Why we exist
Europe now requires platforms to protect children. It does not tell them how to prove they have.
The Digital Services Act, the AI Act, the AVMSD and a growing set of national codes place real obligations on services used by children. They are written as outcomes: a provider must put in place appropriate and proportionate measures. What none of them supplies is the testable detail underneath, the thing an auditor can hold a product against and reach the same conclusion twice.
That gap is not a drafting oversight, it is how framework legislation works. But it leaves a vacuum, and the vacuum gets filled by self-assessment, by marketing, and by trust marks a company can buy. A parent, a regulator and a procurement officer are all left with the same problem: no way to tell a platform that is safe from one that says it is.
The burden of proof is moving onto providers. Custorian exists so that when it lands, there is something rigorous, public and independent for it to land on.
What we do
We write and steward the Child Digital Safety and Wellbeing Standard, and we do not certify anyone against it.
CDSW is a technology-neutral control set. Each control is a single obligation with one testable criterion, a required evidence class, and a named legal or technical authority behind it. It is published openly under CC BY-ND 4.0, so the requirements that decide a certificate are public rather than sold.
The control counts, the ten domains, the eleven platform profiles, the authorities each control cites and the three levels of conformity are all set out on how it works.
Alongside the standard
We maintain a risk catalogue of 95 catalogued harms mapped to controls, an authority register recording the duty-bearer behind every citation, and jurisdictional overlays that keep national law out of the core requirements so the standard travels. We publish a register of certified organisations, and we run research on where children are actually harmed rather than where it is convenient to look.
Where we work
Harm to a child is rarely confined to a single layer of the internet stack. It occurs across an architecture, and the actors exploiting that architecture understand its topology better than most of the institutions mandated to regulate it.
An approach that begins inside a game and moves to a messaging app. A site that stays reachable because its registrar never answers an abuse report. A network that keeps routing an operator every other network has already dropped. Each of these traverses several layers, and each layer has a different duty-bearer, a different regulator, and usually a convenient reason why it is somebody else’s problem. That gap between layers is not a policy oversight. It is where the exploitation actually happens, and it is currently unowned.
The six layers
- Internet service providers. The connection itself, and what is filtered, logged or blocked before it reaches a home.
- Registries and registrars. Who a domain is sold to, what is asked at the point of sale, and what happens when abuse is reported afterwards.
- Network providers. The autonomous systems that route traffic, and who keeps routing for an operator after every other network has stopped.
- Hosting providers. Where material physically sits, how fast it comes down on a valid notice, and how fast it reappears elsewhere.
- Platform providers. The services a child actually uses, where contact is initiated, and where design determines how easily it is made.
- Operating system and device providers. The last layer before the child. It holds the age the account itself declares, and could act on behavioural and contextual signals long before any message is read.
Organised networks operate across all six layers deliberately: to locate children, move them onto a surface nobody is monitoring, and keep what follows reachable. They treat the stack as a single system. Child safety policy still treats it as six unrelated industries. That mismatch is the structural gap, and closing it is the structural opportunity.
Where we choose to build
We fund and build where the gap is measurable and unaddressed: where no layer-level data exists, no duty-bearer is required to publish it, and publishing what is actually true would change how that layer behaves. Before committing to a layer, we map it and apply three tests. Is it already covered, and covered well? Is there an identifiable duty-bearer who could act and currently does not? Would published evidence change that calculus? Where an established hotline or monitor already covers a layer, we cite that work rather than duplicate it. Where the honest answer is that no one is measuring it, that is where we build.
This is also why the research does not stop at the platform layer. Certification reaches the services that opt into it. The layers underneath it reach everything else, including every service that will never apply.
The instruments we build
Most of our effort goes into formal instruments: a written standard, controls with a testable criterion each, and conformity assessment carried out by accredited third parties. This is the correct instrument where a layer has an auditable duty-bearer with a commercial incentive to demonstrate compliance.
It is the wrong instrument everywhere else. No certification regime exists for registrars, and nothing currently requires one. Voluntary frameworks exist, and registrars can opt into abuse-alert partnerships, but none of them carries testable criteria, third-party assessment, or a compliance obligation. For those layers, we build a different class of instrument: scorecards and indexes that measure what is publicly verifiable, publish the methodology alongside the result, and let the comparison do the analytical work. The standard we hold ourselves to: a scorecard records what an intermediary has committed to in writing, never what it is alleged to host.
Vision, mission and values
Our strategic objectives
- Turn obligations into requirements. Convert the outcome-based duties in the DSA, the AI Act and national codes into control statements specific enough that two auditors reach the same conclusion.
- Keep the decision independent. Build and maintain a certification scheme that only externally accredited bodies can operate, so the people who write the rules never decide who passes them.
- Put children in the room. Involve children and young people in shaping what the standard requires and how it is communicated, as participants rather than subjects.
- Publish the evidence. Release the controls, the risk catalogue, the legal authorities and the consultation dispositions as open data, so the standard can be checked, cited and challenged.
What the name means
Custorian reads as custodian, and as guardian, without needing to be explained. The letters carry the commitments underneath.
| Letter | What it stands for |
|---|---|
| C | Children first |
| U | Uncompromised safeguarding |
| S | Standards, not slogans |
| T | Tested, not taken on trustEvery control carries a test type and a test method, so a claim is evidenced rather than asserted. |
| O | Open to everyoneThe requirements that decide a certificate are published, not sold. |
| R | Rights of the child |
| I | Independent certificationExternal accredited bodies certify. Nobody buys a certificate from the people who wrote the rules. |
| A | Accountable by design |
| N | Never for saleEnforced by the impartiality firewalls and the funding policy, not by good intentions. |
The legal name is Foreningen Custorian, CVR 46399455. The lines above are a values statement, not an expansion of the registered name, and they do not appear in the statutes, the scheme rules or the standard itself.
Why it cannot be bought
Independence is a structure, not a promise. Four of the mechanisms are load-bearing. The values these follow from are set out above.
- We take no money from anyone we could assess. No funding, in any form, from a platform that is or may become subject to assessment, or from anyone controlling or substantially funding one.
- We cannot certify. Only external accredited bodies issue certificates. The association is structurally unable to certify itself or anyone else.
- Membership buys nothing. No fee tier confers a board seat, a vote on board composition, or certification eligibility. Platforms subject to assessment cannot be members at all.
- There are no shares to sell. The association has no shareholders and distributes no profit. The standard stays with it, and remains public even if the association dissolves.
The full set of firewalls, the articles behind them, the decisions the board has taken and the accounts are all published on the governance page.
Get involved
Custorian is developed in the open. Lend your expertise to the Governance Board or Advisory Board, or join the foreningen as a member. Public review of the standard closed on 15 September and sign-up is now by invitation key. The standard belongs to everyone who helps shape it.
The Advisory Board advises; the Board governs. Board seats are filled by the sitting Board and ratified by the general assembly, and candidates need not already be members (Articles § 3.4 and § 5.1).
That is who we are. What the standard actually requires, who assesses it, and what it is measured against are all set out next.