For heads of IT, IT risk and security · Australia
You will run it. You do not want to build it.
Sastrum runs as SaaS, in your own cloud account or in your data centre, with the AI model you choose, roles and approval chains you configure in the browser, and a record that answers CPS 234 questions without a project.
Your situation
Every GRC tool promises integration. You end up owning the glue.
Problems
- Controls, evidence and policies sit in tools that do not talk to each other, and you are the one asked to reconcile them.
- CPS 234 and the Essential Eight want evidence that is current; what you have is a folder from the last audit.
- The board wants a cloud tool; the outsourcing policy wants the data to stay where you can see it.
Needs
- A deployment choice that fits the policy: SaaS, your own cloud account, or on-premise, the same product in each case.
- Roles, separation of duties and approval chains you configure yourself, without a change request to the vendor.
- A way to load what you already have: registers, controls and incidents, by file, not by re-keying.
Desires
- An AI assistant that drafts controls and policies but never publishes without a named approver.
- An audit trail you can hand to the auditor as it is, filtered by module, actor and date.
What you would love
- A system the business runs itself, where you are consulted and not paged.
- Sensitive work routed to a model inside your perimeter, and everything else to the cloud, by rule.
Three things that are different
Yours to run, not yours to build.
- 01
Deploy it your way, including the AI.
SaaS, private cloud in your account, or on-premise with the models inside. Per-task routing keeps high-sensitivity work on the model you choose; keys are encrypted at rest and masked on screen.
- 02
Configure, do not customise.
Nine permission areas, custom roles from a permission matrix, conflict rules for separation of duties, and review chains and templates set in the browser. What you change is recorded, not patched.
- 03
A record built for CPS 234.
Every change in an immutable trail, including requests to Lumina. Maker, checker and head of department on every approval, with an SLA clock, so the evidence for the auditor is the system itself.
Coverage for Australia
The standards you are measured against, already mapped.
CPS 234, CPS 230, SOCI and the Privacy Act are in the product, alongside ISO 27001 and the other global standards your controls already follow.
Your regulators
Frameworks for you
- APRA CPS 234
- APRA CPS 230
- Privacy Act 1988 and NDB scheme
- SOCI Act 2018
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Banks, building societies, super funds, insurers and brokers
CPS 234, CPS 230, Privacy Act, ASIC
Why this matters now
The obligations are dated and the penalties are public.
Australian figures, each linked to its source.
A$50m
maximum penalty for serious interference with privacy, or more where 3x the benefit or 30% of turnover is greater
A$5.8m
first civil penalty ordered under the Privacy Act, for a data breach, October 2025
72 hours
to notify APRA of a material information security incident
24 hours
to notify APRA of a disruption to a critical operation outside tolerance
Bring your questions. We open on the admin console.
Sixty minutes with the product team: the role matrix, the approval chain, the audit trail, model routing and the deployment options, on a sample Australian tenant.