Treedis Trust Center

Governance & assurance

• ISO/IEC 27001. Treedis maintains a certified information security management system. Our certificate is available on request.
• Accountability. Designated security leadership oversees policies, risk ownership, exceptions, and corrective actions, with management review.
• Privacy. Our Privacy Policy and Data Processing Agreement (DPA) describe how personal information is handled. We support applicable customer privacy obligations and security assessments.
• Continuous review. Internal audits, risk assessments, and policy reviews inform improvements to the security program.

Service resilience & recovery

• Documented business continuity and disaster recovery plans define responsibilities, recovery procedures, and communication.
• Encrypted backups and controlled access support recovery of customer information.
• Restore exercises validate recovery mechanisms and inform improvements to our procedures.
• Continuity plans are reviewed regularly and after material changes. Customer-specific service and recovery requirements are addressed through the applicable agreement.

Data protection & encryption

• Encryption. Encryption protects customer information in transit and at rest, with managed keys and restricted access.
• Credentials. Passwords are hashed, and secrets are protected separately from application source code.
• Information handling. Classification, access restrictions, and sharing controls govern the use of sensitive information.
• Retention. Retention and secure deletion requirements cover the information lifecycle, subject to contractual obligations and legal holds.

Endpoint & network security

• Endpoint protection, patch management, and secure configuration standards support staff devices.
• Network access controls restrict connectivity and help protect customer information from unauthorized access.
• Web protection and abuse-prevention controls help safeguard customer-facing services.
• Security logging, monitoring, and alerts support detection, investigation, and escalation.

Identity & access management

• Named accounts and role-based permissions support least-privilege access to systems and customer workspaces.
• Multi-factor authentication protects privileged access. Customer authentication options include MFA and single sign-on.
• Access requests and approvals are documented, and access rights are reviewed as roles and responsibilities change.
• Offboarding procedures address access removal. Remote support follows authorization and user-consent requirements.

Spatial data handling

• Spatial content, documents, and associated asset information are handled according to workspace permissions and approved processing purposes.
• Logical access controls support separation between customer workspaces.
• Integrations are reviewed for authorized access, information handling, and applicable supplier requirements.

Secure development

• Our secure development lifecycle covers security requirements, code review, testing, and controlled releases.
• Development and test environments are separated from production, with restrictions on production data use.
• Code and dependency scanning support the identification of vulnerabilities. Findings are prioritized by severity, exposure, and system criticality and tracked through remediation.
• Change-control procedures cover authorization, testing, rollback planning, and documentation.
• Independent penetration testing forms part of our security assurance program.

Incident response

• A documented incident response plan defines responsibilities, escalation, evidence preservation, containment, and recovery.
• Tabletop exercises help teams practice response procedures and identify improvements.
• Customer communications follow applicable contractual and legal notification requirements.
• Incident reviews inform corrective actions and updates to procedures.

Supplier security & privacy

• Supplier risk procedures address due diligence, confidentiality, security requirements, and ongoing review.
• Applicable agreements address privacy, incident notification, and obligations for downstream processing parties.
• Sub-processor information and change-notification arrangements are provided through the applicable DPA and customer review process.

People & security awareness

• Security awareness training covers information handling, phishing, responsible AI use, and incident reporting.
• Personnel policies define screening requirements, confidentiality obligations, acceptable use, and access removal.
• Developers receive secure development guidance, including the review of AI-assisted code.

Responsible AI

Governance & accountability

• Our AI Use Policy and governance procedures define accountable owners, an AI inventory, and risk-based approval requirements.
• AI uses are classified by risk, with stronger review and oversight requirements for higher-risk features.

Customer information & approved use

• AI provider use is subject to security and privacy review and applicable contractual requirements.
• Our policies restrict the entry of customer information, secrets, and personal data into unapproved AI tools.
• AI features are subject to approved processing purposes and customer access permissions.

Human oversight & access boundaries

• Workspace and tool permissions govern what an AI feature is authorized to access or do.
• AI outputs require appropriate verification before they are relied on, particularly for consequential actions.
• User and operator guidance covers intended use, known limitations, safe information handling, and reporting concerns.

Evaluation, monitoring & response

• Documented AI evaluation procedures address reliability, security, prompt-injection risks, and misuse.
• Governance procedures cover monitoring, feedback, incident response, and review after material changes.
• AI-generated information can be inaccurate or incomplete. Users should check relevant source information before acting.