How we guarantee legitimate case studies without a moderation team

Show me the REX is a portal of Tech, data and AI lessons-learned. Our value comes down to one thing: trust in what gets published. A single fake report, a spam post or an illegitimate entry, and the credibility of the whole corpus wobbles.

The question we faced: how do we guarantee the legitimacy of every case study, at scale, without standing up a moderation team?

The challenge: two dead ends

Manual moderation doesn't scale: costly, subjective, and it adds a delay between wanting to publish and going live. Handing the triage to an AI solves nothing fundamental: a model judges the form of a text, not the legitimacy of whoever publishes it — it can't tell whether the company is real.

Our approach: three gates before publishing

We replaced content moderation with sender verification, through three safeguards:

• Minimum substance — a real title and body are required (no empty shells).
• Verified identity — the company's intra-community VAT number is validated against VIES, the EU's official registry. A real company publishing under its own identity won't torch its reputation with a fake case study.
• Full traceability — every case study is tied to an author and a company; every sensitive action is recorded in an audit log.

The trap we didn't see coming

When we wired up VIES, a valid VAT number — belonging to a very real company — showed up as "invalid." Our safeguard was accusing an honest client.

The cause: when the member-state service is busy, VIES answers HTTP 200 with isValid: false and an error code (MS_MAX_CONCURRENT_REQ). Our code read the boolean and concluded "invalid," when VIES actually meant "I couldn't check." The fix: trust only an explicit verdict (VALID / INVALID), retry once on a transient error, and treat everything else as "unknown" — never blocking a user for an outage that isn't theirs.

Defense in depth

Legitimacy sits on a security base: traffic behind a WAF, a locked-down origin, an audit log of sensitive actions, real-time e-mail alerts, admin 2FA, encrypted backups. The principle: accept that no barrier is infallible, so log everything and alert on everything.

• Zero moderators: no moderation queue, self-service publishing.
• Verified identity for every publishing company (VIES registry).
• 100% traceable: author, company and sensitive actions logged.
• Proven by tests: every guarantee is backed by an automated, replayable test.