Password Management
WALLIX Bastion
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by WALLIX S.A. · wallix.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
WALLIX Bastion at a glance
- Vendor
- WALLIX S.A.
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates WALLIX Bastion 2.5/5, the mean of 6 judges. WALLIX Bastion is a privileged access management product from WALLIX, a French company registered in Paris under French law. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
WALLIX Bastion is a privileged access management product from WALLIX, a French company registered in Paris under French law. The bench is clearest on audit and policy, where scores cluster at 7: a SIEM logs guide covers authentication, vault-activity, session-integrity, command-line and file-transfer events, alongside unalterable audit trails and video session recording. Deployment and portability follows at 6 to 7, built on on-premises appliances, high-availability replication, disaster-recovery migration and rollback. The weakest area outside pricing is security architecture, 2 to 3: the pages describe a certified vault, password encryption and a configurable cryptographic security level but name no algorithms, key model or independent audit, and the listed standards read as ones the product helps customers meet. Sovereignty is a genuine split, 5 to 7: some judges credit the French entity, the CNIL, France hosting for the identity product and the on-premises option, while others found no public data-processing agreement, no stated hosting region for the Bastion's own cloud, and non-EU analytics in the website chain. Pricing stays off the pages — a free trial and expert contact only.
Speaks for it
- Audit and policy scores cluster at 7 on a documented SIEM event model, unalterable audit trails and video session recording.
- Deployment and portability scores run 6 to 7 on on-premises ISO and appliance options, cloud tenant images, high-availability replication, disaster-recovery migration and rollback.
- Single sign-on over SAML and OpenID Connect verifies credentials against your own directory, with MFA from authenticator apps to passkeys and security keys.
- Session sharing puts two users in one session with sensitive fields like passwords masked, and guest invites are logged.
- Contracting sits under French law before the courts of Paris, with the CNIL named as supervisory authority and an on-premises deployment path documented.
Held against it
- Security architecture scores sit at 2 to 3, and we found no public information naming the vault's algorithms, key derivation or an independent audit.
- The listed standards are framed as requirements the solution helps customers meet rather than audits of the vendor itself.
- We found no public information on admin account recovery, emergency access, or what happens to a leaver's shared items.
- We found no public information on SCIM or directory sync for automated provisioning and deprovisioning.
- The captured pages give different figures for the vendor's legal form.
Best for
- You need deep privileged-session evidence for audits — a documented SIEM log model, unalterable trails and video session recording.
- You want on-premises deployment with documented high-availability and disaster-recovery paths, or France hosting for the vendor's Identity Access offering.
- You want a French contracting entity under French law, Paris courts and CNIL supervision.
- You already run a directory and want federated SSO with MFA up to passkeys that works with it rather than replacing it.
Avoid if
- Your security review requires a named encryption algorithm, a key model or a published independent audit of the vault before purchase.
- You rely on automated joiner and leaver lifecycle — the documented directory link is federation and credential verification, not SCIM-style provisioning.
- You need public per-seat prices to budget before a sales conversation — the pages offer a free trial, demos and expert contact.
The scores
| Criterion | Panel median |
|---|---|
| Encryption model & independent audits | 1 of 5 |
| Sharing, roles & recovery | 2 of 5 |
| SSO, directory sync & provisioning | 2 of 5 |
| Audit logs, policies & reporting | 3.5 of 5 |
| Hosting choice, offline access & export | 3.5 of 5 |
| European sovereignty | 3 of 5 |
Encryption model & independent audits
Show reasoningHide reasoning
How this is scored
What the vendor can prove about its security design: end-to-end encryption with named algorithms and key derivation, which fields are encrypted on the device and which are not, independent audits and penetration tests with published results, a bug bounty, and incident history disclosed.
0 — Vault contents are readable by the vendor by its own description: server-side encryption with keys the vendor holds, or no encryption of stored credentials.
3 — Client-side or end-to-end encryption described with the algorithms named; key derivation, audits and the scope of what is encrypted are basic or not described.
5 — A published security whitepaper or security page naming algorithms, key derivation and the client-side encryption model, and an independent audit, penetration test or certification (ISO 27001, SOC 2) named.
8 — A stated list of which fields are and are not encrypted (including URLs and metadata), recurring independent penetration tests or code audits with dates and reports or summaries published, a public bug bounty or vulnerability disclosure policy, past security incidents documented with their impact, and open-source clients or cryptography that can be reviewed.
10 — The design is verifiable end to end: full source or cryptographic design public, every field encrypted client-side including metadata, audits by named firms repeated yearly with full reports, a threat model that states what a compromise of the vendor's servers would expose, and incident post-mortems published.
The CISO
A password vault described as secure and certified, with password encryption, disk encryption and a configurable cryptographic security level, but the captured pages name no encryption algorithms, no audit firm, no test dates, no bug bounty and no incident history. The ISO 27001 and PCI DSS references describe standards the product helps customers meet, not independent audits of the vendor. On the day of a breach I would have nothing published to show the board. 4 11 12
The Identity Engineer
The captured pages describe a "secure and certified vault" with password encryption, secure disk encryption and a configurable cryptographic security level, but name no algorithms and describe no key derivation. I found no public information on how vault keys are held or on any independent audit of the cryptography; the ISO 27001 and similar references sit in compliance copy about requirements the product helps customers meet. 11 12 4
The Compliance Auditor
The captured pages describe a certified password vault with password encryption, automated rotation, secure disk encryption and a configurable cryptographic security level, but name no algorithms, no key derivation and no field-by-field encryption scope. We found no public information on independent audits, penetration tests, a bug bounty or disclosed incidents; the standards listed are ones the solution claims to help customers meet, not audits of the vendor's own design. 11 12 4
The SME Owner
The captured pages describe password encryption, a "secure and certified vault" that "prohibits physical password reset or override", secure disk encryption, and a configurable cryptographic security level, but we found no public information naming the algorithms, the key model, or any independent audit, penetration test or bug bounty. ISO 27001 appears only as a standard the solution is said to help customers meet, not as a certification of the vendor itself. 4 11 12
The DevOps Engineer
The pages describe a "secure and certified vault" with password encryption, automated rotation, a configurable cryptographic security level, disk encryption, and image checksum verification for deployments — but nowhere do the captures name the algorithms, the key model, or an independent audit with a published report. For a vault that will hold root credentials, encryption asserted in general terms without verifiable design detail is thin. 11 12 4
The Skeptic
The captured pages describe a "secure and certified vault" and "password encryption" and offer a setting to "set the cryptographic security level", but name no cipher, key derivation or certifier, and I found no public audit report, penetration test, bug bounty or incident history in the captures. The compliance language ("meets the requirements of... ISO 27001") is a marketing list of standards, not an audit of this product. 11 12 4
Sharing, roles & recovery
Show reasoningHide reasoning
How this is scored
How credentials are shared and governed across a company: shared vaults or collections, role-based permissions, view-only and time-limited access, admin account recovery, emergency access, and what happens to shared items when an employee leaves.
0 — A personal password manager by the vendor's own description: no sharing between users is offered.
3 — Shared folders or vaults between users of one account; permission levels, admin recovery and offboarding are basic or not described.
5 — Shared vaults or collections with permission levels (for example read, edit, manage), groups and admin roles, and an admin account recovery or offboarding that keeps a leaver's shared items with the company.
8 — Recovery and offboarding documented with their key model, granular permissions down to hiding the password while allowing autofill, time-limited and one-time sharing with external parties, emergency access with a waiting period, delegated administration per team or location, and approval workflows for sensitive items.
10 — Access is governed and provable: least-privilege defaults, recovery and emergency access designed so the vendor never holds a key and stated so, periodic access reviews supported in the product, and every grant, change and revocation attributable to a person.
The CISO
Session sharing with guest users and masked sensitive fields, IT joining live sessions, dynamic policy enforcement, and access certification campaigns with staff change tracking give the governance real shape, and guest invites are logged. We found no public information on permission levels for shared vault items, admin account recovery, emergency access, or the key model that applies when an employee leaves. 7 10 11 1
The Identity Engineer
Session sharing between two users with sensitive fields kept confidential, logged guest invites, privilege elevation and delegation, and central policy enforcement for privileged accounts are documented. I found no public information on admin account recovery, emergency access, or what happens to a leaver's shared access, which is what I need for offboarding two thousand staff. 7 10 11 4
The Compliance Auditor
Session sharing with sensitive fields like passwords masked, guest session invites that are logged, privilege elevation with precise delegation, and access certification campaigns with staff-change tracking are all documented. We found no public information on admin account recovery, emergency access, or the key model that governs a leaver's shared items. 7 10 11 1
The SME Owner
There is a genuine vault with centrally enforced policy, privilege elevation and delegation "with precision", and session sharing where sensitive fields like passwords stay masked even while a guest user is invited and logged — that maps well to handing credentials to a colleague or third party without exposing them. But for my forty people I most need a documented admin recovery path when someone forgets a master password and offboarding that keeps a leaver's shared items with the company, and we found no public information on either, though staff-change tracking and access certification campaigns are mentioned. 1 4 7 10 11
The DevOps Engineer
Session sharing grants two users the same session with sensitive fields like passwords masked, guest invites are supported and logged, and privileged access is governed through centrally defined and enforced PAM policies, privilege elevation and delegation, and access certification campaigns. We found no public information on admin account recovery, emergency access, or offboarding of an individual's items, so the recovery half of the picture is undated here. 7 11 1 4
The Skeptic
Session sharing is documented with two users in one session, sensitive fields like passwords masked, and guest invites logged, and privilege elevation with precise delegation is described; I found no public information on vault-level permission roles, admin account recovery, emergency access, or what happens to shared access when an employee leaves. 7 10 11
SSO, directory sync & provisioning
Show reasoningHide reasoning
How this is scored
How the vault fits into the company's identity stack: SSO with Entra ID, Okta or Google, and the key model behind an SSO unlock; SCIM or directory sync for joiners and leavers; MFA options including hardware keys; and passkey support for users and the vault itself.
0 — A consumer product by the vendor's own description, with no business administration, SSO or directory connection offered.
3 — Users invited by email or CSV with two-factor authentication; SSO, directory sync and hardware keys are basic or not described.
5 — SSO with named identity providers (Entra ID, Okta, Google), SCIM or directory sync for provisioning and deprovisioning, and MFA including FIDO2 or hardware keys.
8 — The SSO unlock documented with how the vault key is derived or released and designed so the vendor cannot derive it, group sync driving vault permissions, automated suspension on deprovisioning, conditional access or device policies, and passkeys stored and used across platforms.
10 — Identity is integrated without trust shortcuts: the SSO key model published and independently reviewed, deprovisioning that revokes vault access and shared items immediately with a log entry, passwordless vault unlock with passkeys, and support for the customer's own key-management or trusted-device approval.
The CISO
Federation over SAML and OpenID Connect, multi-factor authentication running from authenticator apps to passkeys and security keys, and verification of credentials directly against the customer's own directory are all documented. We found no public information on SCIM or directory sync for joiners and leavers, on named identity providers, or on how a vault key is derived behind the single sign-on unlock. 8 5
The Identity Engineer
Single sign-on through SAML and OpenID Connect, verification of credentials directly against the customer's own directory, and multi-factor authentication spanning authenticator apps, one-time passwords, passkeys and security keys are documented. We found no public information on SCIM or any directory sync for joiners and leavers, on named identity providers such as Entra ID, or on the key model behind an SSO unlock. 8 5
The Compliance Auditor
Single sign-on over SAML and OpenID Connect, credential verification directly against the customer's own directory rather than a stored copy, and multi-factor authentication spanning authenticator apps, one-time passwords, passkeys and security keys are documented. We found no public information on SCIM or directory sync for automated provisioning and deprovisioning of joiners and leavers. 8 5 12
The SME Owner
Single sign-on is documented as an authentication and federation layer using SAML and OpenID Connect, designed to work with the directory we already trust rather than replace it, and MFA spans authenticator apps, one-time passwords, passkeys and security keys. We found no public information on SCIM or directory sync to provision joiners and revoke leavers automatically, and no named providers such as Entra ID, Okta or Google appear in the captured pages. 5 8
The DevOps Engineer
Single sign-on is documented through SAML and OpenID Connect federation, MFA spans authenticator apps, one-time passwords, passkeys and security keys, and the solution is stated to verify credentials directly against your own directory rather than storing a copy. We found no public information on SCIM or automated provisioning and deprovisioning, so the directory link is federation rather than lifecycle management. 8 5 12
The Skeptic
Single sign-on via SAML and OpenID Connect, MFA ranging from authenticator apps to passkeys and security keys, and verification of credentials against the customer's own directory are stated; the pages name no identity provider, and I found no public information on directory sync, SCIM provisioning, or automated deprovisioning. 8 5
Audit logs, policies & reporting
Show reasoningHide reasoning
How this is scored
What an administrator and an auditor can see and enforce: event logs of access and changes, password health and breach reports, enforceable policies (master password, MFA, sharing, export), SIEM integration, and reports an ISO 27001 or NIS2 audit can use.
0 — No administration by the vendor's own description: a personal tool with no admin console, logs or policies.
3 — An admin console with an activity list and a password health or strength report; exportable logs and enforceable policies are basic or not described.
5 — Event logs covering logins, item access, sharing and admin changes, enforceable policies for master password and MFA, and password health and breach-monitoring reports.
8 — Logs exportable or available through an API with native SIEM integration to named targets (Splunk, Microsoft Sentinel, Elastic or syslog), policies for sharing, export and browser-extension behaviour, log retention stated, and compliance reports aligned to ISO 27001, NIS2 or BSI IT-Grundschutz.
10 — Auditability is complete: every view, copy, autofill and permission change logged with user and device, logs tamper-evident and retained for a configurable period, alerting on anomalous access, and an auditor role that can read logs without access to secrets.
The CISO
Unalterable audit trails, video session recording, real-time audit, session log integrity checks, and a SIEM logs guide covering authentication, vault activity, command line and file transfer events are what an auditor can actually work with, and access certification campaigns support ISO 27001 and NIS2 style reviews. We found no public information on named SIEM destinations, a stated retention period for product logs, or an auditor role that reads logs without touching secrets. 6 10 11 1
The Identity Engineer
The SIEM logs guide documents authentication events, vault activities, session integrity checks, configuration changes and command-line events, complemented by unalterable audit trails for compliance reporting, real-time audit, video session recording and access certification campaigns, with NIS2, DORA and ISO 27001 named. The retention figures I found apply to the vendor's website data rather than the product, and no named SIEM targets such as Splunk or Sentinel are given. 10 6 7 1 4
The Compliance Auditor
This is the strongest area: unalterable audit trails for compliance reporting, real-time audit with video session recording, and a SIEM logs guide covering authentication, vault activity, configuration changes, command-line events, file transfers and session-log integrity checks, with ISO 27001 and NIS2 among the frameworks the solution addresses and PAM policy defined and enforced from a central point. The pages do not name SIEM targets, state product log retention, or show password health and breach reporting. 6 10 11 4
The SME Owner
This is where a bastion earns its keep: unalterable audit trails for compliance reporting, video session recording, and a dedicated SIEM logs guide covering authentication, vault activity, session, file-transfer, configuration-change and log-integrity events, plus access certification campaigns and staff-change tracking. We found no public information on named SIEM destinations, a stated log retention period, or password-health and breach reports, though ISO 27001 and the NIS/NIS2 Directive are listed among the frameworks the solution supports. 1 4 6 10 11
The DevOps Engineer
The SIEM logs guide documents an unusually deep event model — authentication, vault activity, configuration changes, command line events, session log integrity checks, SFTP and SCP transfers, pattern and command detection across SSH, RDP, VNC and web application sessions — and the vendor describes unalterable audit trails with real-time viewing and video session recording, positioned against GDPR, ISO 27001 and NIS/NIS2. Named SIEM destinations and a stated retention period for product logs do not appear in the captured pages. 10 6 11 4 7
The Skeptic
The SIEM log guide documents authentication, vault-activity, configuration-change, command-line and session-integrity events, backed by claims of unalterable audit trails, real-time audit and video session recording. I found no public information on log retention, named SIEM targets, or auditor-ready compliance reports beyond a list of standards. 10 6 11 4
Hosting choice, offline access & export
Show reasoningHide reasoning
How this is scored
Where and how the vault runs and how the data leaves it: cloud region choice, a self-hosted or on-premises option, offline access during a vendor outage, client coverage across operating systems and browsers, and a complete, documented export and import path.
0 — Vault data cannot leave the product: the vendor states that no export is offered.
3 — Apps for common platforms and browsers and an export of vault items (for example CSV); hosting region, offline access and export completeness are basic or not described.
5 — Clients for Windows, macOS, iOS, Android and the major browsers, offline access to the vault, an EU region or self-hosted option, and export and import of vault data including from named competitors.
8 — Both EU cloud and self-hosted or on-premises deployment documented, Linux clients, a status page with incident history, an encrypted full-fidelity export covering all item types including attachments, and vault access continuing during an outage of the vendor's service.
10 — The customer can run and leave the vault on their own terms: self-hosting with documented high availability and backup, an open or documented export format that preserves structure, permissions and history, and a stated procedure for continued access if the vendor ends the service.
The CISO
On-premises is a first-class path with physical, virtual and ISO appliances, cloud tenant images, master/master and master/slaves replication, disaster recovery migration, rollback, and per-organization backup and restore, alongside a France-hosted option. We found no public information on a documented export format for vault data, a status page with incident history, or vault access during a vendor outage. 12 8 5
The Identity Engineer
Both a France-hosted cloud and on-premises deployment are documented, with a deep deployment guide covering physical and virtual appliances, ISO and cloud tenant images, master/master and master/slave high availability, disaster recovery migration, rollback and image checksum verification, plus database backup and restore. We found no public information on exporting vault data out of the product, a status page, or end-user client apps for desktop and mobile. 12 8 5
The Compliance Auditor
France-hosted or on-premises deployment for the identity layer is documented, alongside physical and virtual appliances, ISO and cloud tenant images, master/master and master/slaves high-availability replication, disaster-recovery migration, rollback and verified image checksums, with backup and restore of a full database or a single organization. We found no public information on an open export format for vault data, a status page with incident history, or dedicated end-user client applications beyond browser sessions. 8 12 5 1
The SME Owner
Hosting in France or full on-premises deployment is documented, along with ISO images, virtual and physical appliances, cloud tenant images, high-availability master/master and master/slaves replication, disaster-recovery migration and rollback — serious deployment choice for a company our size to grow into. We found no public information on desktop or mobile client apps, offline access during a vendor outage, a status page, or a documented export of vault data; only session-log import/export and full-database or per-organization backup and restore are described. 5 8 10 12
The DevOps Engineer
This is the part I rate: the deployment guide covers ISO and on-premise images, cloud tenant images, physical and virtual appliances, master/master and master/slaves high-availability database replication, disaster recovery migration, upgrade rollback, and backup and restore of a full database or a single organization, with ISO image checksum verification — and an EU-hosted option is documented for the vendor's Identity Access offering. What we found no public information on is a documented export format or open specification for getting vault data out in full; a database backup is not a portable export. 12 8 5 13
The Skeptic
Deployment documentation covers on-premises and virtual appliances, cloud images, master/master and master/slave replication, disaster-recovery migration, rollback, and full-database or per-organization backup, with France hosting and on-premises stated for the Identity Access product. I found no public information on a status page with incident history, an encrypted full-fidelity export, or continuity during an outage of the vendor's service. 12 8 5
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where vault data and metadata are hosted, and who the subprocessors are. Independently sourced by the sovereignty pipeline; end-to-end encryption narrows what a foreign authority could compel, but metadata, logs and the update channel for the client software remain in the vendor's hands, so the chain still counts.
0 — Proven non-EU on every dimension the evidence covers: non-EU vendor and contracting entity and non-EU hosting, with no EU or self-hosted option stated.
3 — One European element proven: an EU data region, an EU contracting entity or EU representative, a self-hosted option, or a published DPA, with the rest of the chain unstated.
5 — EU hosting as standard or selectable, or a self-hosted option, and an EU contracting entity or EU representative, with a DPA offered; the parent company or parts of the chain (support, analytics, email, client distribution) are unstated or non-EU.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessor list published with locations, a DPA covering vault metadata and logs, and a self-hosted option that removes the vendor from the data path.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, certifications published (ISO 27001, BSI C5 or equivalent), and source code or builds verifiable so the client update channel is not a blind trust in the vendor.
The CISO
WALLIX is a French company registered in Paris under French law, hosting is contracted to Datacampus in Niort and AWS in the EU, Identity Access is hosted in France with an on-premises option, and the privacy policy names subprocessors. We found no public information on a published data processing agreement covering vault metadata and logs, or on certifications for the hosting chain. 2 3 8
The Identity Engineer
The contracting entity is a French company registered in Paris under French law, the SSO product is hosted in France with an on-premises option that removes the vendor from the data path, and the privacy policy names French subprocessors with a GDPR undertaking, a DPO contact and the CNIL as supervisory authority. The chain is incomplete: we found no public information on the hosting region of the Bastion's own cloud offering, a data processing agreement for vault data is not shown, and website analytics include non-European providers. 2 3 8
The Compliance Auditor
The contracting entity is fully named and French — WALLIX, a limited liability company registered in Paris, governed by French law under the courts of Paris — with website hosting on named EU infrastructure (Datacampus in Niort, WHODUNIT in Paris, AWS EU for the CRM layer) and the identity layer hosted in France or deployed on-premises under European governance. We found no public information on a data processing agreement or on subprocessors for the vault product itself, as distinct from the website chain, so the sovereignty dimensions the evidence proves do not reach the top anchors. 2 3 8 12
The SME Owner
WALLIX is a French company registered in Paris under French law with the CNIL named as supervisory authority, Identity Access is hosted in France under what the vendor calls European governance, and the Bastion can run entirely on-premises in our own environment. The privacy policy names subprocessors with French addresses for the website hosts and an EU region for AWS, but we found no public information on a data-processing agreement or on certifications published for the vendor itself. 2 3 8 12
The DevOps Engineer
WALLIX is a French company under French law with Paris courts and CNIL named as supervisory authority, the site runs on named French hosts (Datacampus in Niort, WHODUNIT in Paris), hosting in France is stated for Identity Access with European governance claimed, and on-premises deployment takes the vendor out of the data path. The published subprocessor list also names non-EU analytics and marketing services for the website, and we found no public information on a data processing agreement covering vault metadata and logs. 2 3 8 12
The Skeptic
A Paris-registered French company contracting under French law before the Paris courts, with an on-premises option and France hosting claimed for its identity product, is a solid European core — though the captured pages give different figures for the company's legal form. I found no public information on a data-processing agreement or on where the bastion's vault data sits, and the website chain runs through AWS and Google Analytics alongside French hosts. 2 3 8
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, which features (SSO, SCIM, SIEM, self-hosting) sit in which tier, minimum seats, add-ons, and the minimum term.
0 — No public prices at all; every tier is a sales conversation.
3 — A public "from" price or one priced tier, per user or flat.
5 — Per-user prices public for the business tiers with the billing period stated and the main features per tier listed.
8 — Every tier priced publicly with its feature set and seat minimum, add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: annual invoice derivable for a given number of users, with every add-on, self-hosting licence, support level and renewal condition published.
The CISO not rated — no public information
We found no public information on prices, tiers, per-user costs, seat minimums, add-ons or contract terms; the captured pages mention a free trial, demos and a contact-an-expert form but no figures. I read the homepage, legal notice, privacy policy and product pages and none bore a price. 1 2 3 8
The Identity Engineer
We found no public prices on any captured page — no tiers, per-user rates or seat minimums — only a free trial and "WATCH THE DEMO / SPEAK TO AN EXPERT" contact paths. The real annual cost therefore sits behind a sales conversation rather than on public pages. 1 3 8
The Compliance Auditor
The captured pages offer a free trial, product demonstrations, commercial follow-up and contact with an expert, and we found no public information on prices, tiers, seat minimums or contract terms on any page read. A buyer cannot compute any annual cost from what was captured. 1 3 8
The SME Owner
No public prices at all: the only commercial information in the captured pages is a free trial and "watch the demo / speak to an expert", so I cannot begin to compute what this would cost my forty users per year, let alone where single sign-on sits in the lineup. 1 2 3 8
The DevOps Engineer
We found no public prices in the captured pages — only a free trial, product demos and "speak to an expert", with purchases apparently running through a partner network. A buyer cannot compute an annual cost from these pages alone. 3 8 1
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about WALLIX Bastion
Is WALLIX Bastion European?
Not determined: the vendor’s pages as captured do not say where WALLIX Bastion is based.
Where does WALLIX Bastion store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does WALLIX Bastion have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to WALLIX Bastion?
As of 3 Nov 2026, the panel rates Password Depot (3.5/5), Bitwarden (3.5/5) and Proton Pass (3.5/5) highest among the other 23 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Password Depot (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: WALLIX Bastion alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (wallix.com, wallix.com/legal-notice, wallix.com/privacy-policy, wallix.com/solutions/solutions-by-use-case/audit-compliance, wallix.com/blogpost/wallix-access-manager-2-0-granting-remote-access-without-compromising-security, wallix.com/blogpost/privileged-account-security-handled-with-pam-2 and 7 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page wallix.com Checked 3 Nov 2026 Details →
- 2 Legal notice — found from the homepage www.wallix.com Checked 3 Nov 2026 Details →
- 3 Privacy policy — found from the homepage www.wallix.com Checked 3 Nov 2026 Details →
- 4 Security / trust page — found from the homepage www.wallix.com Checked 3 Nov 2026 Details →
- 5 Encryption model & independent audits — found from sitemap www.wallix.com Checked 3 Nov 2026 Details →
- 6 Encryption model & independent audits — found from sitemap www.wallix.com Checked 3 Nov 2026 Details →
- 7 Sharing, roles & recovery — found from sitemap www.wallix.com Checked 3 Nov 2026 Details →
- 8 SSO, directory sync & provisioning — found from sitemap www.wallix.com Checked 3 Nov 2026 Details →
- 9 SSO, directory sync & provisioning — found from sitemap www.wallix.com Checked 3 Nov 2026 Details →
- 10 Audit logs, policies & reporting — found from sitemap docs.wallix.com Checked 3 Nov 2026 Details →
- 11 Audit logs, policies & reporting — found from sitemap www.wallix.com Checked 3 Nov 2026 Details →
- 12 Hosting choice, offline access & export — found from sitemap docs.wallix.com Checked 3 Nov 2026 Details →
- 13 Hosting choice, offline access & export — found from sitemap docs.wallix.com Checked 3 Nov 2026 Details →