Treedis Trust Center

Compliance & certifications

• ISO/IEC 27001 & GDPR. Every client receives a Data Processing Agreement (DPA) to evidence compliance with ISO/IEC 27001 and GDPR (and the UK GDPR / Data Protection Act 2018 where applicable). Our ISO 27001 certificate is available on request.
• Privacy & terms. A Privacy Policy and DPA are provided alongside our Terms of Use, and we assist with data-subject requests and DPIAs.
• Infrastructure attestations. Where useful, audit requests can be satisfied with our ISO 27001 certificate and the relevant third-party certifications of our infrastructure provider, AWS.

Infrastructure & reliability

• Target 99.9% availability.
• Hosted on AWS (us-east-1), Multi-AZ; enterprise clients can receive mirrored / region-pinned environments.
• Aurora PostgreSQL clustered across multiple Availability Zones with automatic failover; ElastiCache (Valkey) Multi-AZ.
• Core services run on AWS ECS Fargate with two or more replicas; content delivered via CloudFront + S3.
• Daily database backups at 03:00 UTC, retained 30 days; logs retained up to 1 year.

Data protection & encryption

• In transit: TLS 1.3 enforced end-to-end, with HSTS and HTTPS-only delivery via CloudFront.
• At rest: AES-256 encryption for data stores (RDS/Aurora, S3).
• Secrets are encrypted in AWS Secrets Manager and SSM Parameter Store, with keys held separately and accessed through scoped AWS IAM and KMS.
• Passwords are hashed; data-leak prevention is supported by AWS Macie, Snyk, and SentinelOne.

Endpoint & network security

• SentinelOne EDR runs across production workloads.
• AWS WAFv2 sits in front of all production load balancers, with AWS Managed anti-DDoS rules, user-agent detection, and IP / regional allow- and block-listing.
• Google reCAPTCHA v3 for bot protection; rate limiting for abuse and DDoS mitigation.
• Isolated VPC with private subnets, databases and cache are not publicly accessible; least-privilege security groups.

Identity & access management

• Single sign-on via any SAML 2.0 provider (e.g. Microsoft Entra).
• MFA required on internal cloud accounts; AWS Site-to-Site VPN supported.
• IAM roles scope every service to specific S3 prefixes, Secrets Manager paths, and SSM parameters (least privilege).
• SSH access requires a PEM key and is restricted to a small number of senior engineers.

Spatial data & embeds

• Digital-twin capture data is hosted by Matterport; AR data (Matterpak / E57) is held on Matterport and Treedis.
• Private model embeds use short-lived tokens (seconds to minutes) for maximum security.
• OAuth integration with Matterport stores only refresh tokens, never long-lived credentials in the clear.

Application security & development

• Multi-environment QA process before any production deployment.
• Infrastructure managed as code (Terraform) with change control via version-controlled repositories and CI/CD.
• Snyk scans for dependency and code vulnerabilities; client penetration testing is welcomed.
• Datadog and AWS CloudWatch provide monitoring, tracing, and log aggregation.
• Personal-data breaches are notified to affected customers without undue delay, within 48 hours of becoming aware.

Sub-processors

Treedis engages a limited set of sub-processors, each bound by data-protection terms no less protective than our DPA. Customers are notified at least 30 days before a sub-processor is added or replaced.

• Amazon Web Services (AWS): core cloud infrastructure (compute, database, storage, CDN, networking).
• Matterport: 3D capture and virtual-tour SDK.
• Anthropic & Amazon Bedrock: foundation models powering TAI.
• Datadog: application performance monitoring and logging.
• SentinelOne: endpoint security / EDR.
• Stripe: subscription billing and payment processing.
• Google: reCAPTCHA and OAuth sign-in.

A complete, current list (including conditional sub-processors) is provided with the DPA on request.

Treedis AI (TAI) standards

AI architecture & data privacy

• TAI uses a Retrieval-Augmented Generation (RAG) architecture, grounded in your own twin, documents, and asset data.
• We do not train or fine-tune foundation models on your data; context is used as a reference only and purged after a query.
• You retain full ownership of your data at all times.

Infrastructure & AI security

• Documents are stored in Amazon S3 and vectorized search in Amazon Aurora PostgreSQL.
• TLS 1.2+ and AES-256 encryption across the AI pipeline; strict AWS IAM policies and private subnets enforce network isolation.

Accuracy & model integrity

• Semantic search combined with keyword search reduces hallucinations.
• Every response from TAI includes direct citations to its sources.
• TAI runs on Anthropic Claude and Amazon Bedrock foundation models.

Safety & compliance guardrails

• Amazon Bedrock Guardrails provide content filtering and PII detection on inputs and outputs.
• Bias mitigation through foundation-model safety training, with full visibility into generated queries.