Policy and moderation
You set the policy in the dashboard (the Moderation policy section). It applies to /v1/moderate (images), /v1/moderate-text (text), and the widget. It consists of a mode (how strongly modwall intervenes) and thresholds (where the boundaries lie). Modes and thresholds work identically for images and text — for text, the threshold applies to the combined “unsafe” score (the maximum across toxicity categories).
Modes: monitor / review / enforce
The mode determines how the model’s raw recommendation (recommended_action) maps to decision, i.e. the action we return to you:
| Mode | What modwall does | Who it's for |
|---|---|---|
monitor | Only observes and logs. Blocks nothing — decision is always allow, while recommended_action shows what it would do. The audit log and the moderation.flagged webhook work as usual. |
Safe integration, a preview of "what we would flag" with no risk to your platform (shadow mode). |
review | Borderline cases are held for a human decision (HITL queue). | NSFW, ambiguous content. |
enforce | Borderline cases block automatically too — no waiting. | Image spam, obvious pornography, repeat abuse. |
Recommended path: start in monitor, see in the dashboard/audit log how much and how accurately modwall flags on your real traffic, and once you trust the numbers — switch to review or enforce.
Decision: allow / review / block
From the raw nsfw score we compute a recommendation (recommended_action) using two thresholds, and then the mode maps it to a decision:
| Condition | recommended_action |
|---|---|
nsfw ≥ block threshold | block |
review threshold ≤ nsfw < block threshold | review |
| below | allow |
A review threshold of 0 disables the band — then the recommendation is hard (allow/block). In monitor mode, decision is always allow regardless of the recommendation; in enforce, a review recommendation becomes block.
Human-in-the-loop (HITL) queue
Content with a review decision goes to the queue in the dashboard, where you manually approve or reject it. We don't store the image — in /v1/moderate, pass reference (your content ID) and/or image_url (a preview on your infrastructure) so the moderator can recognize the content.
You can read the decision status via GET /v1/review/{id}.
Reactive layer (reports)
Independent of the upload scan, users can report content. Call POST /v1/report with a reference; once the report threshold (from your policy) is exceeded, the content automatically goes to the HITL queue.
Per-request threshold
/v1/moderate?threshold=0.6 overrides the block threshold for that request only (the review band is then skipped).
Plans and limits
| Plan | Limit / mo. | Price |
|---|---|---|
| Free | 1 000 | 0 € |
| Starter | 50 000 | 29 € |
| Growth | 250 000 | 79 € |
| Scale | 2 000 000 | 229 € |
| Self-host | — | annual contract |
When your limit is used up we return 402. The counter resets monthly. You can change your plan instantly in the dashboard.
Privacy and reliability
- Images are never stored — we process in memory and log only metadata (time, score, size).
- Fail-open — if the engine fails we return
503; you make the fallback decision (recommended: send to manual moderation). - Self-hosting — in the on-premise variant, images never leave your infrastructure.