Sentrient is a Compliance, GRC and HR Software Solution, built and supported in Australia and hosted on Microsoft Azure. This page answers the questions we are most often asked by IT stakeholders during procurement, security review and due diligence. It covers how your data is stored and protected, how we manage risk, and how we use AI.

Last reviewed: 1 July 2026

Overview

  • Data hosted in Australia – your data is hosted on Microsoft Azure in the AU East region, with disaster recovery in AU Southeast. It never leaves Australia.
  • 9% guaranteed uptime – Sentrient guarantees 99.5% monthly uptime for the platform.
  • Single tenant architecture – every client has an isolated database, application and memory pool. Nothing is shared between clients.
  • Data is encrypted throughout – data is encrypted at rest and in transit, using third party signed certificates.
  • Your data is your data – Sentrient claims no ownership or rights over client data, and it is never used to train AI models.
  • Governed by a recognised framework – our security governance is modelled on APRA’s Prudential Practice Guide CPG 234 – Information Security.
  • Independently penetration tested – we commission annual penetration testing by ZIRILIO, an Australian based independent security testing firm, and clients are also welcome to commission their own testing of our infrastructure and applications.
  • ISO certified – Sentrient is certified to ISO 9001 (Quality Management) and ISO 27001 (Information Security Management).

Inclusions

  1. Security governance and risk framework
  2. Where is your data hosted?
  3. Data ownership and encryption
  4. Third party integrations
  5. Access control and account management
  6. Independent security testing
  7. Quality management
  8. Risk management
  9. Reliability, uptime and service
  10. Disaster recovery and incident response
  11. Support
  12. AI and your data
  13. Data retention and disposal
  14. Ethical and regulatory compliance
  15. Contact us
  16. Changes to this IT Security and Due Diligence Information

1. Security governance and risk framework

The Sentrient security governance framework is modelled on the APRA Prudential Practice Guide CPG 234 – Information Security (June 2019), which supports Prudential Standard CPS 234.

  • IT security risk and an overarching risk management framework
  • User awareness and access control
  • IT asset lifecycle management
  • Monitoring and incident management
  • Security reporting and metrics
  • Ongoing security assurance

Sentrient owns the intellectual property for its Compliance, GRC and HR Software Solution (it is not open-source), and our Azure hosting lets us scale security measures to suit both small and medium businesses and larger organisations – taking a commercial, risk-versus-cost approach tailored to each client’s needs.

Day to day, we monitor for unusual patterns that could affect security (activity logging, environment profiling, routine control checks, monitoring of staff and third-party access to sensitive data), manage incidents (from outages and unauthorised access through to data leakage and failed backups), maintain clear accountability against privacy and cyber security legislation, and report regularly – reviewing the framework itself for continuous improvement, with input from clients and partners.

2. Where is your data hosted?

Sentrient runs on Microsoft Azure, which provides infrastructure, platform and software services on a global data-centre network with strong availability, security and compliance credentials.

Live data

Stored on virtual servers in the Azure AU East region.

Backups

A snapshot is taken every 4 hours (starting 12:00am AEST). Instant-recovery snapshots are retained for 11 days, and daily backups are retained for 60 days. Backups are stored in the Azure AU East region.

Disaster recovery

Production data is synced in real time to the Azure AU Southeast region.

3. Data ownership and encryption

  • Who owns the data? You do. Sentrient makes no claim or interest in client data.
  • Is it encrypted? Sentrient runs on the Microsoft .NET platform and SQL Server. All access is encrypted via a third party signed TLS certificate (TLS 1.2 or higher), all passwords and sensitive information are encrypted, and the database is encrypted at rest using AES-256 Transparent Data Encryption (TDE), with encryption keys managed in Azure Key Vault. Data is also encrypted in transit between you and the cloud.
  • Is my data mixed with other clients’ data? Each client runs on a single, isolated instance – a separate database, application and application memory pool per client. There is no multi-tenant commingling of data.
  • How do you audit your own data handling? Through internal audits conducted at least annually, or more often if required.
  • Can you support a legal or forensic investigation? We maintain a server-level log of user activity across the system. With the appropriate permissions, this is fully searchable – including data relating to archived users.
  • Where can I read your Privacy Policy? Our privacy policy covers three different kinds of personal information including platform data, account and administration data, website and marketing data, and can be found at https://www.sentrient.com.au/privacy-policy
  • Who’s responsible for privacy consent? Your organisation is responsible for obtaining any consents and giving any notices required from your own staff or members before their personal information is entered into Sentrient. Once we hold that information, we’re responsible for handling it in line with the Privacy Act 1988 (Cth) and any other privacy law that applies.
  • Will you sign a non-disclosure agreement? Mutual confidentiality obligations are a standard part of our client agreements, and we’re happy to execute a separate NDA earlier in your evaluation process if your procurement policy requires one.

4. Third party integrations

Sentrient supports integration with a range of accounting and payroll systems, so client data can flow securely between Sentrient and the other business systems you rely on.

  • Which systems does Sentrient integrate with? Sentrient supports integrations with Xero, MYOB, NetSuite and HeroPay, among others.
  • Are these integrations secure? All third-party integrations we support use secure, encrypted connections, and are maintained as part of the Sentrient platform.

5. Access control and account management

  • Who has access to your instance of the software? Sentrient establishes and manages each client’s instance of the software. Your nominated system administrator then controls access within your own environment – assigning user, manager or administrator permissions as needed. We provide administrator training that covers the privacy and security considerations of running your instance (manager permissions, data integrity, managing active/inactive users, and so on). You are always advised of the accounts that exist on your instance.
  • What Sentrient staff has access to your instance of the software? Access to manage client accounts is restricted to your client account manager and our authorised technical support team. Only Sentrient staff explicitly authorised to do so can work on support tickets or client matters in the live environment, and that access is monitored and reported on regularly.
  • What controls are in place for staff to access the software? Where a username and password system is used, our baseline (adjustable to a client’s own policy) is:
  • Username – clearly identifies the individual, e.g. an email address, or firstname.lastname / firstinitial.lastname.
  • Password – minimum 8 characters, including lowercase, uppercase, numbers and special characters.
  • Can we set up Single Sign-On (SSO) and Multi-Factor Authentication (MFA)? SSO (e.g. SAML 2.0, Azure AD, Okta, and Google Workspace) is also available, letting clients authenticate through their own identity provider. MFA is available as an optional, client-configurable setting for added account security.
  • Who manages authorisation for the Azure Cloud environment? Sentrient manages access authorisation and accounting for the underlying Azure Cloud environment itself.

6. Independent security testing

We commission annual penetration testing of our infrastructure and applications, carried out by ZIRILIO, an independent security testing firm, giving clients an additional, proactive layer of assurance over our security posture.

We support independent verification of our security posture. Clients are welcome to commission their own security testing against Sentrient’s infrastructure and applications to confirm they meet their specific requirements – talk to your account manager to coordinate scope and timing.

7. Quality management

Sentrient holds certification to both ISO 9001 (Quality Management) and ISO 27001 (Information Security Management), each independently audited on an ongoing basis.

  • ISO 9001 covers how we manage and continually improve the quality of our software, service delivery and client support.
  • ISO 27001 covers how we identify, manage and mitigate information security risk across the business, complementing the security governance framework described in Section 1.

8. Risk management

Our approach to risk management is collaborative: we start by understanding which security risks matter most to a client, then develop mitigations that are proportionate and cost-conscious.

For larger implementations or clients with highly sensitive data, we can run risk management workshops during onboarding, followed by regular project meetings with risk management as a standing agenda item – typically fortnightly or monthly during implementation, then monthly or quarterly afterwards. These meetings are where larger clients can review risk reports, raise new risks, and track them through to resolution. This is available as a scoped, additional service.

9. Reliability, uptime and service

Sentrient guarantees 99.5% uptime each month for the platform. This figure doesn’t account for outages caused by upstream providers, network carriers, or a client’s own local network.

The platform is built with redundancy: if an individual component fails, its services fail over to another automatically. Most of the time this causes no visible downtime; occasionally a service restarts on different hardware as part of normal operation.

  • Data residency: all data and services provisioned on Sentrient always remain within Australia.
  • Backup recovery point: backups run every 4 hours, so maximum potential data loss is 4 hours. In the event of hardware failure, we restore a server to its original configuration within 48 hours.
  • Scheduled maintenance: designed to be rare and performed outside business hours where possible. Clients are notified at least 72 hours in advance. Under normal conditions, scheduled outages should not exceed one working day per year.
  • Unscheduled maintenance: occasionally necessary to protect network stability; we keep these to a minimum and notify clients as practicable.

Standard exclusions apply – for example, issues within a client’s own network, ISP or equipment, agreed scheduled downtime, or problems outside Sentrient’s network.

10. Disaster recovery and incident response

Our disaster recovery site is a hot site, hosted by Azure in the AU Southeast region. Production data is synced there in real time to minimise data loss, and we run full disaster recovery failover drills every six months.

All software and hardware supporting Sentrient is monitored continuously, 24/7/365, with alerts routed to technical support staff by email, SMS and paging. Issues are either detected proactively by our monitoring, or reported to us by clients.

If we suspect a data breach, here’s what happens:

  • It’s escalated immediately to our Service Delivery Manager, by phone followed by a written summary.
  • The Service Delivery Manager takes immediate action to contain the issue, logs it in our Data Breach Register, and briefs our CTO.
  • Our CTO determines whether a breach has occurred, and whether it needs to be escalated to our formal Data Breach Response Process.
  • If escalated: affected clients and third parties are notified, including planned or completed remediation, within 48 hours; the cause is fully investigated; steps are taken to reduce the risk of recurrence; a post-breach report is documented; and we provide follow-up updates to everyone involved.

Where a confirmed breach involves Personal Information, our standard client agreements commit us to notifying the affected client faster still – within 24 hours of becoming aware – consistent with our obligations under the Privacy Act 1988 (Cth).

Recovery timeframes

Our cloud environment is self-healing and highly available. If something happens to production servers, failover to our AU Southeast recovery site begins within 60-90 minutes, with real-time synchronisation minimising data loss. Incident response itself commences within 60 minutes of an issue being identified.

How long full recovery takes depends on scope – something like restoring an accidentally deleted user profile is quick, while a full server rebuild can take 24-48 hours.

11. Support

Our first-line helpdesk operates 9:00am-5:00pm Monday to Friday (AEST), via phone and email. We aim to acknowledge every request the same business day, or the next business day if it arrives after 1pm AEST, and to complete requests within two working days unless we’ve told you otherwise. Issues are dealt with by urgency.

Low Normal High Urgent
What it means Operations continue uninterrupted; workaround available Minor interruption; workaround available Critical process affected; no workaround available Unable to operate
Response target Same business day, or within 1 business day Same business day Within 3 hours Within 1 hour

12. AI and your data

We know AI is front of mind for anyone doing due diligence on a software vendor right now, so we want to be direct about how we use it.

Do you use AI within Sentrient?

We use AI in select areas of our platform, aimed at making Sentrient more efficient and useful for our clients. Any AI feature we introduce is assessed under the same security governance framework described in Section 1 before it’s released.

Is my organisation’s data used to train AI models?

No. Your compliance records, personal information, and any other content held in your Sentrient environment is never used to train, fine-tune or otherwise improve any AI or large language model – ours or a third party’s (for example, OpenAI or Microsoft’s Azure OpenAI models).

Does my data get sent to or processed by an AI system?

No. Client data continues to sit in the same secure, single-tenant Azure SQL environment described in Section 2, kept separate from any AI processing pipeline.

Who’s accountable for AI use at Sentrient?

AI features fall under the same governance, risk and change-management process as the rest of our platform – with human oversight and no change to who can access your data.

Still have questions?

If AI use is part of your formal due diligence or procurement process, our security team can answer specific questions in writing.

13. Data retention and disposal

Sentrient does not operate its own data centres – all production infrastructure is hosted on Microsoft Azure. When hardware in Azure data centres reaches end of life, Microsoft manages its secure decommissioning: data-bearing storage devices are securely wiped and physically destroyed under Microsoft’s documented device destruction procedures, so client data cannot be recovered.

  • How do we access our data if we leave Sentrient? Your System Administrator can export your data from Sentrient prior to you leaving Sentrient. If more complex data exports are required this is a scoped, additional service.
  • What happens to our data after we leave Sentrient? Your instance of the software is made inactive and is not accessible once you leave Sentrient, and it is deleted within three months or earlier at your request.

14. Ethical and regulatory compliance

Beyond information security, our client agreements commit us and any contractors we use, to:

  • Australian law – our agreements are governed by the laws of Australia, and Sentrient Pty Ltd is an Australian-registered company.
  • Code of Conduct – sets out the ethical standards we expect of ourselves and any third parties we engage, as set out in our Code of Conduct Policy at https://www.sentrient.com.au/code-of-conduct.
  • Insurances – Sentrient holds Professional Indemnity (PI) and Public Liability (PL) insurance, and these are available upon request.
  • Internal policies – we maintain a wide range of policies including but not limited to business continuity, code of conduct, cyber security, fair work, and work health and safety, and these are available upon request.
  • The Modern Slavery Act 2018 (Cth) – taking reasonable steps to identify and address modern slavery risk in our own business and our supply chain, as set out in our Modern Slavery Statement at https://www.sentrient.com.au/modern-slavery-statement.
  • The Privacy Act 1988 (Cth) – handling personal information in line with the Australian Privacy Principles, including how we collect, use, store and disclose it, as set out in our Privacy Policy at https://www.sentrient.com.au/privacy-policy.

15. Contact us

If you have any questions about this IT Security and Due Diligence Information or need a formal response to a security questionnaire or want to talk through specific requirements for your organisation, please contact the Sentrient Team.

Sentrient Pty Ltd

Phone: 1300 040 589

Email: [email protected]

16. Changes to this IT Security and Due Diligence Information

We may update this IT Security and Due Diligence Information from time to time. The current version is always available at https://sentrient.com.au/it-security-due-diligence with the date it was last reviewed shown at the top of this page.