IT Policy & Network Egress

Last updated: 5 October 2026 - Version 0.2 - Operated by MeliUX Ltd. For the broader trust posture see /trust.

For IT teams. A BIM developer at your firm wants to install AllAddin and you need to decide whether to allow it. This page answers the questions a vendor-risk-assessment usually asks: what AllAddin contacts on the network, on what ports, and what you can put in a firewall allow-list. Full security and privacy posture lives at /trust; the vulnerability disclosure policy at /security.

1. Network egress endpoints

AllAddin connects outbound only. It accepts no connections from other machines, uses no peer-to-peer traffic, and does no auto-discovery. All outbound traffic is HTTPS over TCP/443. Section 2 lists the two loopback-only local servers.

Endpoint	Protocol / port	Purpose
`revitclaw-production.up.railway.app`	HTTPS / 443	Backend API. AllAddin sends requests (prompt and structured context; when needed, the generated code with its errors and output) and the data a feature the user runs needs -- see /trust section 1. Update downloads also come from here.
`alladdin.dev`	HTTPS / 443	Marketing + docs site, version-check endpoint, signed installer download. Checked for updates every 30 minutes while Revit runs.
`www.gstatic.com` `fonts.gstatic.com`	HTTPS / 443	System fonts the panel uses if the local font cache is missing. Optional -- works without if blocked.
`ingest.de.sentry.io`	HTTPS / 443	Crash reporting (Sentry, EU/Germany ingest). `send_default_pii=False`, user identity is stripped and report text is sanitised before sending; only sanitised stack traces + request metadata leave. When AllAddin crashes it sends this sanitised report so we can fix what broke -- that's how we do support. No identity attached, EU-hosted, no in-app toggle; block this host at the firewall if your policy requires it, with no loss of functionality.
`<account>.eu.r2.cloudflarestorage.com`	HTTPS / 443	Cloudflare R2 (EU-jurisdiction bucket). Direct client upload/download of client-side-encrypted share-link blobs, and download of your practice's detail library files (small Revit files holding one drafting view each) through time-limited links. The client uploads and downloads ciphertext directly over HTTPS; only hit when a user creates or opens a share link.

What AllAddin does NOT contact: third-party AI providers directly (Anthropic / Mistral). All AI calls route through the AllAddin backend; the user's machine never establishes a direct connection to a third-party model provider. That's a deliberate architecture choice -- keeps the API keys out of every user's machine, keeps the audit log centralized, keeps your firm's network exposure to a single allow-listed host.

Processing regions: EU (our backend databases and servers in the Netherlands, Mistral, Sentry, Cloudflare R2 (EU share-link storage)), US (Anthropic, and a replica of our production web service in Virginia), under SCCs / UK IDTA. MeliUX Ltd is UK-registered. See the live sub-processor register.

2. Inbound network surface

Nothing reachable from other machines. AllAddin runs no services and does not register itself as a firewall exception. Two features open a listener bound to localhost only, which other machines cannot reach: the API Bridge, when a user starts it (ports 7778-7787), and the Dashboards "Open in browser" view (a free port chosen by Windows, opened on first use). Beyond that, the only inbound connections are whatever Revit itself opens (typically the BIM 360 / ACC / cloud-collaboration sockets that Autodesk's own add-ins use).

3. Telemetry posture

Pseudonymous usage telemetry. Request timing, model used, success/failure flag, linked to the user's account. No model contents, no element data; the project reference is a one-way hash, not the project name or filename.
Crash reporting. Sanitised stack traces + request metadata via Sentry (EU ingest, identity stripped). Sent automatically on a crash so we can fix what broke -- no in-app toggle; block ingest.de.sentry.io at the firewall to disable it. AllAddin works fully without it.
Update checks. Every 30 minutes while Revit runs, against our backend. An update installs when Revit closes, after the user agrees (or without asking if the user chose silent updates). The chat interface's web files update in the background; they are signed and verified before use. There is no setting to turn the check off yet.
AI processing. Chat answers come from Anthropic. Requests that fix an error, summarise a result or tag a failure can be processed by Mistral (France, EU) instead.
Improvement corpus. After a turn completes, the prompt, the generated code and its execution outcome are sent to us so we can review what worked and what failed. This is on by default. Identifying fields (file path, document title, worksharing username, project name/number) are redacted on the machine before anything is sent. Disable per user with share_tricks=false, or for every user by deploying suppress_background_egress=true to each user's file, both under [privacy] in %APPDATA%\AllAddin\alladd.ini.
No advertising or tracking pixels. No Google Analytics, no LinkedIn Insight Tag, no third-party beacons.

4. Authentication

AllAddin uses a per-user bearer token (we call it an "RC token") issued by us at onboarding. The token lives in %APPDATA%\AllAddin\alladd.ini, encrypted with Windows DPAPI in the user-scope. A stolen alladd.ini on a different machine is useless -- DPAPI can only decrypt on the original Windows account.

We can revoke a token at any time. Tokens we issue today stop working within 10 seconds of being revoked; a request that is already running finishes. If your firm's security review needs a "we can revoke at any time" guarantee in writing, email trust@alladdin.dev and we'll confirm in the response.

5. Allow-list memo template

Drop-in copy your BIM developer can hand to your IT team to request approval. Edit the bracketed fields and forward.

Internal memo template

To: [IT manager / vendor-risk lead]
From: [BIM developer name]
Re: Approval request -- AllAddin (Revit add-in by MeliUX Ltd)

I'd like to install AllAddin, an AI-assisted Revit add-in, on my machine to [specific use case -- e.g. "automate the sheet-creation workflow on the [Project] project"]. Below is the network-egress profile our IT team needs for an allow-list decision.

Vendor: MeliUX Ltd (UK), Companies House 12413967, ICO registration ZC137214.
Trust posture: ISO 27001 ISMS drafted (51 v0.1 docs, all 93 Annex A controls in scope), full posture at https://alladdin.dev/trust.
Security disclosure: https://alladdin.dev/security.

Network egress to allow-list (HTTPS / 443 outbound only):

revitclaw-production.up.railway.app -- backend API
alladdin.dev -- site + signed installer + version check
ingest.de.sentry.io -- crash reporting, EU ingest (block at the firewall to disable)
fonts.gstatic.com -- fonts (optional)
<account>.eu.r2.cloudflarestorage.com -- Cloudflare R2 (EU), direct client upload/download of client-side-encrypted share-link blobs and download of detail library files through time-limited links

No listeners reachable from other machines. No P2P. No direct connections to AI providers (Anthropic / Mistral) -- all AI calls route through the AllAddin backend, so your firm's network sees a single allow-listed host, not the broader AI ecosystem.

What AllAddin sends: my natural-language request, the Revit version and active view name, and a small structured summary of the active selection (category and family/type names with counts -- no geometry). When the AI fixes an error or summarises a result, it sends the generated code with its errors and output, which can include values the script read. Features I use (room data sheets, dashboard narration, compliance checks, share links) send what they need. After a turn completes it also sends that request, the generated code and its execution outcome to MeliUX's improvement corpus, which IT can turn off for every user by deploying suppress_background_egress=true. Identifying fields (file path, document title, worksharing username, project name/number) are redacted by default before sending; IT can manage all of this via [privacy] in alladd.ini. What stays on my machine: the .rvt / .rfa files themselves and model geometry (except in a share link I publish). Full data-flow disclosure at https://alladdin.dev/trust.

Authentication: per-user bearer token, encrypted at rest with Windows DPAPI (user-scope; stolen file on another machine is useless). MeliUX can revoke a token at any time; the tokens it issues today stop working within 10 seconds of being revoked.

Installer: signed MSI (Authenticode, publisher "MeliUX Ltd"). Standard Programs-and-Features uninstall -- see uninstall guarantee at https://alladdin.dev/trust.

If a security questionnaire is required, MeliUX maintains a template they'll return filled in: email trust@alladdin.dev.

6. What MeliUX provides on request

Email trust@alladdin.dev for any of the below; turnaround under two business days.

A completed copy of your firm's vendor-risk-assessment questionnaire (we maintain a template covering the common ISO 27001 / SOC 2-style questions).
A point-in-time export of all the data we hold for your seat (DSAR) -- separately from this, request one by emailing trust@alladdin.dev (the /privacy page describes the process).
The signed Data Processing Agreement at /dpa, ready for your firm's signature.
A list of every sub-processor in the data path (/sub-processors).
The vulnerability disclosure policy at /security if your security team wants to test.