Bastion governs AI at the moment of inference — it classifies every prompt by data sensitivity, keeps regulated work inside your boundary, routes the rest to the best model for the task, and proves every decision. Cost‑effective, secure, compliance‑ready, auditable — by design.
Runs entirely inside your boundary · drop‑in OpenAI‑compatible · deploys as one container
Enterprises spent a decade classifying and labeling data at rest and in motion. That investment stops the instant a model reads the data — and whoever governs that moment owns the control point for enterprise AI.
Health, finance, government, defense — the highest‑value AI workloads are blocked on evidence, not model quality. Nobody can prove what a model was allowed to see, request by request.
A retrieval‑augmented prompt can pull a labeled document from a store and carry its contents to whichever model answers. Your existing DLP and entitlements never see that hop.
Teams are forced to pick the best model or control of their data. Removing that trade‑off is the difference between AI that ships and AI that stalls in review.
A single control point between your applications and every model they use — classify, enforce, route, and prove, all inside your boundary.
Every prompt scored by data sensitivity — deterministic detectors plus named‑entity recognition running in your own boundary. Session‑aware, raise‑only.
Regulated work is hard‑blocked to your boundary — a policy pre‑filter, fail‑closed. De‑identify‑then‑escalate is a standing rule: detected PII/PHI crosses only de‑identified.
The cheapest model that clears a competency bar for the task — local‑first, cloud only when policy permits. The best answer per prompt, biased onto your own compute.
Every decision lands on a tamper‑evident, hash‑chained audit — host‑forgery‑resistant when the key is held off the machine. Customer‑held evidence, not log lines.
Identifiers are tokenized inside the boundary, only the safe residue is sent, and the answer is rehydrated locally — so a frontier model does the work while the detected identifiers stay in‑boundary. Turns “we can’t use AI on that data” into a governed yes.
Governance events flow to your existing SIEM and OTLP collector as labels and counts — never prompt text, PII, or tokens. Prove what an observer can’t measure: that sensitive work stayed in‑boundary.
Policy runs as a pre‑filter, fixing the candidate models before any scoring — so no later stage can reopen a boundary policy has closed.
Score the prompt by data sensitivity, in‑boundary. Once a session is flagged regulated, that floor only ratchets up.
Regulated is hard‑blocked to the boundary, fail‑closed. The permitted model pool is fixed here — before anything is scored.
Tokenize detected PII/PHI in‑boundary; send only the safe residue; refuse egress outright if detection degrades.
Pick the cheapest capable model from the permitted pool — local‑first. The routing decision is made in‑boundary, so it sends nothing anywhere.
Rehydrate the answer locally and write the decision to the tamper‑evident chain — labels and counts only.
# Point any OpenAI-compatible client at Bastion. # Same wire format — governance happens in between. from openai import OpenAI client = OpenAI( base_url="https://app.bastionplane.ai/v1", api_key="$BASTION_TOKEN", ) resp = client.chat.completions.create( model="auto", # Bastion picks the best permitted model messages=[{"role": "user", "content": prompt}], ) # → regulated? served in-boundary. # → the rest? best model for the task. # → every decision on a tamper-evident audit.
Not a demo — a product engineered to run in production, and to be verified on your own hardware.
Cost/quality routers optimize model selection. AI gateways centralize access. DLP tools classify content. Bastion owns the decision above them — what the data is, and whether it may cross.
| Capability | Bastion | Cost/quality routers | AI gateways | DLP tools |
|---|---|---|---|---|
| Per‑prompt data‑sensitivity classification | ✓ | ✕ | ✕ | ◐ |
| Regulated hard‑block to the boundary, fail‑closed | ✓ | ✕ | ◐ | ✕ |
| De‑identify‑then‑escalate as a routing rule | ✓ | ✕ | ✕ | ◐ |
| Cost‑aware routing on measured competency (in‑house) | ✓ | ✓ | ◐ | ✕ |
| Routing brain that never egresses the prompt | ✓ | ✕ | ✕ | ✕ |
| Tamper‑evident audit, host‑forgery‑resistant (external key) | ✓ | ✕ | ◐ | ◐ |
| Runs entirely inside your boundary | ✓ | ◐ | ◐ | ◐ |
✓ core · ◐ partial / varies by product · ✕ not their focus. Capability presence from public product categories — not a benchmark. Every Bastion row is verifiable in the delivered package. As of 2026.
Bastion is a layer on your sovereign infrastructure, not an alternative to it. Every prompt it keeps in‑boundary is a token served on your own GPUs — a control that fills the estate, not just one that protects it.
Name two engineers and four weeks. Install the package on your hardware, run the proofs against your own data, and read the audit chain that comes out — none of it requires us in the room.
Self‑contained · reproducible on your hardware · nothing leaves your boundary