Security at Bunker.
This page is written for the person doing the security review, not the person doing the buying. It states what is in place today, and it is equally clear about what is not.
Last updated 1 September 2026.
How access works
Bunker does not create a second identity system alongside yours. It runs inside the one you already control.
- You sign in on your own Microsoft Entra tenant. Your multi factor authentication and your conditional access policies apply exactly as they do everywhere else. Bunker never sees or stores a user password.
- Your tenant is added by us, explicitly. Bunker runs an allowlist of permitted tenants. No organization can discover the application and onboard itself.
- Bunker acts as the person who is signed in. When it reads your Fabric, Power BI, Azure DevOps or Microsoft 365 data, it does so under that user's own permissions. A user cannot reach anything through Bunker that they could not reach directly.
- Consent is per connection, and scoped to one resource. Each capability requests only the permissions it needs, through its own consent flow. A consent you grant for Power BI read access cannot be used to mint a token for Microsoft Graph.
- Revocation is yours. Removing the enterprise application consent in your tenant ends Bunker's access to your systems immediately, without our involvement.
Governance and audit
The governance layer is the product, not a setting. It runs server side, where a user cannot turn it off.
Writes are governed, and fail closed
Any action that changes one of your systems goes through a policy check on the server. If the policy engine cannot reach a verdict, the action does not run.
Approvals ledger
Actions that need a human decision are held and recorded, with the requester, the target and the outcome.
Audit ledger
Governed activity is recorded against the user and the organization that performed it, and administrators can export it.
Per user metering
Model usage and cost are metered per user and per organization, so an administrator can see exactly who consumed what.
Where your data lives, and what we hold
Bunker runs on Microsoft Azure in the East US 2 region.
- In transit: TLS on every external connection.
- At rest: Azure Database for PostgreSQL, encrypted at rest with Microsoft managed keys.
- Secrets: held in Azure Key Vault, not in application configuration.
- Operational logs: Azure Log Analytics.
- What is stored: conversation history and message content, files you upload to a conversation, anything you explicitly ask Bunker to remember, and usage telemetry. Results returned from your systems appear inside message content, so they are stored with it.
- What is not stored: Bunker does not copy or warehouse your source systems. It reads them live, under the signed in user's permissions, at the moment of the request.
Subprocessors
The complete list of third parties that process customer data. Microsoft services inside your own tenant are not subprocessors, because that data never leaves your control.
| Subprocessor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Application hosting, database, secret storage and operational logging | United States, East US 2 |
| Anthropic | Model inference. Prompts and the content sent with them are processed to generate a response | United States |
| Cloudflare | DNS and network edge for tuatarabunker.ai | Global edge network |
The model provider
Your prompts and the content sent with them are processed by Anthropic to generate a response. That is worth being precise about, because it is the question every security reviewer asks next.
- Your content is not used to train models. Anthropic's Commercial Terms of Service state it directly: "Anthropic may not train models on Customer Content from Services." This is a contractual restriction, not a setting we opted into on your behalf.
- You own the outputs. Under the same terms, the customer "retains all rights to its Inputs, and owns its Outputs," and Anthropic assigns to the customer any right it may have in them.
- One credential, held server side. Bunker calls Anthropic through a single gateway that holds the only provider credential. Individual products and workspaces never hold a provider key, and no key is ever present in a browser.
- Anthropic's own certifications. Bunker calls Claude through Anthropic's API. For that scope specifically, Anthropic holds SOC 2 Type 2, ISO 27001, ISO 42001, CSA STAR, HIPAA and NIST 800-171. Their compliance artifacts and subprocessor list are at trust.anthropic.com, and the reports themselves are available from them on request.
Those certifications are Anthropic's, not ours. Bunker does not inherit them, and we are not going to imply otherwise. They tell you the model provider underneath us is independently audited. They say nothing about Bunker's own controls, which are described above and are not yet independently attested.
What this does not cover. Anthropic processes the content of a request in order to answer it. If a prompt contains data your policy says may not leave your environment, that policy is the control, not this page. Governed write actions and connection scoping are enforced by Bunker. What a user chooses to type is not.
Compliance status
Stated plainly, because you will find out anyway.
Bunker does not hold a SOC 2 report today. We are working toward one, scoped to the Security trust services criteria. We are not going to give you a date we cannot stand behind, and we would rather tell you that now than at contract stage.
What we will do instead, today
Answer a security questionnaire, including the CAIQ. Walk your security team through the architecture. Put our data handling commitments in the contract rather than in a brochure.
Proof of concept data
For a time boxed evaluation we will commit in writing to deleting your data at the end, naming what is deleted, and confirming when it is done.
Reporting a vulnerability
If you believe you have found a security issue in Bunker, tell us and we will respond.
[email protected]Please include enough detail to reproduce the issue. We will confirm receipt and keep you updated until it is closed.