Reports and moderation in Secure Rooms

End-to-end encryption means we cannot look into a room even to investigate abuse. The report flow is therefore built around explicit consent by a room participant.

Filing a report

Any room participant can file a report from the room menu. The dialog has three steps: describe the reason, then read the consent screen, then confirm. The reason text is stored as plain text (you are warned about this in the dialog) so moderators can triage the report.

The consent screen

Before the report is sent, you see an explicit warning. By consenting you acknowledge that:

• the assigned moderator will see the entire history of the room - all topics and replies - and all files - not just the messages you object to;
• all room participants will be notified and will see a permanent banner while the moderator is in the room;
• the action cannot be undone.

Without your explicit consent the report cannot be submitted.

What happens next

A moderator with the Secure Rooms permission is assigned to the report. You verify the moderator's safety number and hand over the room keys for all epochs; only then can the moderator decrypt anything. The moderator joins with a read-only "observer" role. A system message is posted to the room, and every participant sees a persistent, non-dismissible banner: "A moderator is present in this room (report №N from ). They can read the conversation."

After the report is closed

When the report is resolved and the moderator is removed from the room, a new key epoch is created. From that moment the moderator cannot read new messages.

One honest limitation: the moderator can still decrypt the history of the epochs they were given during the investigation. Keys that have already been handed over cannot be revoked - this is a fundamental property of end-to-end encryption, not something we can fix server-side. Keep this in mind when consenting to a report.