Security-First. Australian-Hosted. Defensible by Design.

Encryption at Rest

All data stored within SentinelOps is encrypted at rest using current strong-encryption standards. This covers case records, evidence files, attachments, notes, communications, and audit logs - there is no category of stored investigation data that sits unencrypted. Encryption keys are held separately from the data they protect, and access to key material is restricted to the platform itself rather than to any individual operator. The specific algorithms, key lengths and key-handling arrangements are documented in our security questionnaire response, provided to prospective customers on request.

Encryption in Transit

All data moving to, from and within SentinelOps travels over an encrypted, authenticated channel using current transport security standards. This applies to browser sessions, programmatic access, integrations, and communication between internal services - there is no internal network segment over which investigation data moves in the clear. Deprecated protocol versions are not accepted. Exact protocol versions and cipher configuration are supplied in our security questionnaire response.

Evidence and Attachment Security

Evidence files and attachments receive additional treatment beyond storage encryption. Every file is fingerprinted with a cryptographic hash at the moment of upload, and that fingerprint can be re-verified at any later point. If a single byte of an evidence file changed, the fingerprint would no longer match and the discrepancy would be visible. This gives you a chain of custody you can demonstrate to a tribunal or court - not an assertion that evidence is unaltered, but a mechanism that lets you prove it.

The audit trail is the evidentiary backbone of any defensible investigation. SentinelOps implements tamper-evident, append-only audit logging that records every action performed within the platform: case creation, evidence uploads, note additions, status changes, permission modifications, and report generation. It also records read access. When someone opens a piece of evidence, that viewing is recorded and attributed to a named individual. Most systems can tell you who changed something. In a whistleblower matter, a privilege dispute or an internal leak, the question that actually gets asked is who looked - and that is a question this platform can answer.

Audit records are cryptographically chained, meaning any attempt to modify, delete, or reorder historical records would break the cryptographic chain and be immediately detectable. This approach mirrors the integrity techniques used in digital forensic evidence handling, so an audit trail presented to a regulator, tribunal or court can be independently checked for signs of alteration rather than simply taken on trust.

Audit records are retained for the life of your engagement with the platform, and are not pruned or summarised as a matter of routine operation. Because every entry is attributed to a named individual and carries its position in the cryptographic chain, the record you produce years later is the same record that was written at the time. Retention arrangements for organisations with specific regulatory obligations are agreed as part of onboarding.

Australian Cyber Security Centre Essential Eight

The Essential Eight Maturity Model published by the Australian Cyber Security Centre is a control set for organisations hardening their own environments, and several of its mitigations - application control, macro settings, user application hardening - apply to your endpoint fleet rather than to a hosted platform. Where the Essential Eight does bear on a platform like ours, SentinelOps supports it directly: administrative privileges are tightly restricted, application dependencies are checked for known vulnerabilities before every release, and backups are taken and have been restore-tested. SentinelOps has not been assessed against a specific Essential Eight maturity level and does not claim one.

Australian Government Information Security Manual (ISM)

The Australian Government ISM sets the information security expectations for government entities and their service providers. SentinelOps is built with those expectations in view - Australian-only data residency, restricted administrative access, encryption of data at rest and in transit, and a complete attributable audit record. We provide a written control summary to government and critical infrastructure buyers on request so your assessors can evaluate the platform against the specific controls in scope for your environment.

ISO 27001

SentinelOps operates a documented information security management system built to ISO/IEC 27001, the international standard for information security management. It governs how we identify, assess and treat information security risk across the platform lifecycle, and it is the source of truth for every security statement we make publicly, including this page. To be unambiguous: SentinelOps is not currently ISO 27001 certified. Certification is in progress and we will say so here on the day it is achieved, and not before.