Bastion
Bastion is an AI-native security and compliance platform that helps startups and scale-ups achieve certifications like SOC 2 and ISO 27001 by combining automated evidence collection, integrated security tooling, and dedicated vCISO support in a single subscription.
- Company typePrivate
- Founded2021
- HeadquartersParis, France
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Bastion does
Bastion is a Paris-based SaaS company that sells an AI-native security and compliance platform to startups and scale-ups, primarily from pre-seed through Series D. Its core proposition combines automated evidence collection across 50+ integrations with embedded security tooling (endpoint MDM, vulnerability scanning, CSPM, phishing simulations, attack surface management, DNS filtering, browser security) and dedicated human security expertise in the form of a vCISO plus OSCP-certified penetration testers. The company supports 30+ compliance frameworks including SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS, DORA, NIS 2, ISO 42001, and the EU AI Act, and reports outcomes such as SOC 2 Type II in 4-5 months and ISO 27001 in 4 months for customers. Trust is signaled by Bastion's own SOC 2 Type II and ISO 27001 certifications and a customer base of 300+ companies including Lemlist, Ankar AI, Fincome, Twin, Pelico, Gleamer, Modjo, and Convelio.
Bastion firmographics
Firmographics- Name
- Bastion
- Legal name
- BASTION TECHNOLOGIES
- Website
- https://bastion.tech
- Company type
- Private
- Founded year
- 2021
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Bastion is an AI-native security and compliance platform that helps startups and scale-ups achieve certifications like SOC 2 and ISO 27001 by combining automated evidence collection, integrated security tooling, and dedicated vCISO support in a single subscription.
- Ownership category
- akta.pro rank
Bastion industry classification
Industry- Product category
- Cybersecurity Compliance Software
- NAICS
- Computer Systems Design and Related Services (5415)
- SIC
- Services-Computer Programming Services (7371)
- akta.pro primary industry
- Security Awareness, Training & Compliance Attestation (HDADAIAJ)
- akta.pro secondary industries
- Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC), App Security, Compliance & Review Automation Platforms (BPAMADAJ), Vulnerability Management & Penetration Testing Services (BPAEADAD), Secure Model Deployment & Runtime Protection (sandboxing, isolation) (HDAAAKAH)
Keywords
Where Bastion is headquartered
LocationHeadquarters
- HQ city
- Paris
- HQ country
- France
- HQ region
- Europe
Offices1 record
Markets served
Bastion business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure
Revenue model
- SaaS Subscription: Bastion operates on a subscription-based SaaS model where customers pay for access to the full platform including compliance automation, security tools, penetration testing, and dedicated vCISO support. Pricing is quote-based and varies by organization size and requirements.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | All-in-One Platform - Full platform access with no feature gating |
Go-to-market motion2 records
Distribution channels2 records
Marketing channels5 records
Bastion product offering
Product offeringCore offering
Bastion provides an AI-native security and compliance SaaS platform delivered as a single subscription. It automates compliance evidence collection across 30+ frameworks (SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS, DORA, NIS 2, ISO 42001, EU AI Act, and more) using AI agents and 50+ integrations, and bundles integrated security tooling (MDM, CSPM, vulnerability scanning, phishing simulation, DNS filtering, browser protection, attack surface management, code scanning) with a dedicated security engineer service offering vCISO guidance, OSCP-certified manual penetration testing, internal audit, and audit coordination.
Product overview
Bastion is an AI-native security and compliance platform delivered as a unified SaaS subscription. The core offering combines three integrated components: (1) AI Compliance module for automated evidence collection and audit management, (2) All-in-One Security module covering endpoint MDM, employee awareness, SaaS security, cloud CSPM, code security, and attack surface management, and (3) dedicated Security Engineers providing vCISO, penetration testing, and audit support services. Key features include Trust Center for customer-facing security portals, Security Questionnaires with AI-powered responses, Policy Management with 20-35 templates, Access Reviews workflows, and Web Browsing Security with DNS filtering and browser extensions. The platform supports 30+ compliance frameworks including SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS, DORA, NIS 2, and the EU AI Act.
Differentiator
Problem solved
Functional benefit
Products and services
- Bastion Platform (AI Compliance + All-in-One Security) Unified AI-native security and compliance SaaS subscription that automates compliance evidence collection and risk management (AI Compliance module) and delivers integrated security tooling (All-in-One Security module) covering endpoint MDM, employee awareness, SaaS security, CSPM, code security, and attack surface management, all from a single platform with no feature gating. Sold to startups and scale-ups that need to achieve and maintain certifications such as SOC 2 and ISO 27001 to win enterprise deals.
- Bastion Security Engineers (vCISO, Penetration Testing, Audit Support) Managed security engineering service included with the Bastion Platform subscription, providing a dedicated virtual CISO (vCISO) who guides each customer from onboarding through audit via dedicated Slack channels, plus 20+ hours of manual penetration testing by OSCP-certified professionals, internal audit execution, and external audit coordination. Designed for startups and scale-ups that lack in-house security expertise.
Quantifiable outcome
- SOC 2 Type 2 certification typically achieved in 4-5 months
- +3 more outcomes
Companies that use Bastion
Customer profileNamed customers11 records
Segments6 records
Ideal customer profiles4 records
Bastion technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration22 records
AI capability5 records
Feature7 records
Bastion partnerships and signals
Strategic signalPartnerships
Nine partnerships are on record, tiered core.
- Amazon Web Services (AWS)coreCloud infrastructure provider integrated with Bastion for automated evidence collection and cloud security posture management. AWS is a core integration for compliance monitoring.
- Microsoft (Azure)coreCloud platform integrated with Bastion for evidence collection and CSPM capabilities. Azure AD used for identity management integration.
- Google Cloud Platform (GCP)coreCloud infrastructure integrated with Bastion for automated evidence collection and cloud security posture management.
- GitHubcoreCode repository integrated for automated security scanning, secret detection, and compliance evidence collection from CI/CD pipelines.
- OktacoreIdentity provider integrated for user access evidence collection and MFA verification as part of compliance automation.
- Azure Active DirectorycoreIdentity management platform integrated for employee directory sync and access control evidence for compliance frameworks.
- Google WorkspacecoreProductivity suite integrated for employee sync, security configuration evidence, and compliance monitoring.
- GitLabcoreCode repository platform integrated for security scanning, dependency management, and compliance evidence collection.
- SlackcoreCommunication platform used for vCISO engagement and customer support, with dedicated Slack channels for each customer.
Scale indicators4 records
Recent moves6 records
Expansion highlights7 records
Bastion competitors and assessment
Company assessmentEmerging players
- Wiz: Wiz dominates cloud security posture management (CSPM) and competes with Bastion's bundled CSPM module. While not a direct GRC competitor, it is a likely substitute at renewal for the cloud security component of Bastion's all-in-one bundle.
- Anecdotely: Anecdotely is an AI-native compliance and GRC platform for security leaders, competing on the same compliance automation plus evidence collection value proposition. Particularly relevant given the AI-native positioning that both companies share.
Direct peers
- Sprinto: Sprinto is a compliance automation platform focused on SaaS companies pursuing SOC 2, ISO 27001, and related certifications, with strong automation and partner-led distribution. Highly comparable on customer profile (SaaS startups) and product surface area.
- Thoropass (formerly Laika): Thoropass combines compliance automation with integrated audit services, comparable to Bastion's bundled software-plus-expert model. Targets SaaS and tech companies needing SOC 2, ISO 27001, HIPAA and PCI compliance with a similar mix of software and human auditor support.
- Vanta: Vanta is the leading automated compliance/GRC platform targeting startups through enterprise with SOC 2, ISO 27001, HIPAA and more. It is the most direct competitor to Bastion's compliance automation core, though positioned as pure self-service SaaS versus Bastion's bundled vCISO service.
- Hyperproof: Hyperproof is a compliance operations platform automating evidence collection, control mapping, and risk management across multiple frameworks. Comparable to Bastion on multi-framework reuse and continuous monitoring, but skews more enterprise.
- Secureframe: Secureframe provides compliance automation, security training, and audit readiness for SOC 2, ISO 27001, HIPAA and PCI DSS, with a similar target buyer profile of fast-growing tech companies. Direct substitute for Bastion's AI Compliance module.
- Drata: Drata offers continuous compliance automation across SOC 2, ISO 27001, HIPAA, PCI and more, with deep integrations for evidence collection. It competes head-to-head with Bastion for the same startup and mid-market buyer; it sits closer to Bastion than Vanta on automation-first positioning.
Broad incumbents
- OneTrust: OneTrust is a broad privacy, security, and GRC platform serving enterprise and mid-market with extensive framework coverage. Overlaps with Bastion on SOC 2/ISO 27001/GDPR automation but does not specialize in startup-friendly bundled vCISO delivery.
- Tugboat Logic (OneTrust): Originally a direct peer, Tugboat Logic was acquired by OneTrust and folded into a broader privacy, GRC, and trust intelligence platform. It competes with Bastion's SOC 2/ISO 27001 automation but as part of a much larger enterprise suite.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat6 records
Key risks5 records
Key highlights6 records
Customer concentration
Bastion social profiles
Digital presenceBastion compliance and trust
Trust signalCompliance2 records
Bastion financial estimates
Financial estimateRevenue estimate
Valuation estimate
Bastion leadership team
Management profileNumber of profiles
Profiles1 record
Bastion funding detail
Funding detailFunding overview
Funding rounds2 records
Investors4 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Bastion M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Bastion
What does Bastion do?
Bastion provides an AI-native security and compliance SaaS platform delivered as a single subscription. It automates compliance evidence collection across 30+ frameworks (SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS, DORA, NIS 2, ISO 42001, EU AI Act, and more) using AI agents and 50+ integrations, and bundles integrated security tooling (MDM, CSPM, vulnerability scanning, phishing simulation, DNS filtering, browser protection, attack surface management, code scanning) with a dedicated security engineer service offering vCISO guidance, OSCP-certified manual penetration testing, internal audit, and audit coordination.
Is Bastion a public or private company?
Bastion is a private company. It is classified as venture growth investor backed and is currently operating.
When was Bastion founded?
Bastion was founded in 2021. It employs 11 to 50 people.
Where is Bastion based?
Bastion is headquartered in Paris, France, in the Europe region.
How does Bastion make money?
One revenue line is on record: saaS Subscription.
Who are Bastion's main competitors?
Emerging players on record are Wiz and Anecdotely. Direct peers are Sprinto, Thoropass (formerly Laika), Vanta, Hyperproof, Secureframe and Drata. Broad incumbents are OneTrust and Tugboat Logic (OneTrust).
Does Bastion have an API?
Yes. Bastion offers an MCP (Model Context Protocol) server integration that connects to AI coding tools including Cursor, Claude, and Codex for context-aware remediations. Configuration uses a standard mcp.json file with bastion server type http and url https://mcp.app.bastion.tech/mcp. Developer documentation is at docs.bastion.tech/mcp/overview.
What industry is Bastion in?
Bastion's product category is Cybersecurity Compliance Software. Its primary akta.pro industry code is HDADAIAJ, Security Awareness, Training & Compliance Attestation, with a secondary code of BPAKADAC, Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX). Its NAICS code is 5415 and its SIC code is 7371.