04 // ZERO-EGRESS INFRASTRUCTURE PRICING
Predictable Per-Million Request Commits. Zero AWS NAT or Egress Tax.
Every plan includes 38-POP Anycast DDoS protection, ephemeral SPIFFE workload mTLS, and our 10x uptime SLA credit guarantee.
TIER 01 // SOC-2 TYPE II PRO
$499 / mo
+ $14 per 1M attested requests · 99.99% Uptime SLA
Shared Multi-Tenant Nitro Enclave · 11.4ms Global P99 · Automated 24h Key Rotation · Up to 12 Edge POPs · Standard Slack Support
TIER 02 // HIPAA + BYOK ENTERPRISE
$1,850 / mo
+ $11 per 1M attested requests · 99.999% Uptime SLA
Dedicated VPC Peering + Customer-Managed AWS/GCP KMS · 8.2ms Global P99 · Signed HIPAA BAA & GDPR DPA · All 38 Anycast POPs
TIER 03 // SOVEREIGN FEDRAMP HIGH
$4,800 / mo
+ $9 per 1M attested requests · Zero-Downtime SLA
Single-Tenant Bare-Metal + FIPS 140-3 Level 3 HSM · 6.8ms P99 · Post-Quantum Kyber-1024 · US-Gov / EU Residency Lock & OSCAL Stream
06 // CISO, BYOK KMS & COMPLIANCE OBJECTIONS (CMS)
Technical Security & Billing Diligence Answers
CONFIDENTIAL COMPUTE
Can Bastion Cloud engineers or AWS operators inspect our plaintext API payloads?
Never. Payloads decrypt strictly inside hardware-isolated Nitro Enclaves whose KMS policies verify signed PCR8 binary hashes. Neither Bastion SREs nor cloud hypervisors have memory or shell access.
KEY SOVEREIGNTY
How fast does BYOK KMS key revocation take if we declare a security incident?
Under 250 milliseconds globally. Disabling or rotating your key grant in AWS KMS, GCP Cloud EKM, or your HSM immediately halts enclave DEK unwrapping across all 38 Anycast POPs.
PREDICTABLE BILLING
Are there hidden AWS NAT Gateway, bandwidth egress, or TLS handshake surcharges?
Zero. Every Bastion tier bills on a transparent monthly platform base plus a flat per-million attested request rate—with 0 egress, NAT traversal, or mTLS certificate rotation fees.
PERFORMANCE SLA
What latency overhead does hardware enclave attestation + PQ-TLS add?
Pre-warmed Rust vsock pools and Anycast BGP routing deliver 8.2ms global P99 on Enterprise BYOK and 6.8ms on Sovereign Bare-Metal—typically 50–65% faster than multi-hop cloud gateways.
COMPLIANCE & AUDIT
Do you sign HIPAA Business Associate Agreements (BAAs) and GDPR DPAs?
Yes. Enterprise ($1,850/mo) and Sovereign ($4,800/mo) commits include a countersigned HIPAA BAA, zero-log GDPR DPA, EU/US-Gov region pinning, and unredacted SOC-2 Type II + NCC pen-test reports.
ONBOARDING
How does the 30-day dedicated sandbox and CISO architecture review work?
Submit your throughput and compliance profile via our Architecture Review intake. Within 24 hours under Mutual NDA, a Principal Cryptographer provisions a dedicated sandbox key and VPC reference Terraform module.
01 // BASTION CLOUD
Zero-Trust Cloud Mesh
Hardware-attested AWS Nitro Enclaves, customer-managed BYOK KMS, and sub-9ms Anycast mTLS across 38 edge POPs.
02 // INFRASTRUCTURE
Platform & Economics
Predictable per-million request commits with zero NAT Gateway or egress surcharges.
03 // CRYPTOGRAPHY BENCH
Company & Research
Engineered by kernel, eBPF, and post-quantum lattice cryptographers in SF & Zurich.
04 // GOVERNANCE & DOCS
Compliance & Manual
SOC-2 Type II, HIPAA BAA, FIPS 140-3 HSM, and 12-station buyer setup documentation.
© 2026 BASTION CLOUD INC. · SOC-2 TYPE II · ISO 27001 · FIPS 140-3 LEVEL 3 · ZERO PAYLOAD RETENTION.
ALL 38 ANYCAST EDGE POPS OPERATIONAL // 8.2MS P99