---
title: "SentinelOps (SentinelOps Pty Ltd)"
url: "https://ailawframework.com/software/sentinelops"
type: "software_profile"
site: "AI Law Framework"
id: "sentinelops"
vendor: "SentinelOps Pty Ltd"
category: "Legal-specific"
segment: "Compliance and privacy"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# SentinelOps (SentinelOps Pty Ltd)

> Australian-hosted investigation case-management platform for workplace, government, insurance and financial-crime investigations, with cross-case pattern detection, OSINT collection, natural-language search and…

Canonical page: https://ailawframework.com/software/sentinelops  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: The SentinelOps managed Australian-hosted platform as published: case management, evidence management, AI and OSINT, and reporting. Pricing, the customer agreement, the integrations page and the document-comparison page were not read.

Australian-hosted investigation case-management platform for workplace, government, insurance and financial-crime investigations, with cross-case pattern detection, OSINT collection, natural-language search and AI-assisted report drafting.

## Capabilities

- Matter management
- Intake and triage
- Knowledge search
- Chronology building
- Document summarisation
- Correspondence and document drafting
- Compliance monitoring
- AML/CTF and sanctions screening
- Data extraction

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia |
| Australian region | Yes |
| Assurance | ISO/IEC 27001 - the security page states that SentinelOps 'operates a documented information security management system built to ISO/IEC 27001' and then states, in the vendor's own words: 'To be unambiguous: SentinelOps is not currently ISO 27001 certified. Certification is in progress and we will say so here on the day it is achieved, and not before.', ACSC Essential Eight - the security page states that SentinelOps 'has not been assessed against a specific Essential Eight maturity level and does not claim one'., Australian Government Information Security Manual - the page states the platform is 'built with those expectations in view' and that 'We provide a written control summary to government and critical infrastructure buyers on request'; no assessment or certification is claimed, and no IRAP assessment is mentioned., Data centre certifications - the page states the facilities are 'operated by a major infrastructure provider that holds its own independent security certifications' and that 'those certifications belong to the facility operator, not to SentinelOps, and we do not present them as ours'. The provider is not named., No SOC 2 report, penetration test summary, ISO/IEC 42001 certification or third-party audit report is published or linked on any page read. A security questionnaire response and a control summary are offered on request. |
| Training on customer content | Unknown |
| Retention | Partly published, and only for audit records. The security page states that 'Audit records are retained for the life of your engagement with the platform, and are not pruned or summarised as a matter of routine operation' and that 'Retention arrangements for organisations with specific regulatory obligations are agreed as part of onboarding'. No retention period is published for case records, evidence files, interview material, OSINT captures, AI drafts or search queries. The privacy policy (last updated June 2026) states only that personal information is retained 'for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law' and that it will then be destroyed or de-identified 'in accordance with APP 11'. No data processing agreement is published, although the privacy policy refers to 'our data processing agreements'. |
| Integrations | Standards-based single sign-on with an existing identity provider, stated on the security page as available to enterprise organisations. |
| Legal content coverage | No licensed legal content set is described. The vendor publishes its own compliance guide pages mapped to named Australian instruments and frameworks: the Australian Human Rights Commission positive duty (with the platform said to support 'AHRC Standard 6'), the Fair Work Act 2009, state and territory WHS psychosocial hazard regulations, the Privacy Act 1988 (Cth), the AML/CTF Act and AUSTRAC suspicious matter reporting, the Security of Critical Infrastructure Act 2018, and whistleblower obligations under the Corporations Act. Those are vendor guidance pages, not legal content licensed inside the product. |
| Pricing | No price, unit of charge, plan or tier is published. No pricing page appeared in the 46-URL site map run over sentinel-ops.app, and the calls to action on every page read are 'Book A Demo' and 'Request A Discovery Call'. The Terms of Use govern website use only and contain no fees. The privacy policy records that 'Billing and payment information (processed through PCI DSS-compliant payment providers)' is collected, which establishes that the platform is paid for but not how it is priced. The workplace-investigations page quotes external investigator rates of 'AUD $250 and $900 per hour' and external investigation costs of 'AUD $20,000 to $80,000'; those are the vendor's figures about the market, not the price of the product, and are not recorded as pricing. |
| Australian presence | Yes. CONTRACTING ENTITY, from the vendor's own Terms of Use (last updated March 2026): 'These Terms constitute a legally binding agreement between you and SentinelOps Pty Ltd (ABN pending)'. The privacy policy (last updated June 2026) opens with the same formulation: 'SentinelOps Pty Ltd (ABN pending)'. NO ACN OR ABN IS PUBLISHED on the terms, privacy, security, about, platform or solutions pages read; the footer of every page reads only 'Copyright 2026 SentinelOps. All rights reserved.' followed by 'Australian-owned and operated.' GOVERNING LAW: the Terms of Use are 'governed by and construed in accordance with the laws of the Commonwealth of Australia and the State of Queensland', with exclusive jurisdiction in 'the courts of Queensland and the Federal Court of Australia', and a dispute process of negotiation, then mediation administered by the Resolution Institute. Those Terms of Use govern the website only; the agreement for the platform itself is not published anywhere on the site. PUBLISHED CONTACTS: legal@sentinelops.com.au and privacy@sentinelops.com.au. HOSTING: the privacy policy states 'All platform and customer data collected by SentinelOps is stored within Australia. Our platform infrastructure is hosted exclusively in Australian data centres, and we do not transfer platform or customer data offshore', with the single stated exception of website analytics through Google Analytics 4 and Microsoft Clarity. The security page states 'All processing and all storage occur within Australia' and that Australian hosting 'is not a regional deployment option or a premium tier feature. It is the only deployment model'. NAME DISCREPANCY: the working roster recorded the vendor as 'Sentinel Investigations Pty Ltd'; nothing on the vendor's own site supports that name, so the name published in the vendor's own terms and privacy policy is used here. |
| Website | https://www.sentinel-ops.app/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Not confirmed | The vendor publishes the platform in five sections - Platform Overview, Case Management, Evidence Management, AI and OSINT, and Security and Data Sovereignty - and six solution pages (enterprise security, government, intelligence consultancies, insurance special investigation units, HR and employee relations, financial crime and AML). No plan, tier, edition, seat band, module list or feature matrix is published, so which of the AI and OSINT functions are included in a given subscription is unestablished. | What editions or tiers exist, and which of pattern detection, anomaly detection, OSINT collection, natural-language search and AI-assisted drafting are included in the one quoted to us? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [Workplace Investigation Software for Australian Organisations - solution page](https://www.sentinel-ops.app/solutions/workplace-investigations) |
| Deployment model | Public claim only | Single-tenancy-by-boundary cloud only. The security page states 'SentinelOps is delivered as a managed Australian-hosted service, with customer data separated at the data boundary rather than by shared application logic', that Australian hosting 'is not a regional deployment option or a premium tier feature. It is the only deployment model', and that the platform 'runs on enterprise-grade Australian cloud infrastructure' whose facilities are run by an unnamed 'major infrastructure provider'. For self-hosting the page invites a conversation rather than publishing an option: 'For organisations with specific data handling requirements or their own hosting mandates, contact our team - we will work through what your security policy and regulatory obligations require before proposing an arrangement.' | Which cloud provider and which Australian regions host the platform and its backups, and has any customer-hosted or private-cloud arrangement actually been delivered? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security) |
| Published functions | Public claim only | Published on the vendor's AI and OSINT page, checked 2026-09-27: cross-case pattern detection across subject, location, temporal, category and behavioural patterns, surfaced 'as alerts to investigators and supervisors'; anomaly detection for 'transactions that fall outside normal ranges, investigation timelines that exceed typical durations, or case outcomes that differ from similar historical matters'; OSINT collection covering 'automated searches across public data sources', 'structured capture and archiving of publicly available social media content', 'ASIC company searches, director histories, and corporate relationship mapping', media monitoring, and 'automated screening against OFAC, UN, EU, and Australian sanctions lists'; OSINT evidence capture with 'source URL, capture timestamp, search methodology, and the investigator who conducted the search'; AI-assisted report drafting that generates 'draft summaries from case notes, evidence, and investigation activity', structures reports to configurable templates, flags 'where the investigation record may be incomplete', and drafts AUSTRAC suspicious matter report narratives; natural language search across case data; and intelligence correlation by 'entity resolution', 'relationship mapping' and 'timeline construction'. The case-management workflow published on the workplace page runs 'complaint receipt, initial assessment, investigation planning, evidence collection, witness interviews, analysis, finding substantiation, and outcome determination'. | Demonstrate each named AI and OSINT function on our own matter types, and state which are available today as against on a roadmap. | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [Workplace Investigation Software for Australian Organisations - solution page](https://www.sentinel-ops.app/solutions/workplace-investigations) |
| Australian framing and legal use | Public claim only | The product is framed entirely to Australian regulation. The AI page ties anomaly detection to 'the transaction monitoring and suspicious matter identification obligations under the AML/CTF Act', AI drafting to AUSTRAC suspicious matter reports and to positive duty reports where 'the documented methodology must demonstrate compliance with AHRC Standard 6', and OSINT limits to the Privacy Act 1988. The security page cites the Protective Security Policy Framework, the Australian Government Information Security Manual and the Security of Critical Infrastructure Act 2018. The workplace page is written to the Australian Human Rights Commission positive duty from 12 December 2023, state and territory psychosocial hazard regulations, Fair Work Commission process decisions and whistleblower obligations under the Corporations Act. The platform makes no legal determination on the vendor's own account: 'AI never creates a finding on its own, and every conclusion is reviewed and recorded by an investigator who remains accountable for it.' | Which of the named statutory frameworks are supported by configured workflows in the product as distinct from guidance on the website, and who maintains them when the law changes? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [Workplace Investigation Software for Australian Organisations - solution page](https://www.sentinel-ops.app/solutions/workplace-investigations) |
| Licence and fees | Not confirmed | No licence, subscription term, fee, renewal or termination-for-convenience provision for the platform is published. The only licence granted in any published document is for the website: the Terms of Use grant 'a limited, non-exclusive, non-transferable, revocable licence to access and use the Website for personal, non-commercial informational purposes only'. The privacy policy confirms billing and payment information is collected through 'PCI DSS-compliant payment providers' without naming them. | Provide the platform subscription agreement with the fee basis, term, renewal, price-review and termination provisions. | [SentinelOps Terms of Use, last updated March 2026](https://www.sentinel-ops.app/terms); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Integration with firm and organisation systems | Not confirmed | The site map returned a platform integrations page, which was not opened for credit reasons, and the security page refers in passing to 'browser sessions, programmatic access, integrations, and communication between internal services' travelling over encrypted channels, which implies programmatic access exists. No named integration, connector, API documentation or supported system appears on any page read. The one integration stated in terms is identity: 'Enterprise organisations can integrate SentinelOps with their existing identity provider using standards-based single sign-on.' | What integrations and APIs exist, specifically with our human resources system, document management system and email, and what data crosses each boundary? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security) |
| Support and contacts | Not confirmed | No support hours, response target, availability target or service credit regime is published for the platform. The published contacts are legal@sentinelops.com.au in the Terms of Use and privacy@sentinelops.com.au in the privacy policy. The privacy policy does commit to timeframes for privacy matters only: access and correction requests answered 'within 30 days', complaints acknowledged 'within 7 days' with resolution aimed at 30 days. The security page states that 'Defined recovery objectives are documented and are provided to customers, with the arrangements that apply to your organisation set out in your agreement' without publishing the objectives. | What are the availability target, recovery time and recovery point objectives, support hours and escalation path, and where are they recorded? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Terms of Use, last updated March 2026](https://www.sentinel-ops.app/terms); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Published quality evidence | Not confirmed | No accuracy measure, benchmark, evaluation or error rate is published for pattern detection, anomaly detection, entity resolution, OSINT screening or AI drafting. The AI page instead sets out the limits of the approach in the vendor's own words, including that AI 'cannot assess witness credibility' and 'cannot determine whether a regulatory threshold has been met based on the nuances of a specific factual matrix'. Quantitative claims on the pages read are about the market rather than the product, including 'an estimated 70 to 80 percent of Australian workplace investigators have no dedicated software for managing investigations', which is published without attribution. No customer is named on any page read, and no case study, reference site or independent evaluation is published. | What measured evidence exists for entity resolution and sanctions screening accuracy, including false positives and misses, and can you provide a reference site in our sector? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [Workplace Investigation Software for Australian Organisations - solution page](https://www.sentinel-ops.app/solutions/workplace-investigations) |
| Task fit and verification | Public claim only | The vendor draws the boundary itself: AI is applied 'to analysis, OSINT collection, natural-language search and report drafting, with each output presented for investigator review and confirmation rather than applied automatically', and 'Where the platform produces an evaluative assessment, that assessment is computed by documented rules rather than by a language model, so a model cannot shape an outcome it does not produce.' Anomalies 'are flagged for investigator review, not automatically actioned'. What is not published is what those documented rules are, what an investigator is shown to check a surfaced pattern, or how a draft report marks the passages the model generated. | Show us the documented rules behind any evaluative assessment, and show how a reviewer sees the source data behind a surfaced pattern and the model-generated passages in a draft report. | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation) |
| Vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27 and not found. A site map over sentinel-ops.app returned 46 URLs with no /llms.txt, /ai-info, /ai, /for-ai or equivalent address, and none of the six pages read (AI and OSINT, security, terms, privacy, about, workplace investigations) contains a block addressed to AI models, assistants or crawlers, or any instruction about how the product should be described. Two adjacent things are recorded here separately and are not the same: first, the Terms of Use restrict automated access, stating that a user agrees not to 'Use any automated means, including robots, crawlers, or scrapers, to access the Website for any purpose without our express written permission', which is access control rather than direction about narrative; second, the site publishes comparison pages named after competitors (CaseIQ, NAVEX and Polonious alternatives) and procurement-guidance pages, none of which was opened and from which nothing is recorded in this profile. | Does SentinelOps publish any file or embedded block that instructs AI models, assistants or crawlers on how to describe the platform, and at what address? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [SentinelOps Terms of Use, last updated March 2026](https://www.sentinel-ops.app/terms) |
| Client authority and professional use | Public claim only | The privacy policy allocates roles: 'Where our platform is used to manage investigation data, customers are the data controllers for any sensitive information contained within their investigation records. SentinelOps acts as a data processor in relation to customer investigation data and processes such data only in accordance with customer instructions and our data processing agreements.' Those data processing agreements are not published anywhere on the site, so the instructions, warranties and authority requirements they contain cannot be read. Nothing published addresses legal professional privilege over material held in the platform. | Provide the data processing agreement, and confirm how privileged material and legal advice held in a case record are protected from disclosure and from access by your personnel. | [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Foundation-model providers | Not confirmed | No model, model family, model version or model provider is named anywhere on the pages read. The AI page states that 'all AI processing occurs on Australian-hosted infrastructure' and answers 'Is investigation data sent to third-party AI services?' with 'No. All AI processing occurs on Australian-hosted infrastructure, and investigation data does not leave Australia.' The same page's bias answer refers to 'a language model' in the negative, saying an evaluative assessment 'is computed by documented rules rather than by a language model', which indicates a language model is used somewhere in the product without identifying it. Whether models are self-hosted open-weight models, a commercial service running in an Australian region, or both, is unestablished. | Name every model and provider used for pattern detection, entity resolution, natural-language search and report drafting, say where each is hosted, and confirm whether any is a commercial API in an Australian region. | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security) |
| Subprocessors | Not confirmed | No subprocessor list is published and no provider is named. The privacy policy names only categories: 'Australian-based hosting providers, payment processors, and technology service providers who assist us in operating our platform, subject to contractual confidentiality and data protection obligations'. The security page refers to 'a major infrastructure provider' without naming it. For the website only, the privacy policy names Google Analytics 4 and Microsoft Clarity, loaded through Google Tag Manager, and states that Clarity 'is configured to mask form inputs and on-page content'. Payment providers are described as 'PCI DSS-compliant' but not named. | Provide the subprocessor list for the platform with each provider's role, entity and country, and the notice process before a new one is engaged. | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Training on customer content | Not confirmed | Nothing published states whether investigation data, prompts, AI drafts or investigator corrections are used to train, tune or evaluate any model. The AI page's statements are about location and disclosure rather than training: investigation data 'does not leave Australia' and is not 'sent to overseas AI services'. Its responsible-AI principles include 'Data minimisation: AI processing uses only the data necessary for the specific analytical task' and 'Bias awareness: AI models are monitored for bias', neither of which addresses training on customer content. No commitment against training appears in the privacy policy or the Terms of Use. | Will SentinelOps warrant that investigation data, prompts, AI drafts and investigator corrections are never used to train, tune or evaluate any model, including for other customers and including in de-identified form? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Feedback and quality monitoring | Not confirmed | Nothing published states what happens when an investigator edits or rejects an AI draft, a surfaced pattern or an entity match. The AI page states that 'AI models are monitored for bias, and investigators are trained to critically evaluate AI outputs' and that 'where AI identifies patterns or anomalies, the underlying data and reasoning are accessible to the investigator', without saying whether corrections are captured, aggregated or reviewed by the vendor. No telemetry or product-analytics statement for the platform appears on any page read; the analytics named in the privacy policy relate to the website. | Is an investigator's edit to or rejection of an AI output captured, does it leave our tenancy, and who at SentinelOps can see it? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Retention of case data, evidence and audit records | Public claim only | Published for audit records only. The security page states 'Audit records are retained for the life of your engagement with the platform, and are not pruned or summarised as a matter of routine operation' and that 'Retention arrangements for organisations with specific regulatory obligations are agreed as part of onboarding'. Backups are described as 'a daily backup of the case database, and separate versioned copies of stored evidence captured multiple times each day', held encrypted in Australia, with no retention period given. The privacy policy retains personal information 'only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law'. No retention period for case records, evidence, OSINT captures, AI drafts or search queries is published. | What retention periods apply to case records, evidence files, OSINT captures, AI drafts and backups, which are configurable, and how do they interact with our own records-authority obligations? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Deletion and certified erasure | Not confirmed | No deletion capability, deletion timeframe, backup-purge period or erasure certificate is published for investigation data. The privacy policy addresses only personal information the vendor holds as controller, stating that when it is no longer required 'we will take reasonable steps to destroy or de-identify it in accordance with APP 11', and provides an access and correction right under APP 12 and APP 13. The immutable, append-only audit design published on the security page raises a question the site does not answer about how deletion of a case record is reconciled with a tamper-evident chain that records every action. | Can a case record and its evidence be deleted on request, how is that reconciled with the immutable audit chain, within what period does deletion reach backups, and will you certify erasure on exit? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Vendor access to content | Public claim only | The security page states that 'Administrative access is restricted to a small number of named individuals and requires strong non-password authentication', and that encryption keys are 'held separately from the data they protect, and access to key material is restricted to the platform itself rather than to any individual operator'. The privacy policy adds 'Employee security awareness training and background checks' to its security measures. Nothing published states whether SentinelOps personnel can open a customer's case record or evidence file for support purposes, whether such access is logged in the customer-visible audit trail, or whether customer approval is required first. | Can your personnel open our case records or evidence, under what authorisation, is that access written to the audit trail we can read, and is our approval required first? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Access control, single sign-on and audit | Public claim only | The privacy policy lists as security measures 'Multi-factor authentication for all platform access' and 'Role-based access controls and regular access reviews'. The security page adds detail: multi-factor authentication 'is enforced by default for every SentinelOps user. It is not an optional setting and cannot be disabled at the tenant level', with time-based one-time codes; standards-based single sign-on for enterprise organisations; separation between customer organisations 'at the data boundary itself', so that 'a request can only return records belonging to the organisation that made it'; roles plus case-level permissions so that sensitive matters 'can be compartmentalised'; time-limited sessions; and audit logging that records read access and attributes it to a named individual, with cryptographic chaining so that 'any attempt to modify, delete or reorder historical records would break the cryptographic chain'. | Which identity providers are supported for single sign-on, can we enforce compartmentalised case access by policy, and can we export the audit trail, including read events, in a machine-readable format? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Encryption in transit and at rest | Public claim only | The privacy policy states 'AES-256 encryption of data at rest' and 'TLS 1.3 encryption of data in transit'. The security page states that encryption at rest covers 'case records, evidence files, attachments, notes, communications, and audit logs - there is no category of stored investigation data that sits unencrypted', that keys are 'held separately from the data they protect', that transit encryption applies to browser sessions, programmatic access, integrations and internal service traffic with deprecated protocol versions not accepted, and that every evidence file 'is fingerprinted with a cryptographic hash at the moment of upload' which can be re-verified. The page withholds the specifics: 'The specific algorithms, key lengths and key-handling arrangements are documented in our security questionnaire response, provided to prospective customers on request.' | Provide the security questionnaire response with algorithms, key lengths and key management, and state whether customer-managed or customer-held keys are available. | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Independent security assurance | Public claim only | The vendor states its position plainly and against itself. On ISO 27001 the security page says SentinelOps 'operates a documented information security management system built to ISO/IEC 27001' and then: 'To be unambiguous: SentinelOps is not currently ISO 27001 certified. Certification is in progress and we will say so here on the day it is achieved, and not before.' On the Essential Eight it says SentinelOps 'has not been assessed against a specific Essential Eight maturity level and does not claim one'. On the data centre it says the operator's certifications 'belong to the facility operator, not to SentinelOps, and we do not present them as ours'. What is offered instead is 'a written control summary' to government and critical infrastructure buyers on request, and a security questionnaire response. No SOC 2 report, IRAP assessment or penetration test summary is published. | When is ISO 27001 certification expected, which certification body is engaged, what is the intended scope, and can we see the current control summary and the most recent penetration test report? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security) |
| Contract, liability and forum | Public claim only | The only agreement published is the website Terms of Use (last updated March 2026), between the user and 'SentinelOps Pty Ltd (ABN pending)'. Its liability cap is for website use and is very low: 'Our total aggregate liability arising out of or in connection with these Terms or your use of the Website shall not exceed one hundred Australian dollars (AUD $100)', with Australian Consumer Law rights preserved. Governing law is the Commonwealth of Australia and the State of Queensland with exclusive jurisdiction in the Queensland courts and the Federal Court, and disputes go to negotiation then mediation administered by the Resolution Institute. SentinelOps may also 'modify these Terms at any time', with changes 'effective upon publication'. No platform subscription agreement, service level agreement or data processing agreement is published, so no liability position for the platform itself can be read. | Provide the platform agreement and data processing agreement, and state the liability cap and indemnities that would apply to a privacy breach or evidence loss in the platform, as distinct from the AUD $100 website cap. | [SentinelOps Terms of Use, last updated March 2026](https://www.sentinel-ops.app/terms); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Cross-border transfers and APP 8 | Public claim only | The privacy policy states that 'All platform and customer data collected by SentinelOps is stored within Australia. Our platform infrastructure is hosted exclusively in Australian data centres, and we do not transfer platform or customer data offshore', and that 'We do not disclose personal information to recipients outside Australia unless we have taken reasonable steps to ensure the overseas recipient complies with the APPs, or the disclosure is otherwise permitted under the Privacy Act 1988'. It records one exception, for the website rather than the platform: analytics through Google Analytics 4 and Microsoft Clarity 'may be processed outside Australia', handled 'in accordance with APP 8'. The security page states 'No part of the platform, and no copy of your data, sits outside Australian jurisdiction', that backups are held in Australia, and that there is 'no offshore data replication, no foreign-jurisdiction backup storage, and no cross-border data transfer'. | Will the residency statement be a warranty in our agreement, covering inference, backups, logging and support access, with notice before any change? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Incident notification and history | Public claim only | The privacy policy states that SentinelOps 'complies with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988' and that 'In the event of an eligible data breach involving personal information that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law', maintaining 'an incident response plan that includes procedures for identifying, containing, assessing, and responding to data breaches'. That is the statutory obligation restated; no contractual notification period to the customer, no named incident contact beyond privacy@sentinelops.com.au, no status page and no incident history appears on any page read. | Within what period will you notify us, as customer, of any security incident affecting our tenancy including one that does not meet the eligible-breach threshold, and what information will the notice contain? | [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Change notice for terms, product and models | Public claim only | Both published documents reserve unilateral change with immediate effect. The Terms of Use: 'We reserve the right to modify these Terms at any time. Changes will be effective upon publication on this page. Your continued use of the Website after any changes constitutes acceptance of the modified Terms.' The privacy policy: 'We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated "Last updated" date ... Continued use of our website and services after any changes constitutes acceptance of the updated Privacy Policy.' Nothing is published about notice before a change to a model, an AI feature, the hosting arrangement or the subprocessors, and the security page states that its own statements are governed by the internal management system rather than by a change-notice commitment. | What notice will we receive before a change to the models, the AI features, the hosting arrangement or a subprocessor, and will privacy-policy changes affecting the platform be notified rather than only published? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Terms of Use, last updated March 2026](https://www.sentinel-ops.app/terms); [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) |
| Export and exit | Not confirmed | No export format, bulk export, transition assistance or end-of-contract data return is published for case records, evidence or audit trails. The security page's related statements are about integrity rather than portability: audit records are 'retained for the life of your engagement with the platform', and evidence files carry a re-verifiable hash. The Terms of Use address only the end of website access: 'We may terminate or suspend your access to the Website at any time, without prior notice or liability, for any reason'. For an investigation record that may have to be produced years later to a tribunal or court, the absence of a published export path is a material gap. | On exit, in what format do we receive case records, evidence files with their hashes, and the complete audit trail, within what period, and can the exported audit chain still be verified outside your platform? | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security); [SentinelOps Terms of Use, last updated March 2026](https://www.sentinel-ops.app/terms) |
| Connectors and third-party tools | Not confirmed | A platform integrations page exists in the site map and was not opened; no connector, marketplace, plug-in or third-party AI tool is described on any page read. The security page refers to 'programmatic access, integrations' as traffic classes covered by transport encryption, and to single sign-on with an existing identity provider, which are the only concrete connection points published. Whether the platform can be reached by an external agent or automation surface is unestablished. | List every inbound and outbound connector and API, say whether any third-party AI tool can reach case data, and confirm we can disable each one. | [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security) |
| Open-web access | Public claim only | Open-web retrieval is a published function of this product, not an incidental one. The AI page states that OSINT capabilities 'bring external intelligence into the investigation workflow' through 'automated searches across public data sources for subjects, organisations, and associated entities', 'structured capture and archiving of publicly available social media content', 'ASIC company searches, director histories, and corporate relationship mapping', media monitoring and 'automated screening against OFAC, UN, EU, and Australian sanctions lists'. The stated limits are that 'The platform does not access private data, bypass access controls, or conduct covert surveillance', that all capabilities 'operate within publicly available information sources, consistent with the Privacy Act 1988 and investigator codes of conduct', and that captures carry source URL, timestamp, methodology and the investigator's identity. No source list, licensing position for the data sources, or statement about what leaves the tenancy when a search runs is published. | Which external sources are queried, what leaves our tenancy when an OSINT search runs, are those queries logged and attributable, and how are the sources licensed? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation) |
| Automated action and confirmation | Public claim only | The vendor publishes a no-automatic-action position and an off switch. AI outputs are 'presented for investigator review and confirmation rather than applied automatically'; 'Every AI suggestion requires human review and approval before it affects case outcomes'; anomalies are 'flagged for investigator review, not automatically actioned'; and 'SentinelOps AI augments investigator judgement ... All investigation decisions, including findings, recommendations, and outcomes, require human review and approval.' On disabling: 'Yes. AI features can be enabled or disabled at the organisational level or for specific case types. Organisations that prefer not to use AI capabilities can operate the platform with AI features turned off.' These are statements on a product page; nothing contractual was found, and no administrative documentation showing the controls was read. | Show the administrative setting that disables AI features by case type, and confirm that no AI output can alter a case record, notify a person or run an OSINT search without an investigator confirming it. | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation) |
| Human review before use | Public claim only | The AI page states that 'all AI outputs are clearly identified as AI-assisted. No AI analysis is presented as human work', that 'Every AI-generated draft is clearly marked as AI-assisted and requires investigator review, modification, and approval before it becomes part of the investigation record', and that for AUSTRAC suspicious matter report drafts 'The AI-assisted nature of the draft is documented in the audit trail'. It also states that 'AI never creates a finding on its own, and every conclusion is reviewed and recorded by an investigator who remains accountable for it.' What is not published is how the marking survives export or printing, or whether an approval record is exportable as evidence of the review. | Does the AI-assisted marking and the approval record survive export, print and disclosure of a report, and can we produce that record to a tribunal as evidence of our review? | [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation) |

## Notes

Five firecrawl operations were available and five were used across both stages: a site map of sentinel-ops.app in stage one (the AI and OSINT page and the workplace-investigations page were already cached at no cost), then the security page, Terms of Use, privacy policy and About page in stage two. The documents that would settle the platform position do not exist publicly: there is no subscription agreement, no service level agreement, no data processing agreement (although the privacy policy refers to 'our data processing agreements'), no subprocessor list and no trust centre. The Terms of Use govern the website only and cap liability at AUD $100 for website use, so nothing published states the liability, term, fees or exit position for the platform itself. Unverified as a result: models and model providers, training on customer content, feedback capture, deletion of case data, vendor access to case records, export and exit, connectors, and pricing. What is unusually well published, and recorded above with the vendor's own words, is Australian residency (exclusive Australian data centres and Australian AI processing, stated as the only deployment model), encryption (AES-256 at rest, TLS 1.3 in transit), enforced multi-factor authentication, tenant separation at the data boundary, and a cryptographically chained audit trail that records read access; and the vendor states against itself that it is 'not currently ISO 27001 certified' and has not been assessed against an Essential Eight maturity level. On the vendor's name: the working roster recorded 'Sentinel Investigations Pty Ltd', but the Terms of Use and privacy policy both name 'SentinelOps Pty Ltd (ABN pending)', so that name is used and the discrepancy is recorded in facts.australia.notes; no ACN or ABN is published anywhere on the site, which is a gap a firm should close before contracting. Not reached, and named so they can be picked up next: the platform overview, case management, evidence management, reporting and analytics, document comparison and integrations pages; the compliance guide pages for AUSTRAC, positive duty, SOCI, Fair Work, WHS psychosocial and whistleblower protection; and the resources pages. Capability values used are the closest defensible existing ones; three gaps in the controlled vocabulary are reported separately and no new value is used here. The vendor-AI-directing check was made and found nothing; see the 'information' consideration, which also records, as a separate matter, the automated-access restriction in the Terms of Use.

## Sources

- [AI-Assisted Investigation (AI and OSINT) - SentinelOps platform page](https://www.sentinel-ops.app/platform/ai-investigation) (checked 2026-09-27)
- [Security and Data Sovereignty - SentinelOps security page](https://www.sentinel-ops.app/security) (checked 2026-09-27)
- [SentinelOps Terms of Use, last updated March 2026](https://www.sentinel-ops.app/terms) (checked 2026-09-27)
- [SentinelOps Privacy Policy, last updated June 2026](https://www.sentinel-ops.app/privacy) (checked 2026-09-27)
- [About SentinelOps](https://www.sentinel-ops.app/about) (checked 2026-09-27)
- [Workplace Investigation Software for Australian Organisations - solution page](https://www.sentinel-ops.app/solutions/workplace-investigations) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.