Report a security issue
Email security@bastionhelix.com with the product, what you found, how to reproduce it, and the time you saw it. Please don't include anyone's personal data, and don't test against other people's accounts or data. We aim to reply within two business days (Monday to Friday, India time). Fixes are prioritised by severity: critical and high within 14 days, medium and low within 60 days or at the next release.
The same contact is published in machine-readable form at /.well-known/security.txt. For everything else, write to support@bastionhelix.com.
How each product handles data
| Product | Where your data goes |
|---|---|
| Bastion Helix for Jira | Built on Atlassian Forge. The app runs on Atlassian's cloud, stores its data only in Forge storage inside Atlassian, and sends nothing outside Atlassian. Every request is checked against the user's Jira permissions. Details: Jira security and the Data Processing Addendum. |
| Bastion Helix Tables | Tables are found, cleaned and exported in your browser. Nothing reaches us unless you switch on online AI apps; then a table your AI app asks for passes through our relay in memory and is not stored. Privacy policy. |
| Bastion Helix Capture | Reports go from your browser straight to your Jira, GitHub or Linear, or to a file. Private details are blurred first. We have no server for Capture. Privacy policy. |
| Bastion Helix Agent Lens | Runs on Cloudflare. Keeps no request logs and never stores the pages it reads or their addresses; stores only what billing needs, with API keys kept as fingerprints. Privacy policy and acceptable use policy. |
| This website | Hosted on Cloudflare. If you join a waitlist, your email address is stored with Resend. Privacy policy. |
How we run security
Bastion Helix is a one-person company. Our Information Security Policy is public and written for our size: it describes what we actually do and commits us only to what we can keep doing. In practice:
- No servers of our own. Products run on Atlassian, Cloudflare and in your browser, so customer data stays on platforms you can assess.
- Accounts: two-factor authentication on our GitHub, Cloudflare, Atlassian and Microsoft accounts, a unique password for every account, and one person with access.
- Secrets: never in code, chat, screenshots or tickets; listed in a token register; rotated at least every 12 months and at once if exposure is suspected.
- Code: private repositories, automated tests before every release, and GitHub Dependabot alerts and security updates on every code repository.
- Logging: no personal data, customer content or secrets in logs.
- Device: one work laptop with full-disk encryption, firewall, antivirus and automatic screen lock.
- Incidents: handled under our Incident Response Plan, which includes telling affected customers within 72 hours where possible.
- Review: the policy, risks, suppliers and access are reviewed at least once a year.
Security questionnaires
We answer the Cloud Security Alliance's questionnaires and publish them in the CSA STAR Registry:
- Agent Lens: listed in the STAR Registry since 20 October 2026 as a STAR for AI Level 1 self-assessment (AI-CAIQ v1.1). See the listing.
- Bastion Helix for Jira: CAIQ v4.1 submitted to the STAR Registry on 20 October 2026 and waiting for CSA's review. Until it is listed, email security@bastionhelix.com for the answers.
What we learned answering them.
These are self-assessments, not third-party audits. We don't hold certifications such as SOC 2 or ISO 27001.
AI
We don't train, fine-tune or host AI models. When we use AI tools in our own work, no secrets, customer data or personal data go into them, and a person reviews every result before it is used. Agent Lens treats page content as untrusted data, and its acceptable use policy includes rules written for AI agents.
Documents
- Information Security Policy (version 1.1, 20 October 2026)
- Incident Response Plan
- Vulnerability reporting (SECURITY.md)
- Privacy policy and Data Processing Addendum
- Agent Lens acceptable use policy
Questions
How do I report a vulnerability in a Bastion Helix product?
Email security@bastionhelix.com with the product, what you found, steps to reproduce and the time. We aim to reply within two business days.
Does Bastion Helix store my Jira data on its own servers?
No. The Jira app runs on Atlassian Forge and stores its data only in Forge storage inside Atlassian. We have no servers of our own.
Is Bastion Helix SOC 2 or ISO 27001 certified?
No. Agent Lens is listed in the CSA STAR Registry as a STAR for AI Level 1 self-assessment, and the CAIQ for the Jira app is waiting for CSA's review. These are self-assessments, not audits.
Last updated 21 October 2026.