Castlepoint AI Review: Australian Records Management and Information Governance at Enterprise Scale

🏆 AID Top Pick — Compliance & Data Governance

Verdict (TL;DR): Castlepoint is a genuinely Australian AI platform solving a genuinely hard problem: how do large organisations manage millions of records across hundreds of systems without disrupting operations or relying on manual classification? The answer is explainable AI that reads content, applies retention and compliance rules, and acts without moving data. Two-thirds of Australian federal government portfolios have adopted it. The pricing is enterprise-tier, the target market is government and regulated industries, and the product is not for small businesses. But for any Australian organisation with serious records, privacy, or information governance obligations, Castlepoint is the most credible local option by a considerable margin.

Score: 21/25 — ⭐⭐⭐⭐⭐ Excellent

Last reviewed: 26 June 2026 by Adam.

Note on scope: Castlepoint is an information governance and records management platform for enterprises, government agencies, and regulated industries. This review does not constitute legal, compliance, or records management advice. Organisations with specific regulatory obligations should assess Castlepoint's suitability with qualified information governance professionals.

What Castlepoint is

Castlepoint Systems is an Australian AI company headquartered in Bruce, ACT (Canberra), founded in 2012 by Rachael Greaves — an auditor and certified information professional by background. The company's registered entity is STLP Consulting Pty Ltd (ACN 128 389 408).

The platform does one thing at very large scale: it automatically discovers, classifies, and governs information across an entire organisation's digital environment — without moving data, without requiring users to change their behaviour, and without deploying agents on individual systems.

Castlepoint's core innovation is what it calls "manage in place" — the software reads content where it lives across every system (SharePoint, Exchange, network drives, cloud repositories, and more), applies regulatory, retention, privacy, and security rules using its explainable AI (XAI), and acts accordingly. The AI is called "explainable" because it shows the reasoning behind each classification decision — which is important when you are automatically determining that a record should be preserved or destroyed.

The platform covers six functional areas: records lifecycle management, cyber security (detecting sensitive and high-risk content), privacy management (identifying PII, PCI, PHI, and sensitive categories), discovery and eDiscovery, audit and assurance, and generative AI governance.

Castlepoint currently manages more than 286.5 million records for its clients — equating to more than ten records per Australian citizen.

What it costs in Australia

Castlepoint uses a flat-cost, per-network licence model. The price is based on your network — not the number of users, systems, records, or data volume. This is an unusual and genuinely buyer-friendly structure: it removes the penalty for growing data volumes, and it removes the incentive to leave content unmanaged to avoid cost.

What is included in the licence: production network access, monthly system checks, patching and upgrades, expert support from Castlepoint's data governance professionals, and implementation in the client's choice of on-premises network, BYO cloud, or Castlepoint's own accredited government Azure cloud. Staging environments are included at no extra charge.

Castlepoint does not publish its price publicly. This is an enterprise contract — expect to engage their sales team for a customised quote. (specific AUD licence figures are not published; pricing must be obtained directly from Castlepoint. Per-network model confirmed from primary source at castlepoint.systems/pricing.)

GST applies. Contracts are presumably commercial-enterprise in nature; terms should be reviewed carefully.

How it works in practice

Castlepoint is deployed across a client's network — which can mean on-premises, private cloud, or within Castlepoint's own accredited Azure environment. The implementation is described as fast: Castlepoint says deployment can be completed in hours, not months.

Once deployed, the platform:

1. Discovers all digital assets across every connected system, building a full inventory without moving or altering content.
2. Classifies each record using XAI that reads the content itself — not just metadata or folder names — to determine what the record is and what rules apply.
3. Governs the record according to the organisation's regulatory obligations: retaining records that must be kept, scheduling disposal of records that can be lawfully destroyed, and flagging sensitive content for further review.
4. Monitors ongoing activity — logging events, detecting anomalies, tracking who accessed what, and alerting on risk.
5. Reports for audit and compliance purposes, with full explainability for each AI decision.

For organisations with Microsoft 365, Castlepoint integrates with Copilot — it can log Copilot interactions and apply Purview sensitivity labels automatically, which matters for GenAI governance as Australian organisations start deploying Microsoft 365 Copilot at scale.

The platform also supports eDiscovery, legal holds, and data subject access requests under the Privacy Act — capabilities that are increasingly relevant as Australian privacy law continues to tighten.

What it does well

The manage-in-place model is genuinely different. Most records management systems require data migration, user training, or ongoing manual classification effort. Castlepoint does not. It classifies what already exists, in the systems where it already lives, invisibly. This removes the biggest barrier to records management adoption: the disruption.

The government adoption rate is remarkable. Two-thirds of Australian federal government portfolios using the same information governance platform is not a marketing claim — it is a procurement signal. Australian government agencies face strict obligations under the Archives Act, PSPF, and ISM. The fact that AFMA, multiple education agencies, climate agencies, and employment departments have all chosen Castlepoint is a credible validation of the platform's capabilities and trustworthiness.

Explainable AI is the right design choice for governance. When a system automatically determines that a record should be destroyed, there needs to be an audit trail explaining why. Castlepoint's XAI provides exactly that — it shows the reasoning, not just the outcome. This is critical for regulatory defensibility and essential for organisations that cannot afford unexplained AI decisions.

Australian-built and Australian-operated. Castlepoint was built in Canberra, is led by an Australian founder-CEO, holds IRAP assessment credentials (relevant for Australian government), and is listed on the Australian Defence Sales Catalogue. The company has active Secret-level (SC) security clearances, complies with the ISM (Information Security Manual) and the Protective Security Policy Framework, and is ISO 27001:2022 certified.

Flat-cost model removes perverse incentives. Pricing based on the network rather than data volume means organisations are never penalised for gaining visibility into their own data. This matters: many compliance failures happen because organisations avoid looking too closely at data they cannot afford to manage.

Accredited government cloud hosting option. Castlepoint offers hosted implementation in its own accredited Azure cloud at no additional charge. This is relevant for Australian government agencies and regulated industries that need assurance about where their data sits.

What it doesn't do well

It is not for small or medium businesses. Castlepoint is an enterprise product. The per-network licence model, the implementation process, the client profile (federal agencies, defence contractors, regulated industries), and the absence of published pricing all indicate this is not a tool a 20-person accountancy firm picks up and deploys in an afternoon. The minimum viable buyer is a large organisation with material compliance obligations and a dedicated records or information governance team.

No self-serve trial or free tier. There is no way to evaluate Castlepoint without engaging their sales and implementation team. For some enterprise buyers, this is normal. For organisations used to modern SaaS evaluation flows, it can be a friction point.

Limited public case study transparency. While the government adoption rate is well-documented, the public case studies available are relatively sparse on measurable outcomes — cost savings, hours recovered, breach incidents avoided. The AFMA case study on the Castlepoint website is useful but relatively brief. Buyers evaluating the platform for business case purposes may need to push for more detailed reference conversations.

International presence raises questions for PROTECTED-tier data. Castlepoint has offices in the UK and US and serves international clients. For Australian agencies with information classified above OFFICIAL: Sensitive, the relevant hosting and processing options should be confirmed explicitly with Castlepoint. The ISM compliance and IRAP credentialing are positive signals, but each agency should verify classification appropriateness for their specific use case. (at PROTECTED classification level: confirm directly with Castlepoint and your agency's CISO.)

The GenAI governance module is relatively new. Castlepoint's Generative AI platform — governing Copilot usage, logging AI outputs, monitoring sensitivity — is a recent addition to the product. It addresses a real and urgent need, but as with any new capability, buyers should probe how mature the tooling is in practice.

Australian fit

Castlepoint is as Australian as it gets. Founded and built in Canberra, led by an Australian founder, ACN registered, prequalified on the Digital Marketplace and DTA Cloud and Software Marketplace, listed on the Australian Defence Sales Catalogue, ISO 27001:2022 certified, ISM and PSPF compliant. Deployment options include on-premises in Australia or in an accredited Australian government cloud.

The company's growth has been driven almost entirely by the Australian public sector and regulated industries — organisations with the strictest requirements for data handling, residency, and explainability. That is not a coincidence; it reflects a product designed for Australian regulatory requirements from the ground up.

Castlepoint also has office presence in the UK and is expanding internationally. This does not diminish its Australian credentials, but it is worth noting that the product's original home base and deepest expertise remains the Australian federal government context.

The one area where specific AUD pricing would strengthen the AU fit score is pricing transparency for smaller government and regulated-industry buyers. The flat-cost model is structurally sound, but the absence of any indicative pricing creates friction for budget-planning purposes.

Australian Fit score: 5/5

Australian Fit gate: Australian Fit ≥ 4/5. Castlepoint scores 5/5 and raw score is 21/25 — Excellent rating stands.

Alternatives

For regulated Australian organisations evaluating Castlepoint, the realistic alternative set is narrow. Most direct competitors operate at the same enterprise tier without the same depth of Australian government integration:

Josef — An Australian legal workflow automation tool. Different use case — document automation and legal workflow rather than records governance — but relevant for legal teams managing document lifecycle within law firms or in-house legal departments at smaller scale.

Harvey — An AI platform used by large law firms for legal research and document review. Targets legal teams rather than information governance functions; does not offer the records lifecycle and compliance automation that Castlepoint provides.

Ironclad — A contract lifecycle management platform with AI features, available in Australia. Relevant for organisations whose primary governance concern is contract records rather than broad information management across all systems.

For organisations specifically focused on the generative AI governance layer — monitoring and governing Copilot and other AI tool usage — Microsoft Purview is the obvious native Microsoft alternative, though it does not offer Castlepoint's manage-in-place autoclassification across non-Microsoft systems.

Bottom line

Castlepoint is a genuinely impressive piece of Australian software. It solves a problem that most large organisations have and most ignore until something goes wrong: how do you govern an ocean of unclassified records across dozens of systems without grinding operations to a halt?

The manage-in-place approach, the explainable AI, the IRAP and ISM compliance, and the extraordinary Australian government adoption rate combine to make Castlepoint the credible first choice for any Australian agency or regulated enterprise with serious information governance obligations.

It is not a small-business tool and it is not cheap. But for the organisations it is designed for, the alternative — unmanaged data risk, FOI non-compliance, PSPF breaches, or a Privacy Act enforcement action — is considerably more expensive.

Recommended for: Australian government agencies, defence contractors, regulated financial services, healthcare, and legal organisations with material records management and information governance obligations.

Not recommended for: Small businesses, organisations without dedicated information governance or records management capacity, or anyone expecting a self-serve SaaS evaluation flow.

Score

Frequently asked questions

Is Castlepoint an Australian company?

Yes. Castlepoint Systems (STLP Consulting Pty Ltd, ACN 128 389 408) is headquartered in Bruce, ACT, Canberra, Australia. It was founded in 2012 by Rachael Greaves. The company is prequalified on the Australian Government Digital Marketplace and DTA Cloud and Software Marketplace, and is listed on the Australian Defence Sales Catalogue.

Does Castlepoint store data in Australia?

Castlepoint operates using a manage-in-place model — data is classified and governed where it lives, without being moved. Deployment options include on-premises within the client's own network, BYO cloud, or Castlepoint's own accredited Australian government Azure cloud environment. Castlepoint is ISO 27001:2022 certified and complies with the Australian Government Information Security Manual (ISM) and Protective Security Policy Framework (PSPF).

How much does Castlepoint cost?

Castlepoint uses a flat-cost, per-network licence model. The price is based on the network rather than the number of users, systems, or records. Specific pricing is not published publicly — contact Castlepoint directly for a quote. Implementation, support, patching, and upgrades are all included in the licence.

Sources

• Castlepoint Systems — Pricing page: https://www.castlepoint.systems/pricing (primary — pricing model) — Wayback 19 May 2026
• Castlepoint Systems — Our Story: https://www.castlepoint.systems/about-us/our-story (primary — founding, Rachael Greaves, mission) — Wayback 3 September 2026
• Castlepoint Systems — Government adoption press release: https://www.castlepoint.systems/blog/castlepoint-government-momentum-media-release (primary — two-thirds AU government figure) — Wayback 10 June 2026
• Castlepoint Systems — AFMA case study: https://www.castlepoint.systems/success-stories/afma-case-study (primary — client case study) — Wayback 17 April 2026
• Castlepoint Systems — Clients page: https://www.castlepoint.systems/about-us/clients (primary — client types) — Wayback 3 September 2026
• Canberra Cyber Hub — Castlepoint profile: https://canberracyberhub.com.au/cyber-businesses/castlepoint-systems (secondary — company overview, ACT HQ)
• Business News Australia — Castlepoint government contracts: https://www.businessnewsaustralia.com/articles/castlepoint-systems-buoyed-by-government-take-up-of-its-ai-data-protection-technology.html (secondary — commercial context)
• Scoop/Watterson — Two-thirds government adoption: https://www.scoop.co.nz/stories/WO2308/S00024/two-thirds-of-australian-federal-government-portfolios-automate-records-management-with-castlepoint-ai.htm (secondary — adoption scale)
• PitchBook — Castlepoint company profile: https://pitchbook.com/profiles/company/467626-78 (supporting — funding/investor data)

Pricing is enterprise-negotiated; no published AUD figures available. GST treatment should be confirmed with Castlepoint directly.

The AI Directory Australia is an independent editorial publication. We don't accept payment for positive reviews. Read our Methodology and Affiliate Disclosure.