End-to-end encryption
Messages and attachments are encrypted on your device before they leave it. Only you and your recipients hold the keys.
Invitation-only · Built for press under pressure
Email that protects your sources, stories and staff.
Bastion is end-to-end encrypted email for journalists, editors and newsrooms operating where reporting carries real risk. Your messages are encrypted on your device — not even we can read them.
- End-to-end encrypted
- Zero-access storage
- No IP logging
- Open-source clients
Built on open, independently audited cryptographic standards
- OpenPGP
- TLS 1.3
- Argon2id
- FIDO2 / WebAuthn
- Tor onion service
Features
Everything a newsroom needs. Nothing an adversary can use.
Bastion gives reporters a familiar inbox while removing the data that puts people at risk — message content, contact graphs and location trails.
Zero-access storage
Your mailbox is stored encrypted with a key derived from your password. We cannot hand over what we cannot read.
Metadata minimization
No IP address logging, no tracking pixels, no third-party analytics. Remote images are proxied and stripped by default.
Secure source intake
Send password-protected, encrypted messages to anyone — even sources without an account — and let them reply securely.
Expiring messages
Set messages to self-destruct after minutes, hours or days. Sensitive threads don't linger in someone else's inbox.
Hardware-key sign-in
Protect accounts with FIDO2 security keys or TOTP. Phishing-resistant authentication is enforced for newsroom admins.
Censorship-resistant access
Reach your inbox through a Tor onion address and rotating alternate routes when the main domain is blocked.
Emergency lockdown
If a device is seized, an editor or trusted contact can revoke all sessions and freeze the account in one step.
Newsroom workspaces
Shared desks, role-based access and admin controls let editors coordinate teams without sharing passwords.
How it works
Encrypted before it leaves your hands
Bastion is designed so that a compromised server, a legal demand or an intercepted connection reveals nothing useful.
You write on your device
Your private key never leaves your device unencrypted. The message is sealed with your recipient's public key before sending.
We store only ciphertext
Our servers relay and store encrypted blobs. Without your password-derived key, the data is unreadable — to us and to anyone else.
Only the recipient decrypts
Your recipient's device unlocks the message locally. Fingerprint verification confirms you're talking to the right person.
# What our servers actually see -----BEGIN PGP MESSAGE----- wV4DkSTMk9yJmHoSAQdAq3l7Zp0bE1vKx9QY2m8a5WJ+Gq0pX4c3NwZ0Lr1uYw4w MbqJm0iO8fG2tH1bS6kR3xN7Pd0FqL5cZ9e2YwT4uV1sA8rQ0JmXk6hB3nE7pD2f0s 1JCAAeGlv9mQ0zR4Kp2wT8yN6cL1bH5sV3dF7gJ0eX9qM2aU4iO8rP6tW1kZ3nYbC -----END PGP MESSAGE-----
Security model
Designed for the threats journalists actually face
Surveillance of the press rarely needs to break encryption — it follows metadata, compromised devices and pressure on providers. Bastion is built to blunt all three.
- Hardened infrastructureEncrypted-at-rest servers in privacy-respecting jurisdictions, with full-disk encryption and no third-party processors.
- Vetted membershipInvitation-only accounts keep impersonators and infiltration attempts out of the directory.
- Transparency by defaultOpen-source clients, a published threat model, a regular transparency report and a warrant canary.
- Bot and abuse protectionEvery sign-in and sign-up is shielded by a privacy-preserving challenge — no tracking cookies, no image puzzles.
What Bastion can see about your account
| Data | Accessible to us |
|---|---|
| Message body & attachments | Never |
| Contacts & address book | Never |
| Your IP address | Not logged |
| Device & browser fingerprint | Not collected |
| Calendar & notes | Never |
| Account username | Required to route mail |
Who it's for
For everyone in the reporting chain
From the reporter in the field to the editor approving publication, every link is protected.
Reporters
Investigative & field journalists
Communicate with sources and your desk without exposing who you talk to.
- Encrypted source intake links
- Tor & alternate-route access
- Emergency session revoke
Editors
Editors & newsroom leads
Coordinate sensitive stories and legal review in one protected workspace.
- Shared desk mailboxes
- Role-based access
- Admin-enforced 2FA
Freelancers
Fixers, stringers & freelancers
Get the same protection as staff, with an account that stays yours.
- Personal encrypted inbox
- Expiring messages
- Works on low-bandwidth links
Organizations
Press freedom partners
Issue invitations to the journalists you support and help them onboard safely.
- Invitation management
- Onboarding guides
- Priority security support
Invitation-only
Why we don't offer open sign-up
An open directory is an attack surface. Requiring an invitation means every account on Bastion is linked to a verified newsroom or press freedom organization — so the people you correspond with are who they claim to be.
Invitations are single-use, expire after 14 days, and are never linked to your identity in our records once redeemed.
I have an invitation code- Get an invitationFrom your newsroom administrator or a partner press freedom organization.
- Enter your codeRedeem the single-use code on the sign-up page to unlock account creation.
- Create your keysChoose a strong password — your encryption keys are generated in your browser.
- Secure your accountAdd a hardware key or authenticator app and save your recovery phrase offline.
FAQ
Questions, answered
Can Bastion read my email?
No. Messages between Bastion users are end-to-end encrypted, and your mailbox is stored encrypted with keys only you control. Messages sent to external providers are encrypted on our servers on arrival, so we keep no readable copy.
How do I get an invitation?
Invitations are issued by newsroom administrators already using Bastion and by our partner press freedom organizations. If you're a working journalist without access to either, contact our verification team through the secure intake link in the footer.
Can I email people who don't use Bastion?
Yes. You can send regular email to any address, or send a password-protected encrypted message that the recipient opens in their browser and can reply to securely.
What happens if my device is confiscated?
Sign in from another device — or ask a designated trusted contact or your newsroom admin — to trigger emergency lockdown. All active sessions are revoked immediately and the account is frozen until you restore it with your recovery phrase.
Is the service accessible if it's blocked in my country?
Bastion is reachable over a Tor onion service and a set of rotating alternate addresses distributed to members. Our clients also work over common censorship-circumvention tools.
What if I forget my password?
Because we can't access your encryption keys, we can't reset your password for you. Use the recovery phrase created at sign-up to restore access. Keep it offline and somewhere safe.
Your reporting matters. Protect the people behind it.
Redeem your invitation and set up an encrypted inbox in under five minutes.