Whoops :(
I've just realised that I've opened myself up to considerable personal liability because I haven't done an illegal content risk assessment or a child access assessment under the #OnlineSafetyAct for our jellyfin media server instance.
Sandra and I can both upload to it, and can both see what the other has uploaded.
The lack of a family / household purposes / small user group and inherently low risk service exemption is absurd.