Trust
Where the model runs.
Sparcle does not ship a model. We ship the runtime that drives a model you chose. The prompt assembly, the access-controlled retrieval, the PII masking, and the audit log all live inside your perimeter, regardless of where the model itself lives. And much of the platform never calls a model at all: launcher recognition, manifest→MCP utility calls, and search are deterministic and on-device, with no LLM, no egress, in any mode. This page explains the three deployment modes our customers actually use, the privacy taxonomy the runtime applies to every endpoint, and the masking guarantee that holds even when the customer points us at a public LLM API.
The architectural decomposition
The runtime is invariant. Only the model location changes.
Bolt's runtime (the agent loop, the prompt assembly, the retrieval ACL, the PII masking, the audit log) runs inside the customer's perimeter in every shipping topology. The LLM adapter is a thin HTTP client whose base URL points at whichever inference endpoint the customer configured. Swapping the model location does not change the security posture of anything else.
The three modes
What customers actually configure.
Ordered from most private to least private. Mode A and Mode B are the configurations regulated industries adopt. Mode C is useful for evaluation and lower-sensitivity workloads, and degrades gracefully via the masking layer described below.
Mode A
On-prem inference
Strongest data-residency. Customer-owned GPUs.
- Customer setup vLLM, llama.cpp, TGI, Ollama: any OpenAI-compatible server on your hardware.
- What leaves the perimeter Nothing. Stays inside your perimeter.
- Endpoint privacy tier Local-only
- Suited for Classified, ITAR, air-gapped, sovereign cloud.
Mode B
In-tenant cloud LLM
No GPUs to run. Prompts never leave your cloud tenant.
- Customer setup Azure OpenAI (Private Endpoints), Bedrock (VPC interface), Vertex (Private Service Connect), or equivalent.
- What leaves the perimeter Stays inside your cloud tenant. No public internet.
- Endpoint privacy tier No-train-default
- Suited for The common regulated config. Reuses your existing cloud-LLM contract.
Mode C
Public vendor LLM API
Single-user evaluation, lower-sensitivity workloads, accepted vendor-API contract.
- Customer setup OpenAI, Anthropic, OpenRouter, Gemini: any OpenAI-compatible public API.
- What leaves the perimeter PII-masked prompt to vendor API. Unmasked record stays in your audit log.
- Endpoint privacy tier No-train-default · Trains-by-default (Gemini free)
- Suited for Eval, internal-only, public-scope content. Not the posture for regulated data.
Endpoint privacy taxonomy
Every configured endpoint gets a tier.
The Bolt runtime derives a privacy tier from the provider and the base URL. The derivation is a pure function: no I/O, no provider call, and nothing about the request contents. The tiers are an ordinal scale so 'minimum acceptable tier' is a single comparison.
| Tier | What it means |
|---|---|
| 1. Local-only | No data leaves the host. Local inference servers running on customer hardware. |
| 2. ZDR | Contractual zero-data-retention. Either ZDR routes on a routing layer, or an enterprise ZDR contract the customer holds with the provider. |
| 3. No-train-default | Provider does not train on inputs by default. May retain briefly for abuse review. |
| 4. Trains-by-default | Provider may train on inputs unless the customer has opted out elsewhere. |
| 5. Unknown | Endpoint policy is not knowable from the request side. Custom base URLs that are not obviously local fall here. |
The masking layer
PII is masked before any outbound LLM call.
Mode A and Mode B already keep the prompt inside the perimeter. The masking layer is what protects Mode C, and what keeps every other mode's audit log free of model-side exposure.
Detect before the call
Text bound for the model is scanned for PII and detected values are replaced with opaque tokens, with the mapping held in the per-request context. Two layers do this: an HTTP middleware over JSON request bodies on protected routes, and the agent loop itself, which masks every prompt, memory and tool result it assembles before the adapter is invoked. The agent-loop layer is the one that matters, because it is where the text that actually reaches a model is built. It is active when a detector is configured; with no detector wired there is nothing to mask with, and the loop runs unmasked.
Restore on the way out
When the LLM response comes back, an outbound layer rehydrates the tokens before the response leaves the process. The model sees masked text; the calling user sees the real values.
Tools see real values, but only the ones you trust
Restoring a masked value for a tool is decided per destination, not waived across the board. A tool running on-device, in-process, or on an MCP server an administrator provisioned gets the real value, because a tool that needs a real customer ID needs the real customer ID. A user-added third-party MCP server, or web search, keeps the tokens; an outbound guard turns a surviving token into a refusal rather than letting it leak either way. The default for an unrecognised destination is untrusted.
Your perimeter keeps the record
The conversation is retained inside your perimeter and governed by your retention rules. The signed audit trail is content-free by construction: it records the actor as a hash, the action, the resource path and the decision, and never the prompt or response text, not even a truncated one. Its coverage is narrower than the phrase audit trail suggests, and the security questionnaire sets out exactly which actions are sealed and which are not.
Shipped, rolling out, and not claimed
Honest about which parts are operational.
The trust center's voice across every page on this site. We will tell you what is in production today, what is in flight, and what we deliberately do not claim.
What is shipped
The five-tier privacy taxonomy, the per-endpoint tier derivation, the PII-masking layer that runs on the request body before the LLM adapter is invoked, the outbound-restoration layer, and the cryptographically signed, tamper-evident audit trail of privileged actions. These are operational today across all three deployment modes. Values Bolt has been asked to remember about you now go through that same masking chokepoint on their way into the system prompt, so a remembered identifier reaches the model as a token. One scoping detail worth stating plainly: that governs what the model sees, not what the database holds. Remembered text is still persisted unmasked at rest, and the retrieval hints stored alongside it are plaintext by design, so at-rest protection is your storage and key posture rather than the masking layer.
What still needs a decision from you
Enforcement of the minimum-tier policy floor sits at the egress point every model call passes through, streaming and non-streaming alike, so a call path cannot skip it. There is no boot-time refusal gate and none planned, because the endpoint a request uses is a per-request fact: the check belongs where the request leaves, not where the process starts. The part that is yours rather than ours is the setting. The floor ships unset, which means no enforcement until an admin chooses a tier. Trial-friendly by default, and something to set deliberately before production.
What we do not claim
We do not claim that data never leaves your perimeter in Mode C. It does, in masked form. We do not claim ZDR by default; ZDR is a contract the customer holds with their provider, and Bolt reflects that label without verifying it from the request side. The runtime is conservative in both directions: when in doubt, it labels an endpoint as less private than it might actually be.
What this means for your edge AI inspection
The AI workload no longer routes through it.
Inline AI gateways exist to inspect outbound prompts on their way to a public LLM. In Mode A and Mode B, the call never reaches the public internet, so the inline gateway has no traffic to inspect for AI use. In Mode C, the traffic that does leave carries the masked form; the proxy can still log the connection, but the masking has already done the work the DLP layer of an inline gateway exists to do.
The AI Protect line item of an edge gateway can be retired once Bolt becomes the sanctioned AI surface. The general SWG and ZTNA spend stays, because that protects web browsing and SaaS access, workloads Sparcle does not replace. We are the AI runtime, not the network.
Architecture review.
If your security or network team wants to walk this in detail against your current edge configuration, a 30-minute architecture review covers the deployment mode, the masking layer, the audit-log surface, and the endpoint privacy floor your policy team wants enforced.