Security and data handling.
How Bolt Sight treats your keys, secrets and telemetry: what the service checks, what it removes before storing anything, who can read what, and what Techsstuff LLC does with your data.
In transit and in the browser
Everything between you and the service runs over HTTPS.
| Control | What it does | Applies to |
|---|---|---|
| HTTPS | The app and the ingest endpoint are served over HTTPS and send a Strict-Transport-Security header. | Console, ingest, API |
| Browser protections | App responses carry a Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff and a restricted Referrer-Policy. | Console |
| Payment pages | Credit packs are bought on Stripe-hosted checkout. Card details are entered only there; Techsstuff LLC never receives or stores a full card number. | Billing |
Accounts and sessions
How people sign in to the console.
| Passwords | Stored as bcrypt hashes, never in clear text. Sign in with Google is also available; it uses PKCE and a random state value, and requires a verified email address. |
|---|---|
| Sessions | A 15-minute access token and a 7-day refresh token. The refresh token is an HttpOnly, SameSite=Strict cookie, stored only as a SHA-256 hash, and replaced each time it is used. Presenting a token that was already used signals theft and is rejected. |
| Brute force | Sign-in is limited to 5 attempts a minute per address, and an account is locked for 15 minutes after 5 failed attempts. |
| Roles | Each project member is an Owner, Editor or Viewer. Viewers read, Editors also change dashboards and alert rules, and Owners also manage keys, allowed origins, members and billing. |
| Query limits | Console queries are rate-limited per user, and the number of expensive telemetry queries a user can run at once is capped. |
Ingest keys
The credential your code uses to send data.
| Write-only | An ingest key can send telemetry to its project. It cannot read data or sign in, so a leaked key cannot expose what you have already stored. |
|---|---|
| Shown once, stored hashed | The key is displayed once at creation. Only its SHA-256 hash and a short prefix are stored. |
| Revocable | Revoking a key takes effect on its next request. You can hold up to 50 keys per project, one for each producer. |
| Browser origins | For browser apps, requests are accepted only from the origins you allow (up to 20 per project). Browser keys are public by design, so give the browser its own key. |
| Capacity isolation | Rate limits apply per key and signal, with a ceiling for the whole project, so one noisy producer cannot starve another. |
Project isolation
One project’s data is not readable from another.
| Stamped on arrival | The receiver stamps every record with the project of the key that sent it. The sender cannot choose another project. |
|---|---|
| Scoped on every read | Console queries run in the project you are working in. The project and your role are resolved on the server from your session and membership, not taken from the request body, and billing and key management additionally require an owner or administrator. |
| Separate application data | Dashboards, alert rules, channels, keys and members belong to one project. |
What is cleaned before it is stored
The redaction rules are pattern based. They are a safety net, not a substitute for keeping personal data out of telemetry.
| Control | What it does | Where it applies |
|---|---|---|
| Sensitive attribute names are dropped | An attribute is not stored when its key contains one of these words: api_key, apikey, authorization, client_secret, cookie, jwt, passwd, password, private_key, secret, session or token. | On arrival |
| Secret-looking values are redacted | Values that look like bearer or basic credentials, JWTs, private-key blocks, password= style pairs, email addresses or card-number-length digit runs are replaced with [REDACTED]. This also covers span, service, metric and event names and log bodies. | On arrival |
| Fields are bounded | At most 64 attributes per record, 1 KB per attribute value, 8 KB per log body and 256 bytes per name. | On arrival |
| Cleaned before anything reads it | The same cleaned records are used for storage, Live Tail, error grouping and alerts. | On arrival |
| Safer browser defaults | The browser SDK leaves exception messages and stack traces out unless you opt in, restricts which attribute keys and span names it exports, and traces only requests that match an exact origin, method and path. | In your app |
| Export allowlist | The Node.js SDK can apply a closed export policy to names, resources, attributes, events, links and status before anything leaves your process. | In your process |
Secrets
What is encrypted and what is hashed.
| Channel secrets | Webhook URLs, SMTP passwords and bot tokens are encrypted with AES-256-GCM at rest and are never returned by the API. |
|---|---|
| Signed webhooks | Every webhook alert carries an HMAC-SHA256 signature of its body so your receiver can verify it came from Bolt Sight. |
| Safe outbound requests | Alert notifications to webhooks, Slack and Telegram require HTTPS, resolve hostnames when connecting, block private address ranges and limit redirects to three. |
| Keys and tokens | Ingest keys and refresh tokens are stored only as SHA-256 hashes; passwords as bcrypt hashes. |
What Techsstuff LLC does with your data
The binding statements are in the privacy policy and the terms; this table summarizes them.
| Use | The data you send to a project is stored and processed to provide the service to that project, and members of the project can access it. We record usage, such as ingested records and query attempts, to apply credits and billing. |
|---|---|
| Sale and advertising | We do not sell this data or use it for advertising. |
| Retention | Traces, logs and error events are deleted 8 days after their timestamp and metric data points after 90 days. The daily totals behind the Events page are kept for 400 days. Dashboards, alert rules, channels, keys and members stay until you delete them. See retention. |
| Deletion | To delete a project’s data or your account, email us from the address on the account. |
| Providers | Hosting, email and payment providers may process information as needed to provide their services, as described in the privacy policy. |
| Payments | Credit packs are paid on Stripe-hosted checkout. Our pages and apps do not collect or store card details. |
Card details are entered only on the payment provider's checkout page. Stripe, our payment provider, is certified to PCI DSS Level 1, the payment card industry's highest security standard, and receives your details over an encrypted HTTPS connection. Techsstuff LLC never receives or stores your full card number.
Reporting a security issue
Found a vulnerability or something suspicious? Tell us.
| How | Email support@techsstuff.com or call +1 307-256-7988. These are the only security contacts; there is no separate mailbox. |
|---|---|
| Include | What you found, the page or endpoint involved, steps to reproduce it and the time you saw it. Do not include passwords, API keys or payment card details, and do not access data that is not yours. |
| What happens next | We read every report and reply by email. We do not publish response-time commitments. |
What this page is
This page describes how the service is built, as the product’s code and documentation state it. It is not an audit report, certification or guarantee. Techsstuff LLC does not publish compliance certifications or uptime figures for Bolt Sight on this website, and the terms promise no specific service level.