# WALLIX Bastion — Password Management

WALLIX Bastion by WALLIX S.A. holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-11-03. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: WALLIX S.A. (https://wallix.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/password-management/wallix-bastion
- Alternatives: https://whats-best.ai/software/password-management/wallix-bastion/alternatives ([markdown](https://whats-best.ai/software/password-management/wallix-bastion/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-11-03 · oldest source captured 2026-11-03

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: WALLIX S.A.
- Headquarters: Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 3 Nov 2026

## The panel's verdict

WALLIX Bastion is a privileged access management product from WALLIX, a French company registered in Paris under French law. The bench is clearest on audit and policy, where scores cluster at 7: a SIEM logs guide covers authentication, vault-activity, session-integrity, command-line and file-transfer events, alongside unalterable audit trails and video session recording. Deployment and portability follows at 6 to 7, built on on-premises appliances, high-availability replication, disaster-recovery migration and rollback. The weakest area outside pricing is security architecture, 2 to 3: the pages describe a certified vault, password encryption and a configurable cryptographic security level but name no algorithms, key model or independent audit, and the listed standards read as ones the product helps customers meet. Sovereignty is a genuine split, 5 to 7: some judges credit the French entity, the CNIL, France hosting for the identity product and the on-premises option, while others found no public data-processing agreement, no stated hosting region for the Bastion's own cloud, and non-EU analytics in the website chain. Pricing stays off the pages — a free trial and expert contact only.

**Speaks for it:**
- Audit and policy scores cluster at 7 on a documented SIEM event model, unalterable audit trails and video session recording.
- Deployment and portability scores run 6 to 7 on on-premises ISO and appliance options, cloud tenant images, high-availability replication, disaster-recovery migration and rollback.
- Single sign-on over SAML and OpenID Connect verifies credentials against your own directory, with MFA from authenticator apps to passkeys and security keys.
- Session sharing puts two users in one session with sensitive fields like passwords masked, and guest invites are logged.
- Contracting sits under French law before the courts of Paris, with the CNIL named as supervisory authority and an on-premises deployment path documented.

**Held against it:**
- Security architecture scores sit at 2 to 3, and we found no public information naming the vault's algorithms, key derivation or an independent audit.
- The listed standards are framed as requirements the solution helps customers meet rather than audits of the vendor itself.
- We found no public information on admin account recovery, emergency access, or what happens to a leaver's shared items.
- We found no public information on SCIM or directory sync for automated provisioning and deprovisioning.
- The captured pages give different figures for the vendor's legal form.

**Best for:**
- You need deep privileged-session evidence for audits — a documented SIEM log model, unalterable trails and video session recording.
- You want on-premises deployment with documented high-availability and disaster-recovery paths, or France hosting for the vendor's Identity Access offering.
- You want a French contracting entity under French law, Paris courts and CNIL supervision.
- You already run a directory and want federated SSO with MFA up to passkeys that works with it rather than replacing it.

**Avoid if:**
- Your security review requires a named encryption algorithm, a key model or a published independent audit of the vault before purchase.
- You rely on automated joiner and leaver lifecycle — the documented directory link is federation and credential verification, not SCIM-style provisioning.
- You need public per-seat prices to budget before a sales conversation — the pages offer a free trial, demos and expert contact.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 1.5/5 | 1/5 | 1/5 | 1.5/5 | 1/5 | 1/5 |
| Sharing, roles & recovery | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| SSO, directory sync & provisioning | 2.5/5 | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 |
| Audit logs, policies & reporting | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Hosting choice, offline access & export | 3/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 3.5/5 | 3/5 | 2.5/5 | 3.5/5 | 3/5 | 2.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **2/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- GDPR: yes [S3]
- Response extension: 2 [S3]
- Response time: 1 [S3]
- Supervisory authority: CNIL [S3]

**Data**
- Account deletion: yes [S2]
- Minimization: yes · yes [S8]
- Retention applications: 2 [S3]
- Retention contractual: 10 [S3]
- Retention logs: 6 [S3]
- Retention prospects: 3 [S3]

**Hosting**
- Aws: Hosting infrastructure (Salesforce) · Amazon Web Services (AWS) · yes [S3]
- Data residency: yes · yes [S8]
- Deployment options: yes · yes [S8]
- Main provider: Datacampus · yes [S3]
- Site host: Datacampus · 799 902 051 · 493 Avenue de Paris, 79000 Niort, France · SAS [S2]
- Technical host: WHODUNIT · 38 rue Dunois, 75013 Paris, France · Société à Responsabilité Limitée · 510 834 930 [S2]
- Whodunit data access: no [S2]

**Integrations**
- Analytics tools: Google Analytics · Salesforce Marketing Cloud · Upland LeadLander · Salesforce · Clari · Amalia [S3]
- Partner network: find a partner · become a partner · yes [S1]

**Legal**
- Data protection contact: privacy@wallix.com [S2]
- Editorial manager: Edwige BROSSARD, Marketing Director [S2]
- Entity address: 250bis, rue du Faubourg Saint-Honoré, 75008 Paris, France [S3]
- Jurisdiction: courts of Paris · French law [S2]
- Privacy contact: privacy@wallix.com [S3]
- Publisher entity: WALLIX · Société à Responsabilité Limitée · 50000 [S2]
- Registration: Paris Trade and Companies Register · 250 bis, rue du Faubourg Saint-Honoré, 75008 Paris, France · B 450 401 153 [S2]
- VAT number: FR 67 450 401 153 [S2]

**Product**
- Academy: yes [S2]
- Access governance: identity-permission mapping · access certification campaigns · staff change tracking [S1]
- Access governance products: WALLIX IAG [S1]
- Access manager: Access Manager provides single point of access; super admins can add, modify, delete users [S6]
- Access manager: Access Manager is a single point of PAM policy definition and enforcement controlling privileged account access through a central interface [S11]
- Access manager 2 release: WALLIX Access Manager 2.0 · 6.0 [S5]
- Acronym definitions: Multi-factor authentication · Privileged Access Management · Single sign-on · Application to Application Password Management · Privilege elevation and delegation management · Identity-as-a-Service [S1]
- Audit trail: yes · yes [S6]
- Backup restore: yes · yes [S5]
- Browser sessions: secure browser-based sessions extending PAM [S1]
- Company description: cybersecurity solutions for simple, secure and trusted access, to protect digital and industrial environments [S2]
- Compliance standards: GDPR, PCI DSS, NIST 800, ISO 27001 and other global standards [S4]
- Covered frameworks list: GDPR · ISO 27001 · PCI DSS · BASEL III · HIPAA-HITECH · DORA · NIS/NIS2 Directive · SOLVENCY II · SCHREMS II · ISA/IEC 62443 · German IT Security Act · NERC CIP [S4]
- Cryptographic security level config: yes [S12]
- Current version: 12.5.0 [S12]
- Deployment choice: yes [S1]
- Deployment cloud tenant images: yes [S12]
- Deployment ISO on premise images: yes [S12]
- Deployment physical appliances: yes [S12]
- Deployment virtual appliances: yes [S12]
- Disaster recovery plan migration: yes [S12]
- Disk encryption: yes [S12]
- Disk expansion aws: yes [S12]
- Disk space quota: yes [S12]
- Doc version: WALLIX Bastion documentation version 12.5.0 [S10]
- Download center: Download center page exists, content delivered as external document [S13]
- Drbd to db replication switch: yes [S12]
- European governance: yes [S8]
- Free trial: yes [S3]
- Ha master master replication: yes [S12]
- Ha master slaves replication: yes [S12]
- High availability database replication: yes [S12]
- Html5 interface: yes [S5]
- Iag module: Identity & Access Governance [S4]
- Idaas module: Identity as a Service [S4]
- Identity federation standards: SAML · OpenID Connect · cloud · on-premises · legacy [S8]
- Integration architecture: yes · yes [S6]
- ISO image checksum verification: yes [S12]
- It join existing session: yes [S7]
- It security: Identity and Access management for IT resources [S1]
- MFA methods: authenticator apps · one-time passwords · phishing-resistant authentication using passkeys [S8]
- MFA module: Multi-Factor Authentication [S4]
- Migration ha modes: yes [S12]
- Migration to v12: yes [S12]
- Minor upgrade ha mode: yes [S12]
- Minor upgrade standalone: yes [S12]
- Multi tenant console: yes [S5]
- Network port setup docs: yes [S12]
- On premise image checksum verification: yes [S12]
- Ot security: OT security solution protecting critical operations [S1]
- Pam: WALLIX PAM · Privileged Remote Access · WALLIX IDaaS · WALLIX Enterprise Vault · WALLIX IAG · WALLIX ONE [S2]
- Pam access scope: operating systems · network devices · applications · industrial control systems · IoT devices [S6]
- Pam module: Privileged Access Management with session management [S4]
- Pam policy dynamic: WALLIX PAM tools support dynamic definition and enforcement of PAM policies [S11]
- Passkey phishing resistant: fingerprint · facial recognition · PIN · security key [S8]
- Password manager: automated password rotation · Application-to-Application Password Management (AAPM) · password encryption [S11]
- Password vault: Password Vault keeps all passwords in one secure location, preventing end-user access to root passwords [S6]
- Password vault: Password Vault stores passwords in a secure and certified vault that prohibits physical password reset or override [S11]
- Pattern detection: Pattern and command detection events are logged [S10]
- Pedm module: Privilege Elevation and Delegation Management [S4]
- Plugin compatibility docs: yes [S12]
- Privileged access: privileged account management · remote access control [S1]
- Privileged products: WALLIX ONE · WALLIX PAM · WALLIX ONE Remote Access [S1]
- Product list: WALLIX PAM · Privileged Remote Access · WALLIX IDaaS · WALLIX Enterprise Vault · WALLIX IAG · WALLIX ONE [S1]
- Products list: WALLIX PAM · Privileged Remote Access · WALLIX IDaaS · WALLIX Enterprise Vault · WALLIX IAG · WALLIX ONE [S4]
- Rdp capabilities: RDP session events include X.509 server, Kerberos ticket, session probe, WALLIX BestSafe, ICAP file verification, dynamic virtual channel, and guest session sharing [S10]
- Rdp drag drop file transfer: yes [S5]
- Real time audit: yes [S7]
- Recognition gartner: 2026 · Niche Player · 8 [S1]
- Remote assistance use cases: Remote assistance, vendor training, contractor monitoring, IT joining existing user sessions [S7]
- Resources offered: Research & reports · Blog posts · Success stories · Datasheet · Webinars · Demos · Videos [S1]
- Role gatekeeper: filter external access and centralize session auditing from all Bastions [S5]
- SAML authentication: yes [S5]
- Session documentation: WALLIX PAM tools provide detailed documentation of privileged account sessions [S11]
- Session invite: Session sharing with a guest user (session invite) is supported and logged [S10]
- Session manager: Session Manager tracks actions of all privileged users [S6]
- Session manager: Session Manager provides real-time viewing and video session recording [S11]
- Session manager sao integration: alert key stakeholders of suspicious account activity · yes [S11]
- Session recording jump: yes [S5]
- Session sharing: Bastion Session Sharing allows two users to access the same session with recording and masked sensitive fields [S7]
- Session sharing standard feature: no · yes [S7]
- Siem configuration changes: SIEM logs include configuration change events and command line events [S10]
- Siem examples: The guide provides SSH and RDP connection flow examples [S10]
- Siem file transfer: SIEM logs cover SFTP and SCP events and ICAP server file verification [S10]
- Siem log categories: SIEM logs cover authentication, vault activity, service status change, session log import/export, and boot events [S10]
- Siem log integrity: Session log integrity checking events are logged [S10]
- Siem protocols: SIEM log filters exist for SSH proxy and SSH sessions [S10]
- Siem rdp: SIEM log filters exist for RDP proxy and RDP sessions [S10]
- Siem vnc webapp: SIEM log filters exist for VNC sessions, WEBAPP sessions and system events [S10]
- Slow post protection: yes · yes [S5]
- Sovereign identity access: Identity Access is an authentication and federation layer combining SSO, MFA and identity federation [S8]
- Ssh public keys for privileged users: yes [S12]
- SSO capability: yes [S8]
- Third party compatibility docs: yes [S12]
- Third party hardware compatibility docs: yes [S12]
- Trial: yes [S2]
- Trial availability: yes · yes [S8]
- Trial available: yes [S1]
- Upgrade rollback: yes [S12]
- Usb install linux: yes [S12]
- Usb install windows: yes [S12]
- Web rdp ssh: yes · yes [S5]
- Workforce access: SSO · MFA · centralized encrypted identity data [S1]
- Workforce products: WALLIX ONE Enterprise Vault · WALLIX ONE IDaaS [S1]
- Works with existing idp: no [S8]

**Subprocessors**
- Social media: LinkedIn · Facebook · YouTube · X (formerly Twitter) [S3]

**Support**
- Alerts advisories: yes [S4]
- Customer support: Customer Support · Professional Services · Training and certification · Alerts and Advisories [S4]
- Services: Customer Support · Professional Services · Training and certification · Alerts and Advisories [S2]
- Support offering: Customer Support · Professional Services · Training and certification · Alerts and Advisories [S1]
- Training certification: yes [S4]

## Questions

### Is WALLIX Bastion European?

Not determined: the vendor’s pages as captured do not say where WALLIX Bastion is based.

### Where does WALLIX Bastion store data?

Not stated on the vendor’s pages as of 3 Nov 2026.

### Does WALLIX Bastion have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

### What are the best alternatives to WALLIX Bastion?

As of 3 Nov 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Bitwarden (3.5/5)](https://whats-best.ai/software/password-management/bitwarden) and [Proton Pass (3.5/5)](https://whats-best.ai/software/password-management/proton-pass) highest among the other 23 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [WALLIX Bastion alternatives](https://whats-best.ai/software/password-management/wallix-bastion/alternatives).

## What this page leaves out

- We found no public information on pricing on the pages we read (wallix.com, wallix.com/legal-notice, wallix.com/privacy-policy, wallix.com/solutions/solutions-by-use-case/audit-compliance, wallix.com/blogpost/wallix-access-manager-2-0-granting-remote-access-without-compromising-security, wallix.com/blogpost/privileged-account-security-handled-with-pam-2 and 7 more). If the vendor publishes it somewhere else, send us the page.
- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://wallix.com (checked 2026-11-03)
- [S2] Legal notice — found from the homepage: https://www.wallix.com/legal-notice/ (checked 2026-11-03)
- [S3] Privacy policy — found from the homepage: https://www.wallix.com/privacy-policy/ (checked 2026-11-03)
- [S4] Security / trust page — found from the homepage: https://www.wallix.com/solutions/solutions-by-use-case/audit-compliance/ (checked 2026-11-03)
- [S5] Encryption model & independent audits — found from sitemap: https://www.wallix.com/blogpost/wallix-access-manager-2-0-granting-remote-access-without-compromising-security/ (checked 2026-11-03)
- [S6] Encryption model & independent audits — found from sitemap: https://www.wallix.com/blogpost/privileged-account-security-handled-with-pam-2/ (checked 2026-11-03)
- [S7] Sharing, roles & recovery — found from sitemap: https://www.wallix.com/blogpost/bastion-session-sharing-empowering-secure-remote-collaboration-2/ (checked 2026-11-03)
- [S8] SSO, directory sync & provisioning — found from sitemap: https://www.wallix.com/products/sovereign-sso-solutions-with-mfa-wallix/ (checked 2026-11-03)
- [S9] SSO, directory sync & provisioning — found from sitemap: https://www.wallix.com/blogpost/how-does-wallix-bastion-secure-the-active-directory/ (checked 2026-11-03)
- [S10] Audit logs, policies & reporting — found from sitemap: https://docs.wallix.com/r/en-us/bastion/12.5.0/siem-logs-guide (checked 2026-11-03)
- [S11] Audit logs, policies & reporting — found from sitemap: https://www.wallix.com/blogpost/bring-a-privileged-access-management-policy-to-life-2/ (checked 2026-11-03)
- [S12] Hosting choice, offline access & export — found from sitemap: https://docs.wallix.com/r/en-us/deployment/12.5.0/deploy-wallix-bastion (checked 2026-11-03)
- [S13] Hosting choice, offline access & export — found from sitemap: https://docs.wallix.com/v/u/en-us/download-center (checked 2026-11-03)

---

Cite as: whats-best.ai, "WALLIX Bastion — Password Management", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/password-management/wallix-bastion

Corrections: https://whats-best.ai/correct/1464?target=page