Legal
Privacy anddata handling.
This policy describes how Bastrion processes information on behalf of security companies using the platform. It is a plain-language summary of product behaviour and contractual commitments, not a substitute for your signed agreement.
Roles
Who controls what.
Your company remains the controller of the operational records created inside your workspace. Bastrion processes those records under your instruction.
- Your workspace data
- Shift reports, incident records, site configuration, personnel records, credential documents, and client releases belong to your company. Bastrion does not sell, rent, or license them.
- Account data
- Names, work email addresses, roles, and access history are held for authentication, attribution, and audit history. Attribution cannot be removed from a submitted record without breaking the audit trail.
- Client visibility
- Client accounts see only records your supervisors have approved and released to their sites. Internal notes, corrections, and quality findings are never exposed to a client account.
- Processing purpose
- Data is processed to operate the service, maintain records, run background quality review, produce exports, and support your administrators. It is not used to train third-party models.
Retention
How long records are kept.
- Configured by you
- Retention windows for reports, incidents, credential documents, and exported datasets are set by your administrators in workspace settings.
- Audit history
- Audit entries are append-only for the life of the workspace. They record who acted, on what, and when, and cannot be edited from the interface.
- Deletion on exit
- On termination, workspace data is removed after the contractual wind-down period, following a final export if one is requested.
- Backups
- Encrypted backups are held on a rolling window and expire on their own schedule after deletion in the live system.
Requests
Access, correction, and questions.
- Individual requests
- Requests from officers or client contacts should be raised with your company as the controller. Bastrion assists your administrators in locating and exporting the relevant records.
- Correction of records
- Operational records are corrected through the supervision workflow rather than overwritten, so the original entry and the reason for change both remain visible.
- Contacting us
- Privacy questions can be raised through the contact page or by your administrators through the in-platform support desk.