For your IT and security team
One page to forward, written for the reviewer.
If someone has asked you to approve Bolt, this is everything you would otherwise have to extract from us over three emails. It is deliberately short, it states what we do not have as plainly as what we do, and every claim on it links to the page that lets you check it.
1. Who we are, and what Bolt is
Vendor
Sparcle Inc., a Delaware C corporation.
Product
Bolt, a desktop application for macOS, Windows, and Linux.
Security contact
[email protected], and /.well-known/security.txt (RFC 9116).
Disclosure policy
One business day to acknowledge, 90-day coordinated disclosure, good-faith safe harbor. Published at /trust/vulnerability-disclosure.
Architecture
Bolt runs entirely on the endpoint. Sparcle operates no service that receives customer content, so there is no vendor cloud in the data path to assess.
2. What leaves the endpoint
The question that decides most reviews. Answered by category rather than with a slogan, because the honest answer is not the word never.
Automatic
An update check, and the update package if the user accepts one. Bolt asks our GitHub release channel first and sparcle.app second, so both are on the list; nothing else leaves on its own. There is no telemetry endpoint and no licence call. Block both and Bolt keeps working; it stops offering updates.
Only if a user connects it
Google Workspace or Microsoft 365, over user-consented and revocable OAuth. Traffic goes from the endpoint to that provider directly. It does not transit Sparcle, because there is no Sparcle service in that path.
Only if you configure it
An LLM endpoint: whichever provider or on-prem server you point Bolt at. Bolt ships no LLM and no credentials for one, so nothing reaches a model provider until you configure one. Structured PII and secrets are masked before the call leaves the machine.
Only if a user enables it
A one-time download of an open on-device model from Hugging Face, for local visual search, embeddings, or speech to text. It runs on-device afterwards. Ask us for the offline preload path if your policy forbids endpoint fetches.
Never
Sparcle. There is no telemetry endpoint, no usage analytics, and no licence server. The licence is a signed token verified offline against a key compiled into the binary.
3. Permissions Bolt asks for
All optional. Bolt runs without any of them, with fewer capabilities.
| Permission | What it is used for | If denied |
|---|---|---|
| Full Disk Access (macOS) | Content search across folders the user chooses. Reads happen on the endpoint; results are indexed into a local, encrypted store. | Optional. Bolt runs without it, with a smaller search surface. |
| Accessibility (macOS) | The global hotkey, window management, and the automation Bolt uses to act on the desktop when a user asks it to. | Optional. Without it the hotkey and desktop actions are unavailable. |
| Screen Recording (macOS) | The screenshot and region-capture tools, invoked by the user. | Optional. Without it, screenshot capture is unavailable. |
| Microphone | Local speech to text, using an on-device model, only while the user is dictating. | Optional and off by default. |
| Calendars, Reminders, Contacts (macOS) | Reading events, reminders and contacts through EventKit and Contacts.framework. Each is its own permission with its own prompt, deliberately narrower than one blanket grant. | Optional. Without one, that data source is unavailable and the rest of Bolt is unaffected. |
| Automation, Apple Events (macOS) | Driving Mail, and the two calendar operations macOS exposes no other way: replying to an invitation and adding attendees. This is a separate permission from Accessibility. | Optional. Without it, those actions are unavailable. |
| Files and Folders (macOS) | Reading Desktop, Documents or Downloads when a user points Bolt at them without granting Full Disk Access. | Optional. Denied folders are simply not searched. |
4. Where data is stored, and how it is protected
Encrypted at rest by Bolt
Clipboard history, the local search index, the thumbnail cache, alerts, and the on-device vector indexes are stored in SQLCipher databases, each keyed by its own subkey derived from one device master. Connector credentials and OAuth tokens are sealed with authenticated encryption (AES-256-GCM for the sign-in refresh token that Google and Microsoft mail, calendar and file access run on; XChaCha20-Poly1305 for MCP connector credentials). Read the next row before you rely on this: where that device master lives is the part that decides what the encryption is worth.
Sealed at rest inside the local database
In the local Postgres instance Bolt runs on the endpoint, the heavy content of chat and memory records is sealed with authenticated encryption. A small queryable surface (subjects, short facts, entity names, timestamps, file paths, URLs) is stored in the clear so local search works without decrypting everything. If the per-install key cannot be saved, chat and memory bodies are stored unencrypted, with a logged warning, rather than sealed under a key that would not survive a restart.
Where the device master lives, stated plainly
On a signed release build the device master is held in the OS keychain. A copy of that same master is also kept on disk in the data directory, at mode 0600, as a recovery file, and it is not deleted. On any build that is not a notarized release, the file is the primary store. So a reader who can read that directory can read the databases, and the encryption above is not what defends the lost-or-stolen laptop. We would rather say this than let you infer a stronger guarantee from the word encrypted.
Protected by the platform
Secrets, key material and the encrypted stores are written mode 0600, and their directories 0700, under the user's account; on Windows they get an explicit owner-only ACL. This is per-artifact rather than a blanket permission sweep over the whole data directory. We recommend, and enterprise deployments should enforce, FileVault or BitLocker; given the recovery file above, that is what actually closes the lost-or-stolen-device case.
Not stored by us
None of the above exists on any Sparcle system. There is no copy to subpoena, breach, or ask us to delete.
5. Assurance, including what we do not have
Listing the gaps here is deliberate. You would find them anyway, and finding them yourself after we omitted them is worse for both of us.
| Item | Status | Detail |
|---|---|---|
| Independent security assessment | Passed | Google CASA, performed by an authorized assessment lab against 48 requirements, covering how Bolt handles Google user data. Detail at /trust/independent-assessment. |
| Code signing, macOS | In place | Apple Developer ID issued to Sparcle Inc., notarized, ticket stapled. Verify with spctl before installing. |
| Code signing, Windows | In place | SSL.com Extended Validation certificate issued to Sparcle Inc., key held in a cloud HSM. |
| Release integrity | In place | Every release publishes a minisign-signed SHA-256 manifest, a CycloneDX SBOM, and independent malware-scan lookups keyed to each file's hash. |
| Third-party penetration test | Booked | Engagement booked with an external firm; not yet performed. We commissioned it to be published rather than filed, so what it finds will be readable by you rather than summarised by us. An internal hardening pass is not a substitute and we do not present it as one. |
| SOC 2 | Not held today | Not held today. We do not imply otherwise. Note that a SOC 2 on Sparcle would attest to systems that are not in your data path. |
| ISO 27001, FedRAMP | Not held | On the roadmap, no committed date. |
6. If you decide to deploy it
Managed install
macOS configuration profiles and Windows Group Policy with a supplied ADMX/ADML template. Settings can be pinned so users cannot change them. See /trust/managed-deployment.
Network
Five hostnames on 443 to download, update, and run. Per-vendor allowlist steps for Palo Alto, Zscaler, Cisco Umbrella, Netskope, and Fortinet at /trust/network-allowlist.
Verification
A read-only script that shows every connection Bolt opens on a test machine, classified against the published list, at /trust/prove-it-yourself. We would rather you ran your own monitor.
Questionnaires
CAIQ, SIG, and HECVAT answers are pre-filled at /trust/questionnaire. Send us your own instrument if you would rather we complete it.
Network policy, self-hosted
The Helm chart ships Kubernetes NetworkPolicy definitions, so egress from the deployment is something you read and enforce rather than take on trust. They are in the chart values, including the production and air-gapped variants. Ask and we will point you at the exact files for the version you are evaluating.
Testing the masking on your own data
Do not evaluate PII detection on our examples. Bolt runs on your machine, so paste your own hardest cases into it and watch what happens: international identifiers, free-text names, clinical narrative, proprietary source. Structured PII is masked by the always-on regex floor; free-text names need the model engine switched on, and on some platforms deployed separately. If something you care about is missed, that is the finding we want.
Continuity, if anything happens to us
Most vendors answer this with an escrow clause. We would rather give you the property escrow is trying to buy, already built in. Bolt is self-hosted, its licence is a signed token verified offline against a key compiled into the binary, and nothing contacts Sparcle in order to run. So your deployment keeps working on its own terms, your data is already in your own infrastructure, and Helm or Docker is what your platform team operates every day. That is continuity you can test during a pilot rather than a clause you hope never to invoke. Source-code escrow is not a standard term in our contracts today; if your continuity policy calls for one, raise it during contracting and we will work through it with you.