Your site offers private hosting; how do you expect reports to happen? The people sharing the CSAM won't report it; they're the ones that want to abuse your site. They'll happily share the content privately among themselves and you'll never know until the police knock on your door. A reporting-based system only works if the images are public and available in a feed so that you can "crowdsource" your moderation. It doesn't work at all--not even a little bit--when the posts are private. I urge you, strongly, to reconsider your plan here before something bad happens. I don't get the sense that you grasp the seriousness of this concern.

Your terms of service shields you from nothing. It doesn't limit your liability here at all.