How we guarantee legitimate case studies without a moderation team

Show me the REX is a portal of Tech, data and AI lessons-learned. Our value comes down to one thing: trust in what gets published. A single fake report, a spam post or an illegitimate entry, and the credibility of the whole corpus wobbles.

Two questions, in fact — and the second one rarely gets asked: how do we guarantee the legitimacy of every case study, at scale, without standing up a moderation team; and how do we publish without ever exposing the person speaking, or the client they are speaking about?

The challenge: two dead ends

Manual moderation doesn't scale: costly, subjective, and it adds a delay between wanting to publish and going live. Handing the triage to an AI solves nothing fundamental: a model judges the form of a text, not the legitimacy of whoever publishes it — it can't tell whether the company is real.

Our approach: four gates before publishing

We replaced content moderation with sender verification, through four safeguards:

• No company, no case study — the hardest gate, and the first one. A plain visitor cannot publish anything: creating a case study requires being attached to a company, and publishing re-checks it server-side, every time. A throwaway account opened in thirty seconds with a temporary e-mail address has literally no path to going live — it cannot even reach the form. And a case study belongs to its company: nobody publishes someone else's.
• Minimum substance — a real title and body are required (no empty shells).
• Verified identity — the company's intra-community VAT number is validated against VIES, the EU's official registry. A real company publishing under its own identity won't torch its reputation with a fake case study.
• Full traceability — every case study is tied to an author and a company; every sensitive action is recorded in an audit log.

Protecting the client, and the client's client

A case study describes a real project: it names a company, often that company's own client, sometimes figures nobody publishes lightly. Verifying the sender is therefore not enough — publishing must also cost no one anything.

• Private case studies, by invitation — the author can expose nothing but a teaser publicly: the content is readable only by them, by the e-mail addresses they invited (once signed in), and by an administrator for support. Everywhere else — listings, search, public page — it is reduced to the teaser and a padlock. A client who cannot say everything in the open can still speak.
• Instant unpublishing — one click and the case study leaves the site, spotlight included. The client keeps control of their own words, without going through us or waiting on anyone.
• Readers are never named — a client sees which companies consulted their case studies, never which person. Our own administrators and views from inside the company are excluded from the count.
• Minimal traces — IP and user-agent are never stored in clear, only as a SHA-256 fingerprint, just long enough to tell two visitors apart. An anonymous visitor does not even open a server session.
• Content sanitised on write — the HTML coming out of the editor is cleaned on save, then again on display: one client's case study cannot become the attack vector against another.

The trap we didn't see coming

When we wired up VIES, a valid VAT number — belonging to a very real company — showed up as "invalid." Our safeguard was accusing an honest client.

The cause: when the member-state service is busy, VIES answers HTTP 200 with isValid: false and an error code (MS_MAX_CONCURRENT_REQ). Our code read the boolean and concluded "invalid," when VIES actually meant "I couldn't check." The fix: trust only an explicit verdict (VALID / INVALID), retry once on a transient error, and treat everything else as "unknown" — never blocking a user for an outage that isn't theirs.

The same trap, a second time

A few months later, auditing our own promise, we typed 0 into the VAT field. The case study went live.

Our rule blocked a missing or explicitly invalid number and let everything else through under the "unknown" label. But "unknown" covered two situations nothing told apart: "VIES could not check right now" — temporary, be tolerant — and "VIES will never be able to check this string" — permanent, refuse. BANANA, a French number typed without its FR prefix, a non-EU prefix: all values doomed to stay "unknown" for life, and therefore to clear the gate for life.

The fix: the number must first have the shape of an intra-community one before the tolerance applies. The lesson: one error state often hides two, and it is the one you never named that holds the door open.

What this approach does not guarantee

A safeguard described without its blind spots stops being a safeguard and becomes a sales pitch. Ours:

• An administrator publishes without the gate: the guarantee covers client self-publishing, not the team.
• The country is self-declared: declaring yourself non-EU lifts the VAT requirement. That is the accepted price of not excluding non-European companies.
• During a VIES outage, a well-formed but unverified number goes through. We prefer that risk to blocking a client over downtime that isn't theirs.

None of these holes is an oversight: each is a trade-off between friction and tightness, written down so it can be argued with.

Legitimacy applies to the numbers too

Verifying who publishes is pointless if the counters are padded. Our own companies publish and stay visible like any other, but they are out of every commercial and marketing metric — revenue, conversion funnel, accounts to re-engage, audience intelligence. They only count where they legitimately do: views and visits, which are real.

The check is one manipulation: recompute every indicator twice, with and without the exclusion. A figure that doesn't move is a figure that forgot the rule.

Defense in depth

Legitimacy sits on a security base: traffic behind a WAF, a locked-down origin, an audit log of sensitive actions, real-time e-mail alerts, admin 2FA, encrypted backups. The principle: accept that no barrier is infallible, so log everything and alert on everything.

• Zero moderators: no moderation queue, self-service publishing.
• No anonymous path: an account with no company can neither create nor publish a case study.
• Speak without telling everything: private case studies by invitation, reduced to a teaser everywhere else.
• Readers never named: audience aggregated per company, IP and user-agent hashed.
• Verified identity for every publishing company (VIES registry).
• 100% traceable: author, company and sensitive actions logged.
• Unpadded figures: our own companies are out of every commercial metric.
• Limits written down: the three blind spots of the gate are documented, not hidden.
• Proven by tests: every guarantee is backed by an automated, replayable test.