Standards
ISO and Australian Standards.
How our software and the way we build it map to ISO/IEC 27001:2022, adopted in Australia as AS ISO/IEC 27001:2023, and to the other cyber security standards Standards Australia names in its January 2025 position paper.
ISO/IEC 27001 Annex A
| Control | How we meet it |
|---|---|
| 8.2 Privileged access rights | Capabilities enforced by the engine; multi-factor sign-in required for every privileged account. |
| 8.5 Secure authentication | Passwords hashed with PBKDF2-HMAC-SHA-256 at 600,000 iterations; lockout; one-time codes. |
| 8.15 Logging | A tamper-evident audit log of every administrative action. |
| 8.24 Use of cryptography | Every algorithm public, in the register. |
| 8.25 to 8.28 Secure development | Written requirements and designs before code; every change reviewed; our own language and its rules. |
| 8.30 Outsourced development | None. Every line is written in-house, in Australia. |
| 8.31 Separate environments | Builds, test installs and production on separate hosts; releases promoted byte for byte. |
| 8.32 Change management | Each change registered with its checks before the code, and recorded when it lands. |
The other standards Standards Australia names
AS 27701, privacy: the software sends no personal information to Senua AI, so your privacy controls stay in your hands. ISO/IEC 19772, authenticated encryption: AES-GCM, one of its mechanisms, protects connections. ISO/IEC 9798, entity authentication: connections authenticate the server, and releases and licences are signed. ISO/IEC 30111, vulnerability handling: fixes go to the root cause and remove the whole class of fault wherever it occurs. ISO/IEC 42001 and AS ISO/IEC 23894, AI: the software learns only from your own data, records the evidence behind every block, and blocks nothing until you allow it.
Download the ISO and Australian Standards datasheet (PDF). Certification of our information security management system to ISO/IEC 27001 is dated on the assurance roadmap.