CyberSentienTrust centre
How we protect your evidence, who can see it, where it is kept, and what we have not done yet. We checked every statement on this page against the live system. If we can’t show something, we list it as not done rather than leave it out.
Last full check 11 August 2026 · the statement on where your data is processed was corrected and re-verified on 21 August 2026 · questions: compliance@cybersentien.com
Who you are dealing with
🏢 The company
CyberSentien · ACN 688 655 334 · Sydney, NSW, Australia. An Australian company, Australian-owned, contracting under Australian law.
✉ Security and privacy contact
compliance@cybersentien.com · to report a security issue, see our security.txt. Formal contract notices are sent by email: see the data processing agreement below.
At a glance
| What | How it works |
|---|---|
| Your files, when stored | Encrypted (AES-256). Every file has its own key, and keys can be replaced without making older files unreadable. |
| Your files, in transit | Every connection is encrypted (HTTPS), and browsers are told never to connect to the engine any other way. |
| Proof nothing has changed | Every file you give us is dated and fingerprinted when it arrives. Every report carries a code anyone can use to check it is unchanged, without needing an account. |
| Record of every action | A permanent record. An entry cannot be changed or removed without it showing. |
| Backups | Daily application backups, encrypted and checked for tampering, with a deeper check every week, all kept in Australia. See Backups below for the limit. |
| Restore tested | On 11 August 2026 we restored a full backup to a separate system and checked it end to end. Before that date we had never proven a restore, and we said so. |
| Independent certification | None yet. No ISO 27001 certificate, no SOC 2 report and no IRAP assessment of our own platform. They are on our roadmap, and we don’t claim them. |
Where your data is kept
Paying customers run on Australian infrastructure, owned in Australia. A paying customer’s evidence stays in their own workspace.
The public demo holds made-up sample organisations only, never real client evidence. The engine itself reports where each AI answer was produced, at /api/ai-statement, so you can check rather than take this page’s word for it. More on the sovereignty page.
Sub-processors
| Sub-processor | What they do, and where |
|---|---|
| BinaryLane | Hosts the CyberSentien engine. An Australian provider on Australian infrastructure. |
| Render | Hosts this marketing website. No customer evidence is stored there. |
| Cloudflare | Delivers this marketing website quickly and securely. It sees visits to cybersentien.com only. The contact form and the engine connect straight to our Australian systems and do not pass through it, and no customer evidence does either. |
| Microsoft 365 | Our business email, for enquiries and correspondence. |
| Stripe | Takes card payments for subscriptions and single reports. You pay on Stripe’s own secure page, so your card details never reach CyberSentien. Stripe receives your email address, the billing name and address it asks for, your organisation’s name if you give it, and what you are buying. It receives no client evidence, assessment content or report text. Stripe processes payments on its own systems, including some outside Australia. |
| GoDaddy | Registers our domain name, cybersentien.com, and runs the directory (DNS) that tells visitors’ browsers where to find it. It hosts nothing: no engine, no website content, no customer evidence and no assessment data passes through it. |
Backups and recovery
✅ Daily backups
Every day, encrypted, with a check that would show a missing or altered backup, and a deeper check every week. On 11 August 2026 we restored a full backup to a separate system and checked it end to end.
⚠ The limit, plainly
The backups are kept in the same Australian data centre as the server. That covers a server failure, damaged data and accidental deletion. It does not cover losing the data centre itself. A second copy in a different Australian location is not yet booked (no date set), and we won’t call our recovery complete until it exists.
What we have not done yet
📜 No independent certification
We hold no ISO 27001 certificate, no SOC 2 report and no IRAP assessment of our own platform. We build the tools that prepare organisations for those assessments; we have not yet completed one for ourselves, and we won’t imply otherwise.
💾 No backup copy in a second location
We keep two separate layers of backup, both in Australia, but both sit in the same data centre as the server. A copy in a second location is not yet booked: no date is set, and we say so here rather than bury it.
👥 No independent penetration test yet
We have tested the platform’s security in depth ourselves, and fixed what we found. That is not the same as an independent penetration test, and we don’t present it as one. An independent CREST-accredited penetration test is not yet booked: no tester engaged and no date set.
🌐 One server, in one place
The engine runs on one server in Australia. There is no automatic switch to a second location and no published uptime guarantee. If that matters for your engagement, talk to us: anything beyond a dedicated Australian server is scoped and quoted for you.
How a result is reached
1. Clear, honest wording
Every requirement is shown in the authority's own words where we are allowed to use them, and otherwise in our own plain English, clearly labelled as ours.
2. Proof, not promises
A policy that says something happens is not proof that it does. Logs, system settings, registers and reviews are, so that is what we look for.
3. Tested before it is trusted
Each framework is checked against answers settled in advance, on evidence CyberSentien has never learned from. We publish the results as measured.
4. Automatic passes only once proven
A framework gives automatic passes only after a test with no mistakes. Until then, your reviewer sees the evidence and makes the call. Every result is dated on the Correctness Board.
The AI that reads your evidence
| Model | What it does | Licence |
|---|---|---|
| BAAI/bge-reranker-v2-m3 | Reads a passage from your evidence and decides whether it proves the requirement (this is what gives an automatic pass) | apache-2.0 |
| BAAI/bge-m3 | Finds the passages in a document worth reading for each requirement | not recorded in the release |
What we are working on
| Item | Status |
|---|---|
| Tighter remote-access security on the engine server | Done 12 October 2026 |
| Independent CREST-accredited penetration test | Not yet booked |
| A second backup copy in a different Australian location | Not yet booked |
| Independent certification of our own platform (ISO 27001, SOC 2 or IRAP) | Not yet booked |
Data processing agreement
A data processing agreement is available on request from compliance@cybersentien.com. We publish no street address or phone number, so formal notices under that agreement are sent by email to the addresses named in the signed agreement. Australian law and Australian jurisdiction.
Reporting a security issue
Email compliance@cybersentien.com, or use the contact in our security.txt. We will acknowledge your report, look into it, and tell you what we found, including when you were right. We do not take action against anyone who reports in good faith.
🔎 Check it for yourself
The demo is the real engine. Open it, try to make it show a pass it cannot prove, and check a report’s code yourself.