Standards
For procurement teams.
Answers for bank, fintech and government security reviews: who is responsible for what, how our software fits APRA's CPS 234 and CPS 230, and our answers to ASD's questions for buyers of software.
Shared responsibilities
| Area | Senua AI | You |
|---|---|---|
| Software integrity | Builds, signs and publishes each release | Installs and upgrades; your system checks each signature |
| Flaws in our software | Finds, fixes and discloses them; fixes at no charge | Applies releases on your patch timeframes |
| Host, network, TLS front end | Publishes host requirements | Hardens, patches and runs them |
| Accounts | Enforces multi-factor sign-in, lockout, roles and audit | Enrols people, sets roles, reviews the log |
| What the software learns | Encrypts it at rest under a key you control | Holds the key; backs up, keeps or destroys the data |
| Logs and monitoring | Records and delivers events, signed | Collects them into your SIEM |
APRA CPS 234 and CPS 230
CPS 234 asks you to assess the information security capability of any third party that manages your information assets. Our software runs in your environment and we manage none of your information, so your assessment is of the software and how we build and deliver it: these pages, the cryptographic register, and the full registry under NDA. If the software supports a critical operation under CPS 230, we sign the terms a material arrangement needs: access for you and for APRA, our subcontractors named, your data in your control, notification, continuity and exit. The software keeps running if we cannot, because the licence works offline.
Government: the PSPF and IRAP
Policy 6 of the Protective Security Policy Framework asks agencies to put security terms into supplier contracts and to see them applied; these pages, and the security terms we sign, are written for that. An IRAP assessment covers your system, with our software inside it, and we give your assessor everything here and the full registry. The Hosting Certification Framework covers providers that host government data. We host none.
ASD's questions for buyers
Every security feature is in every edition, with no add-on to buy. There are no default passwords. Defaults are the safe ones: report only, nothing outbound, the engine on the local host. We collect no data while you use the software, need no remote access, and have none. We are an Australian company developing in Australia. The software uses open standards: TLS 1.3, and FIPS and RFC algorithms. The datasheet answers ASD's questions one by one.
Under a non-disclosure agreement
The full cryptographic registry, what every connection negotiates, and where our own hosted services run. Ask for the security review pack.
Download the procurement datasheet (PDF), with the shared responsibility model and every ASD question answered.