For makers of app-connected toys sold to California buyers

The same “admin” on every unit is not a security feature.

Deadbolt records, model by model, how each connected toy meets California’s connected-device law — a password unique to each unit, a setup that forces a new one before first use, a conforming security label, or another reasonable feature with written reasoning — and the dated proof it works on the firmware shipping now. New firmware without new proof is flagged.

Open the demo See pricing

Opens in this browser with an invented toy maker already in it. No account, no email address, nothing installed.

Open the free demo →

The problem

The oldest failure is still the common one.

California Civil Code 1798.91.04 makes the maker of a connected device equip it with a reasonable security feature. A device reachable from outside the home network is deemed to meet it if its preprogrammed password is unique to each unit, or if it makes the user set a new one before first use. A toy that ships with the same default password on every unit meets neither.

§ 1798.91.04

the California law: a connected-device maker must include a reasonable security feature.

Cal. Civil Code →

Unique

to each device — a preprogrammed password that qualifies.

Cal. Civil Code →

Forced

a new credential before first use — the other route that qualifies.

Cal. Civil Code →

Will not call a model secure that is not.

The same default password on every unit is a stop. A “unique” password that is a common default is a stop. A toy called local-only that pairs through an app or cloud is a stop. Proof is tied to a firmware version, so new firmware with no new proof is flagged, not assumed.

How it works

Models, proof, the file

Record each model

Its firmware, whether it can be reached from outside the home, its route, the default password, and what it collects.

Add dated proof

Several units checked for different passwords, screenshots of a forced reset, the label certificate, or a written review — on a firmware version.

Print the file

Every finding and each model’s route and current proof.

What it will never do

It keeps the record. It tests no toy.

Deadbolt records what you checked and when. It does not probe any device.

No device link.Nothing connects to any toy.

Not COPPA.Children’s privacy law is a separate duty; Deadbolt reminds you where it applies.

It is not a lawyer.A demand letter goes to one. Deadbolt is the record you take with you.

It never touches a payment.The subscription is for software.

Pricing

Priced per maker

Less than one unit off the line.

Most makers

One maker

$9/month

Every connected model one maker sells.

A route per model
Proof per firmware version
Printable file

One maker, yearly

$90/year

The same, two months free.

Everything in One maker
New-firmware flags
Export for your lawyer

Subscription. Your bank statement says Deadbolt Software. Refunded in full on request within 30 days. Your licence key is emailed to you within two working days of payment.

Checkout is our own bitcoin server, not a card processor — nobody we had to apply to and nobody who can close the account. The button takes you straight to it. Give your email address there — that is where your key is sent.

Questions

The ones we actually get asked

Our toy is Bluetooth only. Does it count?

If it cannot be reached from outside the home network, mark it local-only. If it pairs to an app or cloud that can, it is not.

What proof is enough?

Whatever shows the route works on the shipping firmware: units checked for different passwords, screenshots of a forced reset, or the label certificate.

Does Deadbolt cover COPPA?

No. Toys that collect voice or a child’s profile have a separate children’s privacy duty. Deadbolt reminds you; it does not cover it.

Is this legal advice?

No. It is the record you wish you had kept.

What do I actually get when I pay?

The demo on this page is the whole program, running on invented records. Paying gets you a licence key — one line of text, emailed to the address you give at checkout within two working days. Paste it into the program and from then on it keeps your own records. Until then, nothing you type into it is kept.

The key is checked inside the page, on your own machine. It never calls us, so there is still no account and nothing about your business goes anywhere. If you ever stop paying, your records stay exactly where they are, read-only, and Export still hands you every one of them.

Open the demo before the next release

The invented maker’s robot ships with “admin” on every unit, a camera bear is proven only on old firmware, a music box called local-only pairs to the cloud, and the smart blocks have no written reasoning. Deadbolt names every one.

Open the demo See pricing