One page to forward, written for the reviewer.

An update check, and the update package if the user accepts one. Bolt asks our GitHub release channel first and sparcle.app second, so both are on the list; nothing else leaves on its own. There is no telemetry endpoint and no licence call. Block both and Bolt keeps working; it stops offering updates.

Google Workspace or Microsoft 365, over user-consented and revocable OAuth. Traffic goes from the endpoint to that provider directly. It does not transit Sparcle, because there is no Sparcle service in that path.

An LLM endpoint: whichever provider or on-prem server you point Bolt at. Bolt ships no LLM and no credentials for one, so nothing reaches a model provider until you configure one. Structured PII and secrets are masked before the call leaves the machine.

A one-time download of an open on-device model from Hugging Face, for local visual search, embeddings, or speech to text. It runs on-device afterwards. Ask us for the offline preload path if your policy forbids endpoint fetches.

Sparcle. There is no telemetry endpoint, no usage analytics, and no licence server. The licence is a signed token verified offline against a key compiled into the binary.

Clipboard history, the local search index, the thumbnail cache, alerts, and the on-device vector indexes are stored in SQLCipher databases, each keyed by its own subkey derived from one device master. Connector credentials and OAuth tokens are encrypted with AES-256-GCM. Read the next row before you rely on this: where that device master lives is the part that decides what the encryption is worth.

In the local Postgres instance Bolt runs on the endpoint, the heavy content of memory records is sealed with authenticated encryption. A small queryable surface (subjects, entity names, timestamps) is stored in the clear so local search works without decrypting everything.

On a signed release build the device master is held in the OS keychain. A copy of that same master is also kept on disk in the data directory, at mode 0600, as a recovery file, and it is not deleted. On any build that is not a notarized release, the file is the primary store. So a reader who can read that directory can read the databases, and the encryption above is not what defends the lost-or-stolen laptop. We would rather say this than let you infer a stronger guarantee from the word encrypted.

Secrets, key material and the encrypted stores are written mode 0600, and their directories 0700, under the user's account; on Windows they get an explicit owner-only ACL. This is per-artifact rather than a blanket permission sweep over the whole data directory. We recommend, and enterprise deployments should enforce, FileVault or BitLocker; given the recovery file above, that is what actually closes the lost-or-stolen-device case.

None of the above exists on any Sparcle system. There is no copy to subpoena, breach, or ask us to delete.

macOS configuration profiles and Windows Group Policy with a supplied ADMX/ADML template. Settings can be pinned so users cannot change them. See /trust/managed-deployment.

Five hostnames on 443 to download, update, and run. Per-vendor allowlist steps for Palo Alto, Zscaler, Cisco Umbrella, Netskope, and Fortinet at /trust/network-allowlist.

A read-only script that shows every connection Bolt opens on a test machine, classified against the published list, at /trust/prove-it-yourself. We would rather you ran your own monitor.

CAIQ, SIG, and HECVAT answers are pre-filled at /trust/questionnaire. Send us your own instrument if you would rather we complete it.

The Helm chart ships Kubernetes NetworkPolicy definitions, so egress from the deployment is something you read and enforce rather than take on trust. They are in the chart values, including the production and air-gapped variants. Ask and we will point you at the exact files for the version you are evaluating.

Do not evaluate PII detection on our examples. Bolt runs on your machine, so paste your own hardest cases into it and watch what happens: international identifiers, free-text names, clinical narrative, proprietary source. Structured PII is masked by the always-on regex floor; free-text names need the model engine switched on, and on some platforms deployed separately. If something you care about is missed, that is the finding we want.

Most vendors answer this with an escrow clause. We would rather give you the property escrow is trying to buy, already built in. Bolt is self-hosted, its licence is a signed token verified offline against a key compiled into the binary, and nothing contacts Sparcle in order to run. So your deployment keeps working on its own terms, your data is already in your own infrastructure, and Helm or Docker is what your platform team operates every day. That is continuity you can test during a pilot rather than a clause you hope never to invoke. Source-code escrow is not a standard term in our contracts today; if your continuity policy calls for one, raise it during contracting and we will work through it with you.