AI Trust Infrastructure is not a governance dashboard.

Traditional tools rely on point-in-time self-assessments that can be weeks stale before the next review cycle. Generic AI governance tools surface dashboards but leave control evaluation to manual configuration. Sentrify runs structured, framework-native control evaluation on every submission — continuously, not periodically.

SHA-256 keying detects any post-submission modification — the hash is recorded at ingest and verified on every access. The audit log records every access event, not just upload events, so a regulator can trace the full chain of custody for each document.

Every TrustScore is dimension-weighted, fully reproducible, and traceable to the exact control decisions that produced it. LLM calls are used only during control evaluation — never during scoring. The same inputs always produce the same score, which matters when a regulator asks you to explain a number.

Controls are authored against a specific framework version and published as immutable assurance packs. When standards change, a new pack version is published and future evaluations reference it explicitly. Prior evaluations retain their meaning because they are permanently pinned to the pack version they ran against.

Each control passes through 4 evaluation layers: deterministic rules (L1), LLM-assisted reasoning (L2), evidence document validity (L3), and adversarial probe packs (L4). The adversarial layer executes versioned red-team probe packs as a structured fourth pass — producing a pack-versioned record alongside each control decision, not a free-text assessment.

Sentrify routes governance approvals to named humans — it never approves on behalf of governance. Risk tier determines which committee receives the submission; quorum-based endorsement gives governance leads a defensible record. Rejection always requires a mandatory comment and triggers a revise-and-resubmit cycle.

All storage, processing, and LLM inference run inside AWS ap-southeast-2. No data leaves the region. This matters for regulated Australian industries subject to TEQSA, APRA CPS 234, and OAIC Privacy Act obligations — the architecture is designed for Australian data residency, not retrofitted for it.

When a framework standard evolves, a new assurance pack version is published. All prior evaluations remain permanently pinned to the pack version they ran against — historical reports retain their meaning even after the standard changes. Only new evaluations reference the new version.

A regulator or auditor can independently verify any historical report because the evidence content (SHA-256), the control decisions, and the TrustScore math are all preserved and linked. The report itself carries an integrity hash, so any post-generation modification is detectable.

Every evaluation routes to named committee members who endorse — not just flag — the outcome. A governance lead records the final decision. Rejection always triggers a mandatory comment and a revise-and-resubmit cycle, not a silent denial. The full decision trail is preserved in the immutable audit log.