Castlepoint Systems buoyed by government take-up of its AI data-protection technology

Castlepoint Systems, a company that employs artificial intelligence to securely manage data, is making significant inroads into the government sector after revealing that two-thirds of federal government portfolios have implemented its technology.

Castlepoint, a Canberra-based company co-founded and led by certified auditor Rachael Greaves, secured five new federal government departments as clients, including the Attorney General’s Department, in FY23 following another year of significant growth.

The government contracts, plus new clients in higher education, critical industry, and the commercial sector domestically and overseas, have helped Castlepoint's revenue surge more than 100 per cent in the past financial year with plans to grow further in FY24.

Castlepoint Systems, which Greaves co-founded in 2012 with Gavin McKay, provides an AI solution that the company says resolves the long-standing, intractable problems of eDiscovery, security, and records management, and overcomes the limitations of traditional records systems.

Castlepoint uses artificial intelligence to automatically register, classify, sentence, track, monitor and audit all records of a business, no matter the system in which they are stored. 

Greaves designed the solution after more than a decade of work with information security management systems that she says were failing to meet either business needs or compliance obligations.

Castlepoint Systems now manages more than 286.5 million records for its clients in more than 1.6 million separate systems.

The company says it has identified more than a quarter of a billion sensitive and high-risk records for clients that require protection. It has applied records retention rules to these so they can be appropriately preserved or lawfully destroyed, in turn reducing the potential harm of future data spills.

“Government has significant obligations for compliant information management,” says Greaves, the Castlepoint CEO.

“The volume of digital records held by Commonwealth entities has jumped from 51 terabytes in 2013, to more than 314,000 TB in 2022. There is just too much volume, variety, and velocity of data for legacy control methods to be effective.

“Castlepoint has disrupted these traditional models that have failed the test of time and helped keep the Australian public service at the forefront of accountability and responsibility.

“By making discovery, audit, privacy, cyber security, and records management part of one enterprise capability, we have joined the hands of compliance and cyber teams united against a common threat environment. This has amplified their ability to mitigate the risk of losing our nation’s records which results from a lack of effective command and control.”

However, government customers are applying the Castlepoint system for more than just tactical management of records.

 "Castlepoint has given Treasury’s information management team the ability to confidently provide metrics and insights to senior leadership, and to support strategies and plans for improving information management capability,” says a Treasury spokesperson.

“Having full control of information doesn’t need to cause unwanted impacts. With Castlepoint’s AI capabilities, we can know what data we have, where it is, and who is doing what to it.

“We can determine what inherent risk and value it has, what rules apply to it, and whether they are being met. And we can do this without the impacts we see on users, source systems, source data, or the regulatory team that we have all experienced before with other types of GRC (governance, risk and compliance) solutions.”

Greaves, herself a victim of cyber hacking when the personal information of 19 years’ worth of Australian National University students was lost to a foreign adversary in 2018, says the key to Castlepoint’s system is to allow governance teams to have a complete view across the whole environment. She says this facilitates the quick application of security, discovery, and compliance processes.

Greaves developed the 'Data Castle' model as a solution that would be invisible to users and not affect their productivity. However, it was designed to make any and every system being used compliant under law, as well as auditable and discoverable.

The ‘castle’ effectively sits in the middle of the network ‘kingdom’, and constantly watches all activity in the systems below. The AI in the castle reads and registers every single information asset, and uses its content to classify it against policies, security rules and records authorities.

Castlepoint says it supports agencies to discover, audit and protect high-risk and high-value information from any system in a single interface with what it describes as Explainable AI (XAI).

Apart from the Attorney General’s Department, Castlepoint Systems secured contracts with the federal departments of Agriculture, Fisheries and Forestry; Climate Change, Energy, the Environment and Water; Education; and Employment and Workplace Relations in FY23.