For procurement, vendor management and compliance · Australia
You have to clear us before anyone can buy us.
Sastrum is built to pass an APRA-regulated firm's outsourcing assessment: deployment your way, a security pack on request, a partner in Australia, and a contract written for regulated firms.
Your situation
A cloud vendor is an outsourcing decision, and APRA will ask to see it.
Problems
- CPS 230 and CPS 231 make every material service provider your problem, with a contract the regulator may read.
- Most vendors answer the security questionnaire slowly, partially, or with marketing.
- Data residency, access and exit terms get settled late, after the business has already chosen.
Needs
- Clear hosting options and regions, stated once and not changed in the sales cycle.
- A security pack that answers the questionnaire: data handling, access, continuity, testing, what is certified and what is not.
- A price model with no surprises, and a contract that fits the outsourcing policy.
Desires
- Clear a vendor in weeks, not months, with the documents already in hand.
- One local contact who answers the same day.
What you would love
- A vendor who sends the due-diligence answers before you ask for them.
- An exit plan written into the contract from the start.
Three things that are different
Built to be assessed, not just bought.
- 01
Deployment your way.
SaaS, private cloud in your own account, or on-premise, the same product in each case. An Australian hosting region is being confirmed and will be stated here, not before.
- 02
A security pack on request.
Data handling, hosting, access control, business continuity, a penetration test summary, and the certifications SecurEyes holds. Nothing is claimed that the pack cannot show.
- 03
A partner in Australia.
Accuteque implements and gives first-line support in your hours; SecurEyes, a cyber security consultancy of twenty years, stands behind the product and the contract.
Coverage for Australia
The standards your assessment will check against.
The frameworks your own firm answers to are in the product, which is also what your assessment of us will measure.
Your regulators
Frameworks for you
- APRA CPS 234
- APRA CPS 230
- Privacy Act 1988 and NDB scheme
- SOCI Act 2018
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Banks, building societies, super funds, insurers and brokers
CPS 234, CPS 230, Privacy Act, ASIC
Why this matters now
The obligations are dated and the penalties are public.
Australian figures, each linked to its source.
A$50m
maximum penalty for serious interference with privacy, or more where 3x the benefit or 30% of turnover is greater
A$5.8m
first civil penalty ordered under the Privacy Act, for a data breach, October 2025
72 hours
to notify APRA of a material information security incident
24 hours
to notify APRA of a disruption to a critical operation outside tolerance
Start the assessment with the pack in hand.
Tell us which questionnaire you use and we will answer it, with the hosting options and a draft contract.