Bastivo Security & Trust Page

Last Updated: September 20, 2026

1. Security & Trust at Bastivo

Bastivo is an independent AI-assisted corporate risk and insurance discovery, comparison, assessment, and Provider marketplace operated by DICEUS Inc. ("Bastivo," "we," "us"). This page explains, at a general level, how Bastivo approaches security, privacy, data protection, AI governance, and operational trust across the Platform, so that Buyers, Providers, and other visitors can understand our approach.

This page is a general trust and transparency resource. It is not a security questionnaire response, a penetration-test report, a security architecture specification, a compliance certification, a service-level agreement, or a warranty, and it does not create contractual commitments beyond those in our Terms of Service, Provider Terms, Data Processing Addendum, or another applicable agreement.

Bastivo is not itself an insurer, insurance broker, captive manager, law firm, tax adviser, financial adviser, or actuarial firm; nothing on this page should be read to suggest otherwise.

2. Infrastructure and Data Protection

Bastivo's production application and core data-storage infrastructure use Microsoft Azure. Confirmed Azure components, including the production database and file storage, operate in Azure's East US 2 region; the production database runs on Azure Database for PostgreSQL Flexible Server, and uploaded files are stored using Azure Blob Storage. Certain backend services, including authentication, are provided by Supabase; the specific hosting region for Supabase's authentication service has not yet been publicly confirmed. We do not represent that every component of Bastivo's infrastructure operates in a single region beyond what is stated here.

We apply access controls and security measures appropriate to the sensitivity of the information stored on the Platform, including additional protections for confidential and regulated categories of information. Communications between users and the Platform are designed to use encrypted connections.

3. Access and Application Security

Bastivo uses application-level role separation among Buyer Users, Provider Users, and Bastivo Administrators to control what an authenticated user may access. Authentication is provided through Supabase Auth, which serves as Bastivo's authentication and session layer, together with an optional external sign-in option (LinkedIn OAuth). An external sign-in option of this kind establishes a user's identity only; it does not itself determine what that user may access within the Platform. What an authenticated user may see or do is controlled separately by Bastivo's own role and permission model and by database-level access-control rules, rather than by an identity provider.

Bastivo Administrators cannot view or reset another user's password, and cannot impersonate a user account.

4. File and Content Security

Files uploaded to the Platform — such as supporting evidence, Provider materials, or other attachments — are scanned for malware using Microsoft Defender for Storage before they become usable or published. As with any malware-scanning technology, this control reduces risk but cannot guarantee that every threat is detected.

5. Logging, Monitoring, and Incident Response

Bastivo maintains logging and audit records to support security, operational, and trust workflows. Administrative actions, edits, and moderation decisions are recorded in an audit trail that identifies who took the action and when.

Bastivo maintains a process to investigate and respond to security incidents. Where Bastivo acts as a processor or service provider under our Data Processing Addendum, we notify the affected Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data, taking into account the information reasonably available to us at the time and applicable law. Routine scanning activity, blocked intrusion attempts, and similar unsuccessful attempts that do not result in a confirmed breach of security are not treated as Security Incidents for this purpose.

6. Privacy and Data Minimization

Bastivo collects information appropriate to the specific workflow it supports and applies data-minimization practices, including when creating an Unclaimed Provider Profile from legitimate publicly available business information. We distinguish public Provider information from private or internal information, and we distinguish a review's pseudonymized public display from the more limited identity or relationship information we retain internally to support moderation, fraud prevention, and dispute resolution.

Bastivo does not intentionally request or require special-category or sensitive personal information (such as health, biometric, precise-geolocation, or criminal-history information) as part of the Services. If a user incidentally includes information of this kind in free text they submit — for example, to the AI Assessment — that does not mean Bastivo has designed the Platform to collect it, and we apply the data-minimization practices described in our Privacy Policy.

Further detail on the information we collect, how we use it, and your privacy choices is available in our Privacy Policy.

7. Provider Verification and Marketplace Trust

Bastivo may create and publish an Unclaimed Provider Profile using information from legitimate publicly available business sources before the business it describes has registered with, or consented to appear on, Bastivo. An Unclaimed Profile does not mean that the business it describes participates in, endorses, or has otherwise agreed to be represented on the Platform.

A Verified Provider Profile means Bastivo has confirmed the claimant's ownership of, or authorized relationship to, the Provider Profile and has completed Bastivo's verification review process. Verified does not mean, and should not be understood to mean, that Bastivo guarantees or endorses the Provider's quality, solvency, regulatory compliance, professional suitability, financial strength, or performance, or that Bastivo has certified the Provider in any regulatory sense.

Where a Provider Profile includes an AI-generated summary, that summary is generated from Bastivo's own structured profile data, is labeled as AI-generated, and is reviewed before its first publication; it is kept distinguishable from sourced factual information. Further detail on Provider claiming, verification, and correction is available in our Provider Listing, Verification & Correction Policy.

8. Review Integrity

Bastivo expects a review to reflect a genuine engagement or relationship with the Provider being reviewed, and every review — regardless of how it was submitted — is subject to Bastivo's moderation process before publication. Reviews are pseudonymized for public display by default; Bastivo may retain limited identity or relationship information internally to support moderation, fraud prevention, and dispute resolution, even where that information is not publicly displayed.

A Provider may not require Bastivo to remove a review merely because the review is negative, but may dispute a review it believes is factually inaccurate, or appeal certain moderation decisions, through the process described in our Review Policy. A Provider may submit exactly one public response to a published review; a response does not alter, approve, or suppress the underlying review.

9. AI Governance and Transparency

Bastivo's AI Assessment uses artificial intelligence to help interpret the free-text information you provide, phrase clarifying questions, and generate narrative explanations of your results in plain language.

Bastivo's six Assessment Fit Scores are calculated by deterministic scoring logic; artificial intelligence plays no role in calculating or adjusting a Fit Score, and it plays no role in determining a result's Evidence Confidence level. AI similarly does not determine Provider verification status, listing eligibility, review-moderation outcomes, or Provider Profile ownership, and it does not override Bastivo's ranking methodology. AI outputs are informational in nature and do not constitute legal, insurance, tax, or actuarial advice, and do not make a regulated insurance decision on your behalf.

Where a Provider Profile displays an AI-generated summary or an Assessment includes AI-generated narrative explanation, that content is labeled as AI-generated and kept distinguishable from sourced factual information or deterministically calculated results. AI-generated narrative may contain errors or incomplete interpretations and should be read together with the underlying structured result.

Bastivo's AI functionality is built on an architecture that supports more than one AI service provider. The existence of a supported technical integration with a given AI provider does not, by itself, mean that provider processes your data; only an AI provider actually enabled to process production data for a given feature acts as Bastivo's AI processor for that purpose, and any such active provider is identified on our Subprocessor List.

Your Assessment or other customer content must not be used by a third-party AI provider for that provider's own model training or model improvement, unless such use has been explicitly approved under Bastivo's privacy configuration and any required separate consent or other applicable legal basis has been satisfied. Bastivo does not publicly disclose the underlying weights, formulas, factor-point contributions, prompts, or numerical thresholds used in its Assessment methodology or ranking model. Further detail is available in our AI Assessment Methodology & Disclaimer.

10. Third-Party Services and Subprocessors

Bastivo uses third-party service providers to operate portions of the Platform, including infrastructure, authentication, email-delivery, and analytics providers. Where a third party processes Customer Personal Data on Bastivo's behalf in connection with our Data Processing Addendum, that vendor is identified as a Subprocessor on our separate Subprocessor List, which we maintain and update as our Subprocessors change.

Analytics technologies used on the Platform operate under the consent model described in our Cookie & Tracking Policy. Their approved Production configuration, and their Production deployment and runtime, remain subject to verification as part of our production launch process. Please see our Subprocessor List and Data Processing Addendum for further detail.

11. Data Retention and Lifecycle

Bastivo maintains documented retention periods based on the type and purpose of information and applicable legal, security, and operational requirements. Illustrative retention periods for specific categories of information, along with our approach to data-subject and consumer requests such as access, correction, deletion, and export, are described in our Privacy Policy.

Deletion of an individual Buyer or Provider User account does not automatically delete, archive, hide, or "unclaim" the associated Provider Organization or its public Provider Profile. Requests to correct, restrict, archive, merge, or remove a Provider Profile are reviewed manually under our Provider Listing, Verification & Correction Policy; submitting a request does not automatically result in removal.

12. Security Limitations and Shared Responsibility

No online platform can guarantee complete security, and Bastivo does not represent or warrant that the Platform is invulnerable to unauthorized access, error, or misuse. No method of transmission or storage is completely secure.

Security on the Platform also depends on users protecting their own account credentials, using the Platform in accordance with our Terms of Service, and promptly reporting any suspected security concern. This page describes Bastivo's general approach to security and trust; it does not create a service-level agreement, a warranty, or another contractual commitment beyond those set out in our Terms of Service, Provider Terms, Data Processing Addendum, or another applicable agreement, and it does not modify any of those documents.

13. Contact Us

Questions about this page, or a security concern you would like to report, may be directed to legal@bastivo.com. Privacy-related requests may be directed to privacy@bastivo.com. Our business address is 2810 N Church St, Ste 94987, Wilmington, Delaware 19802-4447, USA.