B.O.L.T.

BOLTFFL Compliance Evidence

BOLTFFL is built as a security-first compliance platform for Federal Firearms Licensees. Each FFL tenant is isolated in its own encrypted database, protected by tenant-specific keys, machine-bound master key protection, audited break-glass recovery, tamper-evident audit logs, controlled file uploads, encrypted backups, and deterministic ATF workflow validation.

BOLTFFL does not rely on AI to make compliance decisions. ATF Form 4473 and A&D validation rules are deterministic, citation-backed, and auditable.

B.O.L.T. supports compliant recordkeeping through electronic workflows, audit trails, and backup tools. Our platform backup system provides an additional layer of protection for tenant account data and supports service recovery.

Each FFL holder remains responsible for accurate and timely records, required retention, inspection access, and required local copies and backups. B.O.L.T.'s platform backups supplement these responsibilities.

A B.O.L.T. subscription does not include legal advice, attorney representation, or funded legal defense.

Full detail: Terms of Service · Backup Documentation

Disclaimers

BOLTFFL is not ATF-approved because ATF does not approve commercial software.

BOLTFFL is designed to support compliant electronic A&D and Form 4473 workflows when configured and used according to applicable rules.

BOLTFFL does not use AI to make compliance decisions.

SOC 2-ready controls are not the same as SOC 2 certification.

Security Architecture

Each tenant is stored in its own encrypted database — one FFL cannot see another FFL's data.

Master keys are hardware-bound and never written to application logs.

Passwords are stored as one-way modern hashes; plaintext passwords are never persisted.

Encryption keys can be rotated without downtime and every rotation is fully audited.

Access Control

Administrative sessions time out on the order of minutes, not hours.

Every state-changing request is protected against cross-site request forgery.

Sensitive recovery endpoints are aggressively rate-limited to defeat brute-force attacks.

Administrative role separation prevents a single compromised account from taking the whole platform.

Audit Trail

Every audit-log row is cryptographically chained to the row before it — any tampering is detectable.

Login attempts, admin actions, recovery-key use, backup events, and upload rejections are all recorded.

Compliance PDFs carry a signed footer so auditors can verify authenticity.

File Upload Safety

Uploaded files are validated by content — a file that lies about its type is rejected.

Optional antivirus scanning integrates with an operator-provided ClamAV daemon; when enabled, sensitive upload paths (backups, 4473 attachments, historical-PDF ingest) fail closed if the scanner is unreachable. Low-risk uploads (distributor CSV imports) fail open with a warning log.

Rejections are logged; no silent drops.

Backup and Recovery

Every backup and restore action is audited end-to-end — creation, download, upload, restore, and deletion.

Restores run through a pre-flight validation pass before touching production data.

Backup manifests are cryptographically verified before restore.

ATF Compliance Controls

Form 4473 and A&D checks are deterministic rules — no AI, no black boxes.

Every violation cites the specific ATF rule it triggered.

Corrections preserve originals, so the audit trail stays intact.

Inspectors can pull a read-only PDF binder for on-site audits with one click.

For auditors and enterprise procurement

Detailed control documentation — file:line source citations, cryptographic parameters, deployment topology, and the full audit-event taxonomy — is available to third-party auditors and enterprise procurement teams under NDA . Request access via: