Home CTO Portal The Candor Architecture
The architecture

Moderation you can’t skip, because it’s in the write path.

Most platforms bolt safety on after storage: content lands first, review happens later — maybe. Candor inverts the order structurally. Nothing is stored until it clears screening, and every failure fails closed. This page explains the design; every product in the portal is a component of it.

THE CONTRACT
content arrives → screened → clear → stored
content arrives → screened → not clear → never written
screening unavailable → fail closed → never written

The embedded gateway

Every write path on the platform — posts, media uploads, live-stream titles, messages, registrations — routes through an embedded screening gateway before a single byte reaches storage. The gateway is not a middleware suggestion; it is the only door. There is no code path that stores unscreened content, which means moderation cannot be skipped by bug, load, or shortcut.

The same gateway is embeddable in third-party applications, putting the identical contract inside your own write path.

The gate chain

Behind the gateway, content passes a chain of specialized checks — each one a product in this portal, each independently replaceable:

SENTINEL — behavioral perimeter: velocity, coordination, bot patterns
GUARDIAN SHIELD — age gateway: minors detected at the adult platform’s door
MEDIA SCREEN — images and video frame-checked against known-harm databases before storage
THREATSHIELD — terrorist and violent extremist content analysis
TRUTH SHIELD — credibility analysis with the reasoning shown

Any check failing — or unreachable — blocks the write. A safety module being down never means content slips through; it means content waits.

Defense in depth at the perimeter

Rejection is not the only answer at the edge. Automated attackers probing the perimeter can be routed into a tarpit — connections that stay open, respond slowly, and waste the attacker’s resources instead of your moderators’ time. The perimeter absorbs; the platform never notices.

Watching the watchers

The architecture monitors itself: node telemetry, service health checks across every component, and state-change alerts delivered independently of the platform. When a monitoring component failed recently, the monitor caught it, the fix was applied, and the recovery alert arrived unprompted — the system reported its own repair.

Both directions

The same discipline points outward and inward: Guardian Shield keeps minors off the adult platform; Guardian Shield Inverted keeps adults out of the youth platform. One architecture, two doors, both guarded.

Available as one deployable package

The complete architecture — gateway, gate chain, perimeter defense, monitoring — deployed for your platform as a single engagement, with every component’s behavior verified against live logs before handover.

Talk to us about the package

Where this fits

Candor works at the intersection of gaming safety, age assurance, privacy, parental consent, cryptographic evidence, and auditable trust & safety decisions. Related: