Security architecture
Cybersecurity designed to fail closed
Engineering invariants
These principles are non-negotiable. Every feature, integration, and Discord action is measured against them before shipping.
Browser never controls Discord
The client is untrusted. Authentication, authorization, policy, and execution are enforced server-side only.
Fail closed
If auth, policy, Discord reachability, or intended state cannot be verified, dangerous operations do not run.
Tenant isolation
Every query and API check is scoped to tenant and server identity. One community must never read or mutate another.
Verify after execute
A successful Discord API call is not done. BastionHub confirms the resulting state matches the intended outcome.
Administrator, once
The bot requests Discord Administrator at install so every advertised feature executes — redesigns, containment, announcements. Every action still passes authorize → verify → audit.
Cannot exceed Discord
Capability and UI never imply BastionHub can grant more authority than Discord permits for the acting bot or user context.
Universal Action Pipeline
Every important mutation — a timeout, a role change, a channel redesign, a compliance export — goes through the same ten-stage pipeline. No shortcuts.
Verify Discord OAuth2 session and operator identity server-side.
Confirm the acting user owns or is delegated by the server owner.
Evaluate owner-defined rules against the requested action.
Assess blast radius, affected resources, and privilege impact.
Route to AUTO, CUSTOMER, or BASTIONHUB decision lane if required.
Verify the bot has the Discord permission needed to execute.
Call the Discord API with minimum required authority.
Confirm Discord state matches the intended outcome. Not done until verified.
Write actor, action, guild, timestamp, and result to the audit trail.
Push the verified result to the Owner Dashboard and Staff Dashboard.
What continuous monitoring covers
Members through staff
Monitors for phishing, scams, raids, privilege abuse, and webhook changes where Discord's API and granted permissions allow.
Owner-defined policy
You define the rules. BastionHub enforces them. You do not have to trust the platform blindly.
Auditable actions
Important work can be traced from detection or requester → policy → approval → Discord execution → verification.
Threat types detected
Detection happens in memory. Discord message bodies, attachments, passwords, and raw webhook tokens are never persisted. Only threat metadata (type, action, timestamp, severity) is stored.
Phishing
Malicious links and credential harvesting
Raids
Coordinated mass-join attacks
Bot spam
Automated flood and channel disruption
Fraud
Scam patterns and social engineering
Impersonation
Fake accounts mimicking staff or owners
Privilege abuse
Staff exceeding their authorized scope
Webhook attacks
Compromised or rogue webhooks
Config drift
Unauthorized permission or role changes
Discord authority and limits
Discord remains live truth for Discord objects. BastionHub is source of truth for policy, approvals, audit, and entitlements — never a silent override of Discord authority.
- Official bot + OAuth2 only. No user-token, self-bot, or unofficial client.
- Administrator, once. The bot requests it at install so no feature hits a permission wall. BastionHub never grants Administrator to members.
- Privileged intents (message content, members, presence) are used only for stated security and moderation purposes. No scraping, reselling, or model training.
- Discord-native containment. AutoMod, timeouts, and incident invite pause use Discord's own safety APIs. BastionHub does not circumvent Discord Trust and Safety.
- Verify after execute. A successful Discord API call is not complete until BastionHub confirms the resulting state matches the intended outcome.
Data and infrastructure
BastionHub stores security metadata only — threat types, actions, timestamps, and audit entries. Client data is stored on AWS (US-West-2) via Supabase managed PostgreSQL with AES-256 encryption at rest and TLS 1.2+ in transit. Tenant isolation is enforced on every query.
For the full data-processing disclosure — what we collect, what we do not collect, subprocessors, retention periods, international transfers, and breach notification procedures — see the Privacy Policy and the Compliance page.