SAFE Intelligence Platform

The patterns were always there.
The infrastructure to see them wasn't.

Threat intelligence for interpersonal harm.

SAFE applies threat intelligence methodology to domains where adversarial behaviour has never been systematically mapped. One analytical grammar. Every domain it touches.

See what SAFE detects Explore the frameworks ↓
Analytical Framework
We do the research.

SAFE organises intelligence through six foundational questions — separating what we know from what we assume, what we observe from what we interpret. The framework forces completeness. No single question is sufficient alone.

Q1
What is harm?
Objective
Definitions, taxonomies, and research on how harm actually operates, structurally, not anecdotally.
Q2
What do we perceive as harm?
Subjective
Societal definitions, legislation, media, cultural variation. What we talk about, what we legislate, what we ignore.
Q3
What are the indicators?
Objective
Observable behaviours, measurable patterns. The tactics, techniques, and behaviours that enable harm.
Q4
What is the impact?
Subjective
Experienced effects on individuals, families, communities. What it actually does to people.
Q5
What maintains harm?
Objective
Sustaining factors, systemic enablers. How systems are weaponised. What prevents intervention.
Q6
What prevents harm?
Objective
Intervention points, restoring factors, pathways to resolution. What actually works.
Tactics, Techniques & Behaviours
One grammar. Every domain.

What are the observable indicators? The answer is a structured, evidence-based catalogue of tactics, techniques, and behaviours — classified using the same schema across every domain SAFE touches.
The same analytical grammar describes a partner using technology to monitor and control, a CFO manipulating audit timelines, or an extremist movement grooming recruits through mentorship.

SAFE-T-0023
Covert Surveillance for Psychological Control
Monitoring the victim's activities, communications, movements, or social connections without their knowledge for the purpose of maintaining information asymmetry and psychological dominance.
Distinguished from overt surveillance disclosure (which is abuse.force.psychological — "I know where you were") by the covert mechanism: the perpetrator gathers information secretly and uses it to anticipate, control, or demonstrate omniscience without revealing the surveillance method.
The victim experiences an inexplicable sense that the perpetrator "always knows" without understanding how.
The target is psychological (sense of autonomy, privacy, freedom of action), not physical or environmental.
AbuseManipulationTech-Facilitated
SAFE-T-0055
Romance & Relationship Fraud
Establishing or maintaining a deceptive intimate relationship for the primary purpose of economic extraction. The relationship itself is the manipulation mechanism — the victim provides financial resources, access, or support based on a relationship they believe is genuine. Distinguished from financial abuse within genuine relationships by the foundational deception about the relationship's nature.
ExploitationManipulationEnvironmental
SAFE-T-0063
Deliberate Psychological Deprivation
Consciously and overtly withholding emotional engagement, psychological care, attention, and validation from a dependent person. The perpetrator is present and capable of providing psychological care but deliberately refuses. Includes emotional abandonment of children, sustained emotional disengagement from dependent partners, and deliberate refusal to acknowledge a dependent person's psychological needs.
NeglectForcePsychological
SAFE-T-0072
Stalkerware Installation
Installing hidden monitoring software on victim's device to track location, messages, calls, photos, and keystrokes. Stalkerware (also called spouseware or creepware) is commercially available software marketed for 'parental monitoring' or 'employee tracking' but frequently used for intimate partner surveillance.
AbuseManipulationEnvironmental
SAFE-T-0114
Evidence Fabrication
Fabricating digital evidence including fake emails, text messages, documents, receipts, screenshots, or records to frame victim for misconduct, support false legal claims, or manipulate decision-makers. May involve sophisticated forgeries using editing tools or simple fabrication of documents.
AbuseManipulationPsychological
SAFE-T-014
Boundary Testing & Desensitisation
Making incrementally escalating requests to test compliance and normalise boundary violations. Starts small (share your location, send a photo, stay up late talking) and escalates (send intimate content, meet in person, transfer money, cut off contact with friends). The request-demand-threaten-force escalation sequence. Each compliance makes the next request harder to refuse.
ExploitationManipulationPsychological
FIR-T-1008
Insider Recruitment Targeting
Identify potential insiders who could be recruited as accomplices — profiling for access level, vulnerability to coercion, ideological alignment, or financial motivation. Distinct from FIR-T-1002 (which profiles individuals to bypass); this technique profiles individuals to recruit.
ExploitationManipulationDirect
FIR-T-2002
Document Forgery and Fabrication
Create, alter, or fabricate documents to support fraudulent narratives — invoices, contracts, identity documents, qualifications, compliance certificates, bank statements.
AbuseManipulationDirect
FIR-T-4006
Key Person Dependency
Engineer a situation where the adversary becomes the single point of knowledge, access, or authority for a critical function — making their involvement indispensable and their removal difficult, while simultaneously reducing the likelihood that anyone else will detect anomalies.
ExploitationIsolationInstitutional
FIR-T-6004
Attribution Misdirection
Direct suspicion toward other individuals, departments, systems, or external actors — framing colleagues, creating false evidence of alternative explanations, or exploiting existing conflicts to mask fraud as interpersonal dispute.
ExploitationManipulationProxy
FIR-T-9001
Whistleblower Suppression
Suppress, discredit, or neutralise individuals who report or threaten to report fraud — through intimidation, retaliation, professional marginalisation, or institutional mechanisms.
ExploitationIsolationTechnology-facilitated + Proxy
FIR-T-7006
Parallel Business Operations
Operate a legitimate-appearing business that actually exists to receive diverted contracts, customers, intellectual property, or opportunities from the employer — a parallel operation that monetises the insider's position.
ExploitationIsolationInstitutional
DVE-T-1001
Autonomous Radicalisation Through Content Consumption
An individual radicalises through self-directed engagement with extremist content, driven by platform algorithms and their own psychological state, without any contact with a human recruiter. The absence of a recruiter eliminates the network signals traditional intelligence relies on. Detection depends on behavioural indicators — content escalation patterns, linguistic shifts, social withdrawal, and platform migration — rather than communications intercept.
AbuseManipulationTechnology-facilitated
DVE-T-1002
Grievance Crystallisation and Ideological Anchoring
A personal crisis — family court loss, job loss, institutional betrayal — becomes anchored to an ideological framework that transforms private suffering into public mission. For sovereign citizen actors, pseudo-legal belief systems reframe adverse government interactions as evidence of systemic fraud, converting compliance into surrender and resistance into duty. This is the primary pathway to violence against government personnel because the ideology specifically designates government officials as the enemy.
AbuseManipulationTechnology-facilitated
DVE-T-2002
Clandestine Cell Formation and Compartmentalisation
Small groups of 2–6 individuals with pre-existing trust relationships (family, veterans, co-workers) form operationally autonomous cells that are nearly invisible to network-based intelligence because the relationships pre-date any extremist activity. The cell combines the operational capability of a coordinated group with the detection resistance of autonomous individuals. Identifying when a legitimate social group transitions to an operational cell is the key analytical challenge.
NeglectManipulationTech-Facilitated
DVE-T-3001
Sovereign Citizen Pseudo-Legal Frameworks.
Individuals deploy fabricated legal documents — notices, liens, fee schedules, jurisdiction rejections — that exploit the legal system's procedural obligation to respond to filings. This activity is uniquely significant as an escalation precursor: it generates a visible institutional documentation trail, and the inevitable failure of pseudo-legal strategies drives escalation toward direct confrontation. Personal liability claims filed against named government officers are the highest-priority indicator of imminent threat.
ExploitationManipulationInstitutional
DVE-T-5002
Targeted Harm of Government Personnel.
A grievance-driven actor targets a specific named official — the judge, the child protection worker, the police officer — for lethal violence, having identified that individual as personally responsible for their suffering. The fixation-to-violence pathway produces observable indicators at every stage: grievance emergence, pseudo-legal activity, correspondence escalation, personal research on the target, surveillance, and attack preparation. The cross-agency visibility problem is acute — the fixated individual may be known to courts, police, and the relevant agency, but no single agency sees the complete threat picture.
AbuseForceDirect
DVE-T-6002
Stochastic Inspiration and Leaderless Resistance.
Public figures or persistent content creators maintain sustained narratives designating specific targets as existential threats, with the statistical expectation that within a large enough audience, someone will act violently — without ever receiving a direct instruction. The operational actor understands themselves as autonomous; the narrative architect maintains plausible deniability. This is the mechanism by which ideology produces violence without organisation, and it is structurally the hardest threat to counter through traditional law enforcement because there is no conspiracy to prosecute.
AbuseManipulationProxy
The same schema (mode, mechanism, domain, vector) describes adversarial behaviour across all three domains. This isn't analogy. It's the same structural dynamics operating through different content. A mentor grooming a recruit into extremism uses the same mechanism stacking (manipulation + isolation) as a partner grooming a target into dependency. SAFE makes this visible.

WARNING - CONTENT NOTICE

The following section discusses interpersonal harm, including domestic and family violence, through a synthetic case study. Some readers may find this content distressing.

Structural Pattern Detection
39 events. 27 months. 1 alert.

What follows is a synthetic case — built from composite patterns in published DFV death review literature, coronial findings, and practitioner research. It does not represent any individual. Click through and watch what SAFE's contextual analysis reveals when it stops looking at incidents and starts looking at the trajectory.

Request a Briefing

The full platform — architecture, deployment models, constitutional constraints, and what a pilot looks like in your context.

Book a Time hello@notastandard.org

Not A Standard is a female-founded Australian security and intelligence company. We also created the TFA Matrix — an open-source technology-facilitated abuse framework used as a reference resource across the sector.

notastandard.org →

If you are in immediate danger, call 000. For support: 1800RESPECT · Lifeline 13 11 14