Governance software for organisations that get audited.
Sanctis is an Australian platform for oversight work — contracts, grants and confidential disclosures — built for government agencies, regulated enterprises and non-profits where isolation, auditability and data residency come first.
The principles the platform is designed around
Each module does a single job, but they share one identity system, one access model and one audit trail.
- One isolated instance per customer
- Every customer gets their own running deployment — its own database, its own storage, its own encryption keys, its own address. There is no shared database to leak across.
- Australian data residency
- Every record, backup and process stays in Australian Azure regions. Nothing fails over or replicates offshore.
- Audit-first
- Append-only logs of authentication, permission and record changes. A permission model that can explain why a person has access to something. Support access that is time-boxed, approval-gated and recorded on both sides.
- One reviewed build
- Every customer runs the same image. Modules are switched on per customer by a signed entitlement — never by shipping different code to different people.
- Accessibility
- The interface is built to WCAG 2.1 AA, the baseline for Australian government procurement.
Where we are, and where we're headed
Sanctis is built to meet the frameworks our customers answer to. Some are in place today; others are a deliberate roadmap.
- Privacy Act 1988 & the Australian Privacy Principles
- AU-region data handling (APP 8), security of personal information (APP 11), and access & correction request support (APP 12/13) are designed in.
- SOC 2 (Security, Availability, Confidentiality)
- A target. The technical controls are mapped; the operational programme is being built toward an external audit.
- IRAP / PSPF / Essential Eight
- Future scope. A hardened government configuration — mandatory SSO, IP allowlisting, short idle timeouts, customer-managed keys — is the on-ramp.
Accountability. Sanctis is built and operated by one small Australian team. The people responsible for how your instance is run, and the security documentation behind these commitments, are provided as part of onboarding.
Want to talk it through?
Tell us what your organisation is trying to keep on top of, and we'll show you how Sanctis fits.