Security
How Bolt Search protects your data.
How keys, passwords, projects and database credentials are handled, as the product is built. This page does not claim certifications, audits or uptime figures.
API keys
Keys are the way programs reach your project.
- Shown once, stored as a hash. A key looks like
bsk_followed by hex characters. The full key appears only when you create it; lists show a prefix. Only the SHA-256 hash is stored, never the key. - One project, one role. A key works for a single project and is either an editor or a viewer, never an owner. It cannot create projects, change members, manage keys or touch billing.
- Revocable at once. A revoked key is answered with 401 on its next request.
Accounts and sessions
How people sign in to the console.
- Passwords are hashed. Passwords are stored as bcrypt hashes, with cost 12 by default. You can sign in with Google instead, which requires a verified email and uses a signed state, PKCE and a single-use state record.
- Short-lived sessions. Access tokens are signed and expire after 15 minutes by default. Refresh tokens are random 32-byte values stored as SHA-256 hashes, delivered in an HttpOnly cookie, and replaced every time they are used. Signing out revokes all of a user’s refresh tokens, and changing a password revokes the other sessions.
- Guessing is slowed down. Five failed sign-ins for an email lock that email for 15 minutes, and the sign-in and account endpoints are rate limited per IP address.
Isolation between projects
Each project is a separate tenant.
- Indexes are namespaced. Every index is stored under the project’s slug, as
slug__name, and the prefix is removed from responses. Names that contain__are rejected, in URLs, in bulk actions and in scroll ids, so a request cannot name another project’s index. - Everything else is checked against the project. Data sources and sync jobs are looked up for the project of the caller; an id from another project answers 404. Scroll ids are signed, so they cannot be edited.
- Roles are enforced on every API route. The role of the key or member is checked before the handler runs: viewer to read, editor to write, owner to manage the project.
Transport and browsers
How requests are protected on the way.
- HTTPS. The console at
console.boltsearch.appand the API atapi.boltsearch.appare served over HTTPS, and the API sends a Strict-Transport-Security header (two years, including subdomains) on secure connections. - Browser protections. API responses carry X-Content-Type-Options, X-Frame-Options (deny), Referrer-Policy, Permissions-Policy and Content-Security-Policy headers.
- You choose which sites may call the API from a browser. Allowed Origins is a per-project list. An empty list means same-origin requests only.
Your database credentials
What happens to the PostgreSQL login you give a sync job.
- Write-only. A data source’s password is never returned by the API or shown again in the console.
- Read-only by construction. A sync job only runs SELECT statements. Custom queries must start with SELECT and are refused if they contain semicolons, comments, dollar-quoting or data-changing keywords. You should still give the job a database user with read-only rights on the tables it needs, and set
ssl_modetorequireor stricter, because the default isdisable.
What is recorded
Logs, analytics and usage.
- Audit log. Every request that changes something (POST, PUT and DELETE) is logged with the user id, method, path, source address, status, duration and request id. The request body is not logged.
- Search analytics. Each search records its index, query text, result count, latency, user id and source in the project’s analytics; clicks are recorded when you report them. Project members can read this in the Analytics page. Events are deleted after the retention period, which defaults to 90 days. Do not put secrets in search queries.
- Usage reporting. The billing service receives the project id, a meter name and a count of attempts. It does not receive documents or queries.
Payments
Card details never reach Techsstuff LLC.
- Hosted checkout. Credit packs are paid on Stripe-hosted checkout. Card numbers are entered there, not on this website or in the app, and Techsstuff LLC never receives or stores a full card number.
What we do with your data
Plainly.
- To run the service. The data you send to a project is stored and processed to provide Bolt Search to that project, and members of the project can access it.
- Not sold, not advertising. We do not sell it or use it for advertising.
- Deletion. To delete a project’s data or your account, email us from the address on the account. Deleting a project removes its indexes, sync jobs and data sources.
- The policy. Read the privacy policy.
Report a vulnerability
Tell us before you tell anyone else.
Email support@techsstuff.com or call +1 307-256-7988. Say what you found, which endpoint or page it affects and the steps to reproduce it. Use your own project and data when you test, and never access another customer’s data. We read every report and reply by email.
Please do not send passwords, API keys or payment card details.
Create a project and see the controls for yourself.