

  • Estimated cost to remediate identified compliance gaps
  • Outstanding regulatory fines or settlements
  • Litigation reserves for active safety-related lawsuits

Compliance Capex:

  • Safety team headcount needed to reach industry standard
  • Technology and vendor costs for compliance infrastructure
  • Legal and consulting costs for regulatory work

Operational Risk Scenarios:

  • Best case: Continue current trajectory
  • Base case: Proactive compliance investment required
  • Downside case: Regulatory enforcement requiring rapid remediation
  • Worst case: Platform ban, major fine, or existential safety incident

Exit Risk Adjustment:

  • Valuation discount for unquantified safety risks
  • Timeline extension for IPO or M&A if compliance work required
  • Deal structure considerations (escrow for unresolved liabilities)

Trust & Safety Due Diligence Checklist

Use this checklist during investment evaluation:

Team & Organization:

  • ☐ Dedicated Trust & Safety leader identified
  • ☐ Trust & Safety FTE count documented
  • ☐ Reporting structure reviewed
  • ☐ Cross-functional safety processes confirmed

Operations:

  • ☐ Content moderation metrics reviewed (volume, action rates, response times)
  • ☐ Quality assurance processes documented
  • ☐ Vendor and geographic diversification confirmed
  • ☐ Decision logging and appeals process verified

Compliance:

  • ☐ Applicable regulations identified
  • ☐ Privacy policy and terms of service reviewed
  • ☐ Regulatory correspondence reviewed
  • ☐ Compliance roadmap for upcoming regulations documented

Incidents:

  • ☐ Safety incident history reviewed
  • ☐ Incident response plan documented
  • ☐ Post-mortem reports analyzed
  • ☐ Learning and improvements identified

Child Safety (if applicable):

  • ☐ Age verification methods reviewed
  • ☐ Age-appropriate safety features confirmed
  • ☐ CSAM detection systems verified
  • ☐ NCMEC reporting confirmed

Technical Infrastructure:

  • ☐ Safety systems architecture reviewed
  • ☐ Detection tools and vendors documented
  • ☐ Scalability and redundancy confirmed
  • ☐ Security audit results reviewed

Product Roadmap:

  • ☐ Safety review process confirmed
  • ☐ Safety roadmap reviewed
  • ☐ Safety metrics tracked
  • ☐ Trade-off decision examples documented

Risk Quantification:

  • ☐ Compliance gap remediation costs estimated
  • ☐ Required safety headcount calculated
  • ☐ Regulatory risk scenarios modeled
  • ☐ Exit impact assessed