Last updated: May 30, 2026
Bastionik is infrastructure software. We collect the minimum data necessary to operate the service. We do not sell your data, serve you ads, or share your information with third parties except as required to deliver the service.
Account information: Email address, username, and password (hashed) when you register.
Encrypted credentials: API tokens and authentication credentials you store in the vault. These are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) before storage. We cannot read your stored credentials in plaintext.
Agent configuration data: Agent names, Ed25519 public keys, and access policies you define.
Usage and audit logs: Every agent action is logged with agent ID, timestamp, service accessed, action performed, IP address (approximate location), and outcome. This is a core product feature — not incidental tracking.
Billing information: Subscription plan and payment history. Payment card details are processed by Paddle and never touch our servers.
We share your information only with the following service providers, and only as necessary to deliver the service:
We do not sell your personal information. We do not share your information with advertisers. We do not use third-party tracking cookies or ad pixels.
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you in advance.
Bastionik is designed so that a compromised agent cannot exfiltrate credentials, even under attacker control:
If we become aware of a security incident affecting your data, we will notify you and relevant authorities within 72 hours as required by applicable law.
Depending on your location, you may have the right to access, correct, or delete your personal information. To exercise these rights:
EU/UK users have rights under GDPR including data portability and the right to object to processing. California users have rights under CCPA. South African users have rights under POPIA.
We will respond to all data rights requests within 30 days.
Our servers are hosted on Microsoft Azure infrastructure in the United States. If you are accessing our Services from the EU, UK, or other regions, your data is transferred to and processed in the United States. This transfer is governed by Microsoft Azure's Standard Contractual Clauses.
For privacy-related questions or data requests:
Email: hellobastionik@gmail.com
Data Protection Officer: Available at the email above
Bastionik (Pty) Ltd, trading as Bastionik · Bloemfontein, Free State, South Africa
This Privacy Policy was last reviewed on May 30, 2026. We will notify you 30 days before any material changes take effect.