Create a BastionCord account with your email address and password. BastionCord does not use “Log in with Discord” — the platform holds no Discord credentials of its own, so your dashboard account is entirely separate from your Discord account.

Once you are in the dashboard, the order is: connect a bot, register a server, choose the verified role, then publish your verification embed.

Every BastionCord feature runs on a Discord Application that you own. In the Discord Developer Portal, create an application, add a bot user, and copy the application ID, client secret and bot token.

In Dashboard → Bots, the setup wizard walks you through pasting those values. The token and client secret are encrypted with AES-256-GCM before they touch the database and are never displayed again.

Make sure Guild Install is enabled under Installation Contexts, and add the callback URL shown by the wizard to your application’s OAuth2 redirects. Then invite the bot to your server with the permissions the wizard lists.

Register a server in Dashboard → Servers, pick the role that verified members should receive, and optionally a role to remove once they verify.

The embed editor lets you set the title, description, colour, images and button label, then publish it to a channel. Members who click it are sent through Discord’s official OAuth2 consent screen.

BastionCord requests the identify scope only. The email scope is added exclusively when you switch on email collection, and Discord always lists the scopes on its own consent screen — there is no way to request them silently.

A backup captures the structure the Discord API exposes to bots: categories, text and voice channels, roles and their hierarchy, permission overwrites and supported server settings. Messages and member data are not included.

Restoring applies that snapshot to a target server — the original one, or a fresh server you want to rebuild. Review the plan before you confirm: restoring changes channels and roles.

How many backups are retained depends on your plan, and older ones are pruned automatically once you pass the limit.

All security checks are off by default and are configured per server in Dashboard → Security. Nothing is collected until you turn it on.

When enabled, BastionCord can look up connection metadata — approximate location, network provider, and VPN, proxy, Tor or hosting flags — and combine it with account age and repeated-attempt signals into an explainable risk score. Every score lists the named signals behind it; there is no single-signal verdict.

Raw IP addresses are never shown in the dashboard, retention is capped by a period you choose, and expired records are deleted automatically by a scheduled job. Members are told, before they continue, that connection data may be processed.

Dashboard → Members lists everyone who has verified, with their risk level and verification history. You can revoke a member’s verification or add them to the server blacklist from there.

Member Recovery is an opt-in, separately consented flow: members explicitly authorise the guilds.join scope on a dedicated consent page, an administrator must approve the destination server, and members can revoke that authorisation at any time. It is never bundled into ordinary verification.

Business plans can issue API keys to read verification and member data programmatically. Keys are scoped to your account and can be revoked from the dashboard at any time.

Webhook delivery is available separately: point BastionCord at a Discord webhook URL and choose which events to receive, from successful verifications to completed backups.