Security at BastionIQ
In short: your data is encrypted at rest and in transit, isolated from every other organisation, and hosted in the UK. Your organisation can require multi-factor authentication (MFA) for everyone, sessions are short, and significant activity is written to an append-only audit log. AI providers never train on your data. Full technical detail is in our security documentation.
Encryption and data protection
Your data is encrypted at rest and in transit. BastionIQ uses dedicated encryption keys per data class, with automatic annual key rotation, and no data is stored unencrypted at any point in its lifecycle.
All communication between your browser and the platform uses TLS (Transport Layer Security). There are no unencrypted endpoints.
Uploaded documents are held in an access-controlled object store and are never publicly accessible. Downloads use short-lived, authenticated links scoped to your account, and public access to storage is blocked at the infrastructure level.
Tenant isolation
Every organisation’s data is isolated by tenant. API requests are authenticated and scoped to your organisation at every layer of the application, so it isn’t possible to reach another organisation’s data through the API.
Sign-in, MFA and sessions
- MFA for every user. Authenticator-app MFA (time-based one-time passwords) is available to every user from User Settings.
- Enforce it for your organisation. Organisation Owners and Admins can require MFA for all members. Anyone without it is asked to set it up before they can continue.
- Mandatory in the partner portal. Managed service provider (MSP) staff using the partner portal must sign in with MFA. It can’t be switched off.
- Short sessions. Access tokens expire after one hour and refresh while you’re active. You’re signed out after 30 minutes of inactivity, with a warning two minutes beforehand.
- Sign out everywhere. If a device is lost or you suspect a session has been compromised, end your sessions on every device at once.
Passwords must be at least 12 characters and meet complexity requirements.
Audit log
Significant activity is recorded in an append-only audit log, including sign-in activity, document uploads, plan changes, exercise runs, member invitations and settings changes. Owners and Admins can review it from Settings → Audit Log. In the partner portal, every access into a client environment is audit-logged.
Hosting and data residency
BastionIQ runs on Amazon Web Services (AWS). Each deployment is confined to a single AWS region: your organisation’s data is stored, and platform processing takes place, only in the region you’re deployed to. Your data region is shown on the login page, so you can always see it before you sign in.
| Region | AWS region | Location | Availability |
|---|---|---|---|
| United Kingdom | eu-west-2 | London, UK | Standard |
| United States | us-east-1 | Northern Virginia, USA | On request |
| European Union | EU member states | On request | On request |
If you need your data hosted in the US or an EU member state, contact us.
AI processing is a narrow exception to single-region residency. BastionIQ-hosted AI uses AWS Bedrock cross-region inference, which keeps processing within your data region’s wider geography rather than a single named region. For UK and EU organisations, content may be processed in any EU AWS region, not only eu-west-2. Nothing is stored outside your region as a result; this applies only to the transient processing of the AI request itself.
AI processing
BastionIQ uses Claude, from Anthropic, to power AI-assisted features. Your organisation chooses how it’s connected in Organisation Settings:
- BastionIQ-hosted AI. Requests are served through BastionIQ’s own AWS Bedrock deployment, running Claude within your data region’s geography. There’s no API key to manage, and hosted AI carries a monthly usage quota per feature.
- Bring your own key. Connect your organisation’s own Anthropic API key for unlimited usage, or if you need AI processing confined to a single named region. AI requests are then processed under your organisation’s own agreement with Anthropic.
When you use an AI feature, the prompt includes the context that feature needs, for example your infrastructure inventory when generating a plan, or your exercise responses when generating a debrief. Passwords and authentication credentials are never sent to the AI.
No training on your data. Neither AWS Bedrock nor Anthropic uses API inputs or outputs to train models. BastionIQ doesn’t retain prompt content or AI outputs beyond the duration of the request, and logs only token usage counts, never prompt content.
Responsible disclosure
If you’ve found a security vulnerability, email security@bastioniq.ai. We aim to acknowledge reports within 24 hours and resolve confirmed issues within 30 days.
More detail
Full technical detail is in our security documentation. For how we handle personal data, see our Privacy Policy. For privacy questions or our current sub-processor list, contact privacy@bastioniq.ai.