Trust & Safety Due Diligence: What Investors Miss When Evaluating Platforms
After building Trust & Safety infrastructure at Amazon, Google, and TikTok, I've seen the same pattern repeatedly: investors underestimate Trust & Safety risk until it becomes an existential threat to portfolio companies.
Here's what investors should evaluate during Trust & Safety due diligence—and the red flags that signal serious problems.
Why Trust & Safety Matters for Investors
Trust & Safety failures can destroy company value faster than almost any other operational risk:
Financial Impact:
- GDPR fines up to 4% of global revenue
- DSA fines up to 6% of global revenue
- AI Act fines up to €35M or 7% of global revenue
- COPPA violations up to $51,744 per violation
- Class action settlements (often 8-9 figures)
Operational Impact:
- Platform bans (app store removal)
- Payment processor suspension
- Advertiser boycotts
- Market access restrictions (especially EU)
Reputational Impact:
- User exodus following safety incidents
- Media coverage of safety failures
- Difficulty recruiting talent
- Lost partnership opportunities
Exit Impact:
- Failed M&A due to unquantified safety liabilities
- Delayed IPO timelines pending compliance work
- Valuation discounts for identified safety risks
What to Evaluate During Due Diligence
1. Trust & Safety Team Structure
Red Flags:
- No dedicated Trust & Safety headcount
- Trust & Safety reports to Customer Support (not a peer function)
- No Trust & Safety representation in product development
- Entire safety function outsourced with no internal oversight
Green Flags:
- Dedicated Trust & Safety leader at VP/Director level
- Cross-functional safety review process for new features
- Clear escalation paths for safety incidents
- In-house expertise supplemented (not replaced) by vendors
Questions to Ask:
- How many FTE dedicated to Trust & Safety?
- What's the organizational reporting structure?
- Who has final decision authority on safety vs. growth trade-offs?
- How are safety considerations incorporated into product development?
2. Content Moderation Infrastructure
Red Flags:
- No proactive content detection (purely reactive to reports)
- Average response time to user reports >72 hours
- No quality assurance on moderation decisions
- Single moderation vendor with no backup
- No audit trail of moderation decisions
Green Flags:
- Hybrid human + AI moderation
- Sub-24 hour response to high-severity reports
- Regular quality audits (weekly/monthly)
- Geographic and vendor diversification
- Comprehensive decision logging and appeals process
Questions to Ask:
- What percentage of policy-violating content is detected proactively vs. user-reported?
- What's the average time to action on different violation types?
- How do you ensure moderation quality and consistency?
- What happens if your primary moderation vendor becomes unavailable?
Data to Request:
- Volume of content moderated (last 12 months)
- Action rates by policy category
- Appeal rates and overturn rates
- Moderator accuracy scores
3. Regulatory Compliance Posture
Red Flags:
- "We don't operate in the EU so we ignore GDPR/DSA"
- No regulatory monitoring system
- Reactive compliance (waiting for enforcement)
- Generic terms of service copied from competitors
- No privacy policy or outdated by >2 years
Green Flags:
- Proactive regulatory intelligence system
- Regular legal counsel engagement on compliance
- Market-specific compliance strategies
- Regular policy updates reflecting regulatory changes
- Clear data governance and privacy program
Questions to Ask:
- Which regulations apply to your platform? (GDPR, DSA, AI Act, COPPA, CCPA, etc.)
- How do you monitor regulatory changes?
- Have you received any regulatory inquiries or enforcement actions?
- What's your process for updating policies in response to new regulations?
Critical Documents to Review:
- Privacy policy and terms of service
- Data processing agreements (DPAs)
- Any regulatory correspondence or submissions
- Compliance roadmap for upcoming regulations
4. Safety Incident History
Red Flags:
- "We've never had a safety incident" (usually means poor detection)
- No incident response plan
- Previous incidents handled inconsistently
- Safety incidents not tracked or analyzed
- Delayed disclosure of serious incidents
Green Flags:
- Documented incident response playbook
- Clear severity definitions and escalation triggers
- Post-incident review process and learning
- Regular crisis simulation exercises
- Transparent communication with stakeholders
Questions to Ask:
- What was your most serious safety incident in the last 24 months?
- How did you respond?
- What did you learn and what changed as a result?
- Who is authorized to make decisions during a crisis?
Data to Request:
- Safety incident log (past 24 months)
- Post-mortem reports for major incidents
- Metrics on incident detection and response time
5. Child Safety Program (If Applicable)
Red Flags:
- Age verification is self-reported with no verification
- No proactive CSAM detection
- No dedicated child safety team or expertise
- Generic safety features applied to all users regardless of age
- No partnerships with child safety organizations
Green Flags:
- Age-appropriate safety features
- CSAM detection using PhotoDNA/hashing
- Dedicated child safety expertise
- Regular engagement with NCMEC, IWF, or equivalent
- Proactive measures beyond legal minimums
Questions to Ask:
- How do you verify user ages?
- What additional safety measures apply to minors?
- How do you detect and respond to CSAM?
- How many CSAM reports did you file with NCMEC last year?
Critical for Platforms with Users <18:
- COPPA compliance (US)
- Age-Appropriate Design Code compliance (UK)
- DSA obligations for protecting minors (EU)
6. Technical Safety Infrastructure
Red Flags:
- No automated detection systems
- Safety tools built entirely in-house (reinventing the wheel)
- No API rate limiting or abuse prevention
- Single-region infrastructure (no geographic redundancy)
- No disaster recovery plan for safety systems
Green Flags:
- Industry-standard tools (hashing, classifiers, etc.)
- Layered detection (automated + human + user reports)
- Rate limiting, CAPTCHA, email verification
- Geographic distribution of safety infrastructure
- Regular penetration testing and security audits
Questions to Ask:
- What tools and vendors do you use for safety detection?
- How quickly can you deploy safety updates in response to new threats?
- What's your uptime SLA for safety systems?
- How do you handle coordinated attacks or brigading?
Technical Assessment:
- Review architecture diagrams
- Understand data retention and deletion procedures
- Evaluate logging and audit capabilities
- Assess scalability of safety systems
7. Product Safety Roadmap
Red Flags:
- No safety features planned in product roadmap
- Safety features only added reactively after incidents
- Product and safety teams don't communicate regularly
- Safety considerations not part of launch checklist
Green Flags:
- Safety review required for all new features
- Dedicated roadmap for safety improvements
- Regular product-safety sync meetings
- Safety metrics tracked alongside growth metrics
Questions to Ask:
- How do you balance growth and safety in product decisions?
- What safety features are planned for next 6-12 months?
- How do you decide which safety investments to prioritize?
- Give an example of a feature that was modified or delayed due to safety concerns.
Red Flags That Should Stop a Deal
Some Trust & Safety issues are so severe they should pause or kill an investment:
Existential Red Flags:
1. Active regulatory enforcement action
- Ongoing investigation by FTC, state AG, EU Commission, etc.
- Unresolved COPPA violation
- Open GDPR or DSA enforcement proceeding
2. Pattern of serious safety incidents
- Multiple high-profile incidents in past 12 months
- Incidents involving harm to minors
- Incidents resulting in legal action or settlements
3. Fundamental architecture problems
- No way to delete user data (GDPR "right to deletion")
- No content moderation at all
- No age verification for platform with child users
- User data stored in insecure manner
4. Dishonest or evasive responses
- Claiming compliance when clearly non-compliant
- Refusing to provide safety metrics
- Obvious gaps between stated policies and actual practices
How to Quantify Trust & Safety Risk
Include these in your investment models:
Known Liabilities:
- Estimated cost to remediate identified compliance gaps
- Outstanding regulatory fines or settlements
- Litigation reserves for active safety-related lawsuits
Compliance Capex:
- Safety team headcount needed to reach industry standard
- Technology and vendor costs for compliance infrastructure
- Legal and consulting costs for regulatory work
Operational Risk Scenarios:
- Best case: Continue current trajectory
- Base case: Proactive compliance investment required
- Downside case: Regulatory enforcement requiring rapid remediation
- Worst case: Platform ban, major fine, or existential safety incident
Exit Risk Adjustment:
- Valuation discount for unquantified safety risks
- Timeline extension for IPO or M&A if compliance work required
- Deal structure considerations (escrow for unresolved liabilities)
Trust & Safety Due Diligence Checklist
Use this checklist during investment evaluation:
Team & Organization:
- ☐ Dedicated Trust & Safety leader identified
- ☐ Trust & Safety FTE count documented
- ☐ Reporting structure reviewed
- ☐ Cross-functional safety processes confirmed
Operations:
- ☐ Content moderation metrics reviewed (volume, action rates, response times)
- ☐ Quality assurance processes documented
- ☐ Vendor and geographic diversification confirmed
- ☐ Decision logging and appeals process verified
Compliance:
- ☐ Applicable regulations identified
- ☐ Privacy policy and terms of service reviewed
- ☐ Regulatory correspondence reviewed
- ☐ Compliance roadmap for upcoming regulations documented
Incidents:
- ☐ Safety incident history reviewed
- ☐ Incident response plan documented
- ☐ Post-mortem reports analyzed
- ☐ Learning and improvements identified
Child Safety (if applicable):
- ☐ Age verification methods reviewed
- ☐ Age-appropriate safety features confirmed
- ☐ CSAM detection systems verified
- ☐ NCMEC reporting confirmed
Technical Infrastructure:
- ☐ Safety systems architecture reviewed
- ☐ Detection tools and vendors documented
- ☐ Scalability and redundancy confirmed
- ☐ Security audit results reviewed
Product Roadmap:
- ☐ Safety review process confirmed
- ☐ Safety roadmap reviewed
- ☐ Safety metrics tracked
- ☐ Trade-off decision examples documented
Risk Quantification:
- ☐ Compliance gap remediation costs estimated
- ☐ Required safety headcount calculated
- ☐ Regulatory risk scenarios modeled
- ☐ Exit impact assessed
Need Trust & Safety Due Diligence Support?
Echelon Advisory provides comprehensive Trust & Safety due diligence services for investors, including infrastructure audits, compliance gap analysis, and risk quantification.
Services: Pre-Investment Assessment ($10K-$25K) | Deep Dive Technical Assessment | Post-Investment Integration Planning | Fractional CSO for Portfolio Companies
Contact UsKey Takeaways for Investors
- Trust & Safety failures can destroy company value faster than most operational risks
- Many platforms have inadequate safety infrastructure relative to their risk profile
- Regulatory enforcement is increasing globally (GDPR, DSA, AI Act, COPPA)
- Safety incidents create direct financial, operational, reputational, and exit risks
- Effective due diligence requires both technical assessment and operational review
- Quantify compliance costs and regulatory risk scenarios in investment models
- Some red flags should pause or kill a deal (active enforcement, fundamental architecture problems)
The platforms that survive and thrive are those that build robust Trust & Safety infrastructure before it becomes an existential crisis. Investors who understand this dynamic make better investment decisions and create more value in their portfolios.
About the Author
Maneesha Pandey is the founder of Echelon Advisory Services, specializing in Trust & Safety, AI Governance, and EU regulatory compliance. She spent 14+ years building Trust & Safety infrastructure at Amazon, Google, and TikTok, including launching TikTok's LATAM Trust & Safety operations from scratch and managing CPSC regulatory programs at Amazon.