Security-First. Australian-Hosted. Defensible by Design.

For Australian organisations conducting investigations under Australian law, data sovereignty is not a preference. It is an operational and legal requirement. Investigation data frequently contains personal information governed by the Privacy Act 1988, sensitive employee records subject to the Fair Work Act 2009, and material that may be subject to legal professional privilege or statutory secrecy obligations.

SentinelOps hosts all customer data exclusively within Australian data centres. This is not a regional deployment option or a premium tier feature. It is the only deployment model. There is no offshore data replication, no foreign-jurisdiction backup storage, and no cross-border data transfer. Your investigation data remains subject to Australian law and Australian privacy protections at all times.

This approach ensures compliance with Australian Government data handling requirements, including those mandated under the Protective Security Policy Framework (PSPF) and the Australian Government Information Security Manual (ISM). Organisations subject to the Security of Critical Infrastructure Act 2018 (SOCI Act) can deploy SentinelOps with confidence that data residency requirements are met by default.

Investigation data requires access controls that go beyond standard role-based permissions. SentinelOps implements a multi-layered access control model that combines organisational roles, case-level permissions, and data classification to ensure users access only the information relevant to their function.

Organisational roles define baseline permissions: administrators, investigation managers, investigators, reviewers, and read-only stakeholders each have distinct capability sets. Case-level permissions allow investigation leads to further restrict access on a per-case basis, ensuring sensitive investigations (executive misconduct, whistleblower matters, covert operations) are compartmentalised from general investigation teams.

All access control changes are logged in the immutable audit trail, creating a complete record of who had access to what data and when. This is critical for demonstrating compliance with privacy obligations and for responding to discovery requests or regulatory inquiries about data handling practices.

Multi-factor authentication (MFA) is enforced by default for all SentinelOps users. This is not an optional setting. MFA supports time-based one-time passwords (TOTP), hardware security keys (FIDO2/WebAuthn), and push-based authentication through supported authenticator applications.

Enterprise organisations can integrate SentinelOps with their existing identity providers through SAML 2.0 and OpenID Connect (OIDC) protocols. This enables single sign-on (SSO) through providers such as Microsoft Entra ID (Azure AD), Okta, and Google Workspace, reducing credential sprawl and aligning with organisational identity governance policies.

Session management includes configurable inactivity timeouts, concurrent session limits, and forced re-authentication for sensitive operations such as evidence deletion requests or access control changes. All authentication events are recorded in the audit trail.

SentinelOps infrastructure is deployed across geographically redundant Australian data centres, ensuring high availability and disaster recovery capability without any data leaving Australian jurisdiction. Data centres are certified to international standards including ISO 27001, SOC 2, and meet the physical security requirements of the Australian Government ISM.

The platform architecture implements defence-in-depth principles: network segmentation, web application firewalls, intrusion detection and prevention systems, and continuous vulnerability scanning. Automated threat detection monitors for anomalous access patterns, data exfiltration attempts, and credential compromise indicators.

Backups are encrypted, replicated across availability zones within Australia, and tested regularly for recoverability. Recovery time objectives (RTO) and recovery point objectives (RPO) are defined and tested in accordance with enterprise service level expectations.