One account, every device
Bastion uses passwordless email sign-in: enter your address, get a one-time code, and you’re in. The same account carries your identity across web, desktop, iOS and Android — and it’s the same unified account used across the wider family of apps, so there’s no separate signup per app.What stays on your server
Your content — message text, file contents and call media — is end-to-end encrypted and, on a self-hosted node, lives on infrastructure you chose, in the region you chose. It never leaves your box in a readable form; the server only ever holds ciphertext.What the control plane sees
Identity, push and licensing are brokered by a shared control plane so accounts work everywhere. That means it handles:- Sign-in (verifying your email and issuing your session).
- Licensing (which plan an organization is on).
- Delivery metadata needed to route pushes and calls.
What metadata is visible
End-to-end encryption protects what you say — not the fact that a conversation is happening. Being honest about that:- Your node (your own server, or your managed instance) can see the “envelope”: who is talking to whom, group membership, and timestamps. That’s inherent to delivering messages — and on a self-hosted node it’s your server.
- Message sizes are padded into fixed buckets before encryption, so an observer of encrypted traffic learns much less from length.
- Bastion has no link-preview/unfurl feature and no phone-contact sync — two common ways other apps quietly leak the URLs you share and your social graph.
- Notifications are private by default: a push tells your device a message arrived, carrying only an opaque reference — not who sent it or which chat — and the app fills in the details after it opens. Call pushes ring without revealing the caller to the notification service. An organization can opt into richer (named) notifications if it prefers.