Configurable Governance Controls
Songlines Control® provides configurable control patterns that can be enabled and scoped according to workload risk, deployment boundaries and the customer's governance operating model.
Core Security Architecture
Sovereign Infrastructure
Australian deployment and customer-hosted patterns can support residency requirements. Effective boundaries depend on the selected deployment, connected providers, data flows and customer configuration.
Zero-Trust Architecture
Requests routed through configured enforcement paths can be authenticated, authorised and evaluated against applicable policy. Customers remain responsible for route coverage and complementary identity controls.
Tamper-Evident Governance Records
Configured governance records can be signed and maintained as append-only entries. Evidence coverage and retention depend on source completeness, deployment settings and privileged administration.
PII Auto-Redaction
Configured detection and redaction rules can process selected sensitive-data types on covered enforcement paths. Customers remain responsible for classification, coverage, exceptions and validation.
Role-Based Access Control
Granular RBAC with per-user AI spend attribution. Admins, users, and service accounts each have precisely scoped permissions — nothing more.
Flexible Deployment
Choose a managed, customer-hosted or isolated deployment pattern after validating environment dependencies, residency boundaries and support responsibilities.
Tamper-Evident Audit and Compliance Records
Covered interactions can generate tamper-evident records using the fields received from connected workloads and policy decisions. These records support customer review when combined with appropriate retention, legal, risk and operating controls.
Compliance & Regulatory Alignment
Songlines Control® is designed to support compliance across the frameworks that matter most to Australian enterprise and government organisations.
-
ISO 27001
Our Information Security Management System is aligned with ISO 27001 standards. Security controls are embedded in the product architecture, not bolted on.
-
Assessment Support
Product controls and evidence can support customer assessment against selected ISM requirements. Applicability and suitability depend on the deployed architecture, control ownership and assessment scope.
-
ISO 42001
Aligned with the international standard for AI Management Systems — providing a governance framework for responsible AI deployment at enterprise scale.
-
Essential Eight
Selected corporate and product controls are mapped to Essential Eight mitigation areas. Customers should assess applicability and maturity within their own environment.
-
Privacy Act
Songlines Control® supports compliance with the Australian Privacy Act 1988, including data residency controls, PII redaction, and access audit trails.
-
APS AI Policy
Designed to support Australian Public Service AI use policy requirements, including human oversight, transparency, and accountability for AI-assisted decisions.
Vulnerability Disclosure
We welcome responsible disclosure from the security community. If you believe you have discovered a security vulnerability in our platform, please contact our security team at security@cetusai.com.au. We will acknowledge receipt and coordinate triage and remediation communication according to severity and available evidence.