A PAM published in France, GDPR by design
Bastigo doesn't store, host, or process any customer data: the bastion runs entirely on the infrastructure you choose. No data reaches the vendor, no de facto data processing agreement needed, and a footprint compatible with hosting already certified for regulated industries if your business requires it.
Why GDPR is simpler with software that hosts nothing
Most of the heaviest GDPR obligations (shared processing records, data-processing clauses, transfers outside the EU) fall on whoever hosts and processes your data. Bastigo is never part of that chain: the software installs at your site, and the vendor has no access, no copy, and no visibility into what flows through it.
- ✓ No data (passwords, recordings, directory) ever sent to the vendor
- ✓ No GDPR data-processing agreement to negotiate with the vendor for that data
- ✓ You alone decide where your data lives, including a strict EU-only residency requirement
Certified health-data hosting is a hosting question
Certified health-data hosting (HDS in France) applies to the hosting provider. Bastigo hosts nothing, so the question of Bastigo itself being certified simply doesn't apply, any more than it would for any other piece of software you install on an already-certified server.
You choose the host
If your industry requires certified hosting, you install Bastigo on that hosting, exactly like any other software in your information system.
Nothing leaves the environment
Bastigo never sends data outside the environment it runs in: its operation doesn't call the certification of your chosen hosting into question.
No certification standing in for the host
Bastigo doesn't claim to be itself "certified" for hosting regulated data (a certification that only makes sense for a hosting provider), and doesn't replace your own hosting's certification process if one is required.
Self-hosted: what changes for your compliance
| Criteria | Bastigo (self-hosted) | SaaS PAM |
|---|---|---|
| Data location | ✓ Chosen by you, including strict EU residency | Decided by the vendor |
| Vendor as a GDPR data processor | ✓ No, no data ever reaches them | Usually yes |
| Transfers outside the EU | ✓ Depends only on your own hosting choice | Common depending on the vendor |
| Compatibility with certified hosting | ✓ Yes, depends on the hosting you choose | Depends on the SaaS vendor's own certification |
What legal and security teams ask us
Is Bastigo GDPR compliant?
Bastigo is designed to never receive your data: the software installs and runs entirely on your own infrastructure, wherever you choose to put it. No data (passwords, session recordings, user directory) ever reaches the vendor, which considerably simplifies your GDPR compliance compared to a third-party-hosted SaaS solution.
Is Bastigo a data processor under GDPR?
No, not for the data processed by the software once installed: the vendor never has access to it, never hosts it, and never processes it. You remain the sole data controller for data flowing through your own bastion, exactly as with any other software installed on your own infrastructure.
Can Bastigo be used in an environment subject to certified health-data hosting requirements?
Yes. Certified health-data hosting applies to the hosting provider: since Bastigo hosts nothing itself, the question doesn't apply to the vendor. You can install Bastigo on hosting that is already certified if your industry requires it, without that certification being called into question, since the bastion never sends any data outside that environment.
Where is data hosted with Bastigo?
Wherever you install your bastion: on your own VM or appliance, in your own datacenter, or with the cloud provider of your choice. Bastigo never decides where your data lives and never transfers it outside your environment.
Is Bastigo a French company?
Yes, Bastigo is published in France (see our legal notice, in French). The software then installs wherever you choose to run it, in France, in the EU, or elsewhere.
A specific compliance question before you decide?
Our technical team answers directly, no sales detour.