Online Safety Act Risk Assessment

1. Illegal content risk assessment

Service description. Same Street is a UK-only, invitation-light social platform for adults going through difficult life experiences, with a user base weighted towards care home residents, older adults and people experiencing serious loneliness. Functionalities that carry risk are: user profiles, support group posts and replies, community posts and stories, direct messages, message requests, Wisdom Bridge one-to-one pairings and sessions, and the Cafe. There is no public anonymous posting, no livestreaming, no advertising, and no content recommendation to strangers outside the matching feature.

Risk profile summary. Our user base is unusually vulnerable, and volume is currently low. We therefore treat the likelihood of harm as moderate but the severity of harm as high, and we mitigate before publication rather than reactively. Four risk types are assessed as relevant to Same Street. Terrorism content, child sexual abuse material and the sale of illegal drugs or weapons are assessed as low likelihood given the audience and the absence of anonymous public posting, but the same screening, human review and escalation controls apply to them.

Grooming and inappropriate trust-building

Relevant offences: Priority illegal content: offences relating to controlling or coercive behaviour, and offences under the Fraud Act 2006 and Serious Crime Act 2015 where grooming is used to facilitate abuse of an adult at risk.
Why this risk is relevant to Same Street: Same Street connects people who are lonely, recently bereaved, or living in care. The platform's core function — encouraging trusted one-to-one relationships between strangers — is the same mechanism a person seeking to groom a vulnerable adult would try to exploit. Direct messages, Wisdom Bridge pairings and the Cafe all create private channels.
Assessed likelihood: Medium — low volume at pilot scale, but a realistic and foreseeable attempt vector.
Assessed impact: High — grooming of an adult at risk can lead to coercive control, financial abuse and serious psychological harm.

Mitigations in place

AI moderation: every profile, post, reply and message is screened before publication by a semantic AI layer specifically prompted to detect grooming patterns — building inappropriate trust, isolating a person from others, requesting secrecy, and attempting to move the conversation off-platform.
Keyword and pattern screening: a second, independent layer matches content against a safeguarding keyword list maintained by the Designated Safeguarding Lead. Both layers always run; neither replaces the other.
Human review: flagged content is held from publication and queued for review by a named human reviewer. No account is suspended and no content decision is finalised by AI alone.
Urgent escalation: high-confidence detections trigger an immediate alert to the safeguarding inbox with the risk classification and a review link.
Structural controls: message requests must be accepted before conversation opens, contact details are masked in the interface, pairing message rate limits apply, mentors are verified against UK professional registers, and members can block and report at any point.
Safeguarding escalation: confirmed concerns are handled under the Adult Safeguarding Policy, including referral to the relevant local authority under Section 42 of the Care Act 2014, the resident's care home, and the police or 999 where there is immediate risk.

Financial abuse, fraud and scams

Relevant offences: Priority illegal content: fraud and financial services offences, including fraud by false representation under the Fraud Act 2006 and offences relating to the proceeds of crime.
Why this risk is relevant to Same Street: Older adults, particularly those who are isolated, are disproportionately targeted by romance fraud, courier fraud and inheritance scams. Members may hold savings or property, and may have reduced ability to recognise a manipulative request.
Assessed likelihood: Medium to high — this is the most common attack pattern against our user demographic.
Assessed impact: High — losses are frequently large, life-altering and unrecoverable.

Mitigations in place

AI moderation is explicitly prompted to detect requests for money, bank details or gift cards, inheritance discussion, pressure around financial decisions and unusual generosity.
Keyword screening covers scam and phishing language, payment requests and off-platform contact attempts.
Scam messages, phishing links and requests for money or financial information are removed immediately with no prior warning under the internal Content Moderation Policy, and the account is suspended.
Directed financial suggestions that fall short of a scam receive a formal warning first, with escalation on repetition, recognising the risk of unlicensed financial advice under the Financial Services and Markets Act 2000.
Fraud prevention controls: phone/OTP verification, brute-force lockouts, new-device alerts, mentor register checks, and staff verification with time-limited access.
Members are given plain-English scam awareness guidance in the in-app Safety Guide, and no feature on Same Street ever asks a member to send money to another member.

Exploitation of vulnerability

Relevant offences: Priority illegal content: offences relating to controlling or coercive behaviour and ill-treatment or wilful neglect of a person lacking capacity (Mental Capacity Act 2005 s.44), alongside relevant fraud offences.
Why this risk is relevant to Same Street: Members may have cognitive impairment, dementia, or limited support networks. Exploitation may target loneliness or confusion rather than money directly — for example pressure to change care arrangements, to grant access to accounts, or to become dependent on a single contact.
Assessed likelihood: Medium.
Assessed impact: High — exploitation of an adult at risk can cause lasting harm and loss of autonomy.

Mitigations in place

AI moderation includes an explicit exploitation category covering any attempt to take advantage of a member's loneliness, cognitive state or isolation.
Directed medical, treatment or care advice to a specific member triggers a warning and escalation path, with immediate action where a safeguarding concern is identified.
Human review of held content by the Designated Safeguarding Lead, with a private moderation log recording date, nature of concern, action taken and outcome, available to the ICO or Ofcom on request.
Welfare monitoring: welfare alerts, mood pattern alerts and inactivity checks surface members who may be at risk, with service level targets for response.
Care-home context: where a member is a resident and has consented, concerns can be raised with their care home; capacity considerations are handled under the Mental Capacity Act 2005.
Safeguarding escalation to the local authority under Section 42 of the Care Act 2014, and to emergency services where there is immediate danger.

Harassment, abuse and threatening communications

Relevant offences: Priority illegal content: harassment, stalking, threats and abuse offences, including the Protection from Harassment Act 1997 and the false and threatening communications offences under the Online Safety Act 2023.
Why this risk is relevant to Same Street: Support groups discuss bereavement, divorce, illness and loneliness. Emotionally charged discussion can spill into targeted abuse, and a vulnerable member may be less able to defend themselves or disengage.
Assessed likelihood: Medium.
Assessed impact: Medium to high — targeted abuse can cause significant distress and drive an isolated member off the platform, worsening the loneliness it exists to relieve.

Mitigations in place

Pre-publication screening of posts, replies and messages for abusive and threatening language, with held content routed to human review.
Harassment or targeted bullying of another member, and content demeaning or exploiting elderly or vulnerable people, is removed immediately with account suspension and no prior warning.
A graduated warning path applies to mildly offensive language that is not targeted or threatening: warning, then content removal and final warning, then suspension.
Member controls: block, hide posts, report a member or a message, and leave any group at any time.
Response time targets: within 2 hours where possible for reports flagged as urgent, within 24 hours on working days for reports from members or care homes.
Appeals: any member who believes an action was taken in error can request a review and receives a response within 5 working days.

How the mitigations fit together

Every piece of user-generated content passes through two independent screening layers before it is published. Content that either layer flags is withheld and placed in a human review queue — AI never removes an account or finalises a decision on its own. Confirmed illegal content is removed, the account is suspended, the decision is written to a private moderation log, and where a person may be at risk the matter is escalated under the Adult Safeguarding Policy to the local authority, the care home, or emergency services. If the AI layer is unavailable, keyword screening continues and the failure is logged for review.

2. Children’s access assessment

Conclusion. Same Street is strictly an 18+ service. Children are not permitted to access any part of the platform, and no part of the service is designed for, targeted at, or appealing to children. Accounts identified as belonging to under-18s are removed.

Why children are not the target audience. Same Street exists to support adults through bereavement, divorce, retirement, illness and moving into care. Content, tone, imagery, accessibility design and the support group topics are all built for older adults. There is no child-oriented content, no games, and no promotion of the service through channels used by children.

Current age assurance method. Age assurance is self-declaration at sign-up: every member must confirm they are 18 or over, and the Terms of Use make 18+ a condition of holding an account. This is reinforced by:

Verified phone number via one-time passcode, which requires control of a UK mobile number and is checked at sign-up and on new-device sign-in.
Closed onboarding paths for the main user groups: care home residents are onboarded through a verified care home, staff accounts are verified against the care home, family accounts are linked to a resident, and volunteers and mentors complete additional verification including UK professional register checks and DBS expectations.
Moderation and profile review, which surfaces indications that an account holder may be under 18 (age stated in a profile or message, school references, life stage inconsistency). Any such indication is reviewed by a human and, where confirmed, the account is removed.
No public content: nothing on the platform other than the public marketing pages and legal documents is visible without an account, so a child who is not registered cannot read member content.

Limitations of the current method — stated openly. Self-declaration is not highly effective age assurance. A determined child could declare a false date of birth, and a phone number check confirms control of a handset rather than the holder’s age, since children may have their own mobile numbers. Verification through care homes and register checks applies to particular account types and does not cover every general member. Detection through moderation is reactive: it can only act after an account exists and has posted something indicative. We therefore assess that it is possible, though unlikely and unattractive, for a child to create an account.

How we manage that residual risk. Because a child could in principle register, we do not rely on age assurance alone. The same pre-publication AI and keyword screening, human review and safeguarding escalation described in section 1 apply to all content and would treat grooming or sexual content involving any member as an immediate-removal matter. Sexual content of any kind is prohibited outright and removed without warning. Anyone who believes a child is using the platform can report it to safeguarding@samestreet.co.uk.

Planned improvement. As the service grows beyond the pilot stage, or sooner if any evidence of under-18 access emerges, we will introduce a stronger age assurance measure proportionate to the risk — for example third-party age estimation or document-based verification at sign-up — and record the change in this assessment. We will not treat self-declaration as sufficient indefinitely.

2a. Age assurance decision record

The decision. Same Street is strictly an 18+ service. The age assurance method currently in use is a self-declaration checkbox at sign-up, under which every applicant must confirm they are 18 or over, supported by the Terms of Use making 18+ a condition of holding an account.

Acknowledgement. We acknowledge openly that a self-declaration checkbox is not “highly effective age assurance” within the meaning of section 81 of the Online Safety Act 2023. It is not technically accurate, robust, reliable or fair in the sense Ofcom uses that term, and we do not present it as such anywhere on the service or in this assessment.

Why this is proportionate at the present stage. The service is pre-launch and operating as a closed UK pilot. There is no pornographic content and no primary priority content on the platform, so the duty to use highly effective age assurance for that content does not arise. Nothing beyond the public marketing pages and legal documents is readable without an account. There is no marketing to under-18s of any kind — no child-oriented content, imagery, games or rewards, and no promotion through channels used by children — so the service is neither targeted at nor likely to attract them. Sign-up additionally requires control of a verified UK mobile number, and the main cohorts arrive through closed, verified routes (care home onboarding, staff and family linkage, mentor and volunteer verification). Against a genuinely negligible likelihood of child access, imposing document or biometric age checks on bereaved and older adults — the very people this platform exists for — would create a real digital-exclusion barrier and collect identity documents we would otherwise have no reason to hold. We assess that collection as disproportionate to the residual risk today.

Residual risk and compensating controls. Because a child could in principle declare a false age, we do not rely on age assurance alone: pre-publication AI and keyword screening, human review, and safeguarding escalation apply to all content, sexual content is prohibited outright and removed without warning, and any indication that an account holder may be under 18 is reviewed by a human and the account removed where confirmed.

Review commitment. This decision is not permanent. We will reassess the age assurance method before any material change to the user base or the mentee cohort — including opening the service to the general public, admitting a new category of member, extending mentoring to anyone under 18 or to a cohort with a plausible under-18 element, launching consumer-facing marketing, or introducing content that would engage the highly effective age assurance duty — and immediately if any evidence of under-18 access emerges. Where reassessment shows self-declaration is no longer proportionate, we will implement a stronger measure, such as third-party age estimation or document-based verification, before the change goes live, and record the outcome here.

3. Named accountable senior person

The senior person accountable for Same Street’s compliance with the illegal content and reporting duties under the Online Safety Act 2023 is:

Afaq Zia

Founder · Designated Safeguarding Lead · Accountable person for online safety

safeguarding@samestreet.co.uk · hello@samestreet.co.uk

This role holds personal accountability for: keeping this risk assessment current, approving the moderation keyword list and AI screening prompt, reviewing every piece of held content during the pilot phase, deciding safeguarding escalations including referrals under Section 42 of the Care Act 2014, responding to Ofcom or ICO information requests, and signing off any material feature change against the review commitment below.

Same Street Ltd is a pilot-stage service with no other staff at the time of writing. Before any volunteer or employee begins moderation work, their responsibilities and the escalation route to the accountable person will be documented in the internal Content Moderation Policy, and this section will be updated to reflect the division of duties.

4. Review commitment

This assessment is reviewed and, where necessary, updated before every material feature change goes live, and in any event at least every 6 months.

A change is treated as material, and triggers a review, when it:

introduces a new way for members to communicate or share content — a new messaging surface, group type, media upload, voice or video capability, or anything that creates a private channel between members;
changes who can contact whom, including matching logic, pairing rules, message request behaviour, rate limits, or the visibility of profiles and content;
changes moderation itself — the AI screening prompt or model, the keyword list, what is held versus published, the human review queue, or reporting and blocking tools;
changes sign-up, verification or age assurance, or opens the service to a new category of user or a new territory;
changes safeguarding escalation, response time targets, or the accountable person for online safety.

The review is carried out and signed off by the accountable senior person named above before release. Each review records the date, what changed, whether any new risk was identified, and any mitigation added. A review is also triggered immediately by any significant safeguarding or moderation incident, by new Ofcom guidance or codes of practice, and by any evidence of under-18 access.

Related documents: Adult Safeguarding Policy, Community Guidelines, Privacy Notice and Legitimate Interests Assessments. The internal Content Moderation Policy and the private moderation log are not published, and are made available to Ofcom or the ICO on request.