Security lead
Did anything sensitive reach an AI tool?
Before: a screenshot, a guess, or a policy document. Now: a count of what was masked, what was refused, and the occasions that need a look, from the device's own records.
Sample report
Last month your people used AI on company data. Can you show what happened?
Finance asks what it cost. The board asks if it is under control. A customer's questionnaire asks what you can prove. Without a record, the honest answer is a guess. This is what a Bolt report looks like when the record exists. The figures on this page are examples.
What you could not see before
Three readers, three questions, one record.
AI tools now read and move company data all day. Cyberhaven's telemetry found 39.7% of data movements into AI tools involve sensitive data,1 and IBM puts the average data breach at $4.99 million.2 A report helps only if someone can check it.
Finance
What are we actually dealing with?
Before: a vendor's dashboard you cannot audit. Now: what was counted, with the limits stated. The finance view does not invent a price.
Board
Is it getting better or worse?
Before: an anecdote. Now: this period against the last, with the gaps in the record named instead of smoothed over.
The sample
Client findings, as Bolt produces it.
Layout, headings and wording are produced by the Bolt release 0.1.177 report code. The figures and the organisation name are invented, and the SAMPLE banner is ours.
How to read it
Five parts. Read the fourth first.
Part 1
Headline sentence
What it says. One plain sentence with the result. Here it counts the occasions an unmanaged AI application was brought to the front while sensitive content was still on the clipboard.
How to read it. It has three possible forms: a count, no occasion found, or “did not measure”. The last one is never shown as zero.
Part 2
What was examined
What it says. Three measures: times sensitive details were masked before being sent, requests refused by policy, and occasions of simultaneous exposure.
How to read it. Each is a count of recorded events, not an estimate. A masked item is sensitive detail withheld before sending. A refusal is a request policy stopped. An exposure is the one to investigate.
Part 3
How to check this
What it says. A statement that the figures come from a tamper-evident record on the assessed machines, which can be exported and verified without the assessor and without the software running.
How to read it. Scoped below. It covers whether the exported record is intact, not whether every event was captured.
Part 4
Coverage limitation, read before the figures
What it says. For each category of evidence, how many days of the period it was being recorded. In the sample, one category was recorded for 24 of 30 days.
How to read it. Read this first. A zero in a partly recorded category would mean the category was switched off, not that nothing occurred. The report withholds trend direction for such a row instead of guessing.
Part 5
Footer and report id
What it says. Where this copy was made and where it went, a report id, and the date range. The sample was made without sending anything anywhere, and says so.
How to read it. The id and range let two people confirm they are holding the same report. Where a copy is kept depends on how and where the report was produced.
The verification statement
What “verify it independently” covers, exactly.
Bolt records events in a hash chain, seals them into signed batches, and ships a separate verifier program. Here is what a check proves and what it does not.
What a passing check confirms
The events in an exported bundle are re-hashed from their recorded fields and re-derive every sealed root, so they are the events that were sealed, unaltered. Each root's signature verifies against a public key you obtained separately. It runs with no database, no key service and no network, and it does not contact Sparcle.
What it does not confirm
That no event is missing. That the key's custody is sound; you decide that when you pin the key. Events not yet sealed: sealing runs in batches, so the most recent events in a period may not be covered. The Auditor evidence report states the sealed share for its period.
Tamper-evident, not tamper-proof
Changing a recorded event breaks the check. Deleting the record is a storage question, so keep the archive somewhere you control.
Where the verifier is
It is a separate program. It is inside the macOS app on Apple Silicon, in the server image, and a standalone download on Windows. The Intel macOS app does not carry it, and standalone macOS and Linux builds are not on every release. Check the
verification page before planning an audit around it.
Who each report is for
Eight report types in Bolt, one source of figures.
Reports are an admin screen in Bolt. A view changes order, framing and appendices, never a number.
For: Security and IT
AI Exposure Assessment
The base report. The other views reorder and reframe its figures; none of them changes a number.
For: The board and the executive
Board summary
This period against the one before it, where the near misses went, and exceptions that need a decision. A missing prior period is shown as missing, never as flat.
For: An auditor or assessor
Auditor evidence
Scope and population, completeness and integrity, a step-by-step re-performance procedure, results, and limitations and exclusions.
For: The CISO
Security and Risk
What the boundary refused or changed, and the decisions that supports.
For: Finance
Cost and exposure
What was counted. It deliberately does not put a price on it, because the record does not hold prices.
For: IT
Coverage and operation
Events recorded against events sealed into the tamper-evident chain, and a plain statement that a machine with no Bolt installed does not appear.
For: A partner to hand on
Client findings
The report on this page: plain language, no product vocabulary, for a consultant or advisor to give to their own client.
For: A regulator or a buyer
Questionnaire response
Shipped, but not a finished answer yet. Until a deployment supplies its own obligation wording it produces a document that says it has no obligation rows. Use Auditor evidence for the figures.
Honest limits
What this page and these reports do not claim.
- The sample is illustrative. Its figures are invented. The layout and wording are real.
- A report is evidence, not an audit opinion and not a certification. Your counsel and your auditor decide what it amounts to.
- Every total is a floor. A machine without Bolt does not appear at all, so compare against your own device inventory.
- Counts include every recorded event. Sealing lags, and the Client findings sheet does not print the sealed share.
- Verification confirms the record is intact. It does not prove nothing is missing.
- In release 0.1.177 the deployment's report archive keeps copies of four report types: AI Exposure Assessment, Board summary, Auditor evidence and Questionnaire response. For the others, save the file.
- Questionnaire response is not a finished answer yet, as noted in the table.
- Reports need an admin. The scheduled PDF command covers Security and Risk and Board summary only.
Sources
Where these claims come from.
- Cyberhaven, 2026 AI Adoption & Risk Report, 5 February 2026. Vendor telemetry, not an independent survey.
- IBM, Cost of a Data Breach Report 2026, July 2026.
- Bolt release 0.1.177, Admin, Reports: the eight report types and the Client findings layout. The sample was produced from that release's report code with invented figures.
- Sparcle, Verify our claims, for the verifier, its checks and where it ships.
Know what your AI tools did.
Start free on your own machine and see the Reports screen on your own records. Or tell us what your auditor, board or customers ask for.