Sub-processors
Sub-processors
Every outside company that handles personal data for Bastion, what it receives and why.
Last updated
The list
These are the outside companies that receive personal data from Bastion. We use no others.
| Company | What it does for us | Data it receives | Location | Role |
|---|---|---|---|---|
| MongoDB, Inc. (MongoDB Atlas) | Hosts our database. | Everything Bastion stores: accounts, encrypted tokens, server settings, moderation records, raid reports, appeals and subscription records. | Ireland | Processor for us. Sub-processor for server owners. |
| Vercel Inc. | Runs the website and the dashboard. | Everything that passes through the website while it is being handled, such as your sign-in and the settings you save. | Vercel's global network. Pages are served from the location nearest to you. | Processor for us. Sub-processor for server owners. |
| [Bot hosting provider] | Runs the bot. | Everything that passes through the bot while it is being handled, including message content in memory. | [Bot hosting region] | Processor for us. Sub-processor for server owners. |
| Discord Inc. | Sign-in, and the platform the bot works on. | Sign-in requests, and every action the bot takes in a server. When you are signed in, your browser also loads avatars and server icons from Discord's image servers. | See vendor | Independent controller. Discord is not our processor: it runs the platform under its own terms and privacy policy. |
| Stripe | Takes payment for Bastion Pro and issues invoices and receipts. | Your display name, verified email address, Discord ID, our account ID, and the ID and name of the server you bought Pro for. Card details go straight from your browser to Stripe, through the payment form on our checkout page, and never reach us. On that page Stripe also receives your IP address and browser and device details, for fraud prevention. | See vendor | Processor for us for billing, and an independent controller for its own legal duties such as fraud checks. |
| Klaviyo, Inc. | Sends marketing email, only to people who have turned it on. | For people who opted in only: email address, Discord ID, and the fact that they started a checkout or subscribed, with the server ID. | See vendor | Processor for us. |
"See vendor" means the company chooses where it processes data. Its own privacy pages say where, and which safeguards it uses for transfers out of the UK and the EEA.
Which of these handle server members' data
For the data the bot handles inside a server on the owner's behalf, only our database host and our hosting provider act as sub-processors.
Stripe and Klaviyo receive data about dashboard users only: the person who pays, and people who turn on marketing email. They receive nothing about a server's members. Stripe's payment form loads in the buyer's browser on our checkout page and on no other page.
Discord is not a sub-processor. Members' data is on Discord already, under Discord's own terms, and the bot works through it.
top.gg is not a sub-processor either. It sends us the Discord ID of each person who votes for Bastion on top.gg, and we send top.gg nothing. The vote button on our site is a plain link.
What we do not use
- No analytics or advertising companies.
- No outside font, script or content delivery services in your browser. Fonts are served from our own address.
- The bot downloads a public list of scam links from GitHub. It sends no personal data to do so.
- For the VPN check on the web verification page, the website downloads public lists of Tor, VPN and datacentre addresses from the Tor Project and from GitHub. It sends no personal data to do so: a member's address is compared with the lists on our side and never leaves it.
- No AI service. The AI check for scam images is not set up on this installation, so no image is sent to anyone.
- No outside human check or captcha service. The web verification page loads nothing from any other company.
Changes to this list
Before a new company starts handling server members' data, we add it to this page at least 14 days in advance and change the date at the top.
If you own a server and object to a change, tell us at support@bastionbot.xyz within those 14 days. If we cannot meet your objection, you can remove Bastion from your server and we refund the unused part of any Pro subscription for it. The data processing agreement has the full rule.