Trust & Security

Last updated: 7 July 2026 - Version 0.2 - Operated by MeliUX Ltd. Looking to report a security issue? See our disclosure policy.

Why this page exists. AllAddin runs inside Revit, on machines holding billable client work. Architects and engineers are personally liable for that work. Before you install us, you should be able to answer three questions in plain language: what leaves your machine, what protects what stays, and what happens when you uninstall. This page answers those, with sources you can verify yourself.

Signed installerAuthenticode

ISO 27001ISMS drafted

UK GDPRICO registered

Sandboxed exec28 patterns blocked

DPAPI tokensper-user encryption

UK-basedMeliUX Ltd - 12413967

Processing regions: US (hosting, Anthropic), EU (Mistral, Sentry, Cloudflare R2 share-link storage), under SCCs / UK IDTA. MeliUX Ltd is UK-registered -- that's where the company is, not where your data sits. See the sub-processor register.

1. What leaves your machine

AllAddin sends the smallest amount of data that lets the AI help you. Two columns: what travels, what doesn't.

Sent to our backend

The natural-language question you typed.
The Revit version, language pack, and active view name.
A small structured summary of the active selection (category and family/type names with counts -- not geometry).
The generated code's execution outcome (success / error string), so we can learn what worked.
Anonymous usage telemetry (request timing, model used; the project reference is a one-way hash, not a name).
Only if you turn on "Share tricks" in Settings (off by default): the prompt, generated code, and outcome of a completed turn are submitted to our improvement corpus -- see the privacy notice.
To find relevant tips, your typed query text (only the text you typed, never your model contents) is sent to Mistral (France, EU) to compute a search embedding -- and Mistral keeps none of it (zero-data-retention for our account) and does not train on it.

Stays on your machine

Your model contents and geometry.
Element parameter values, schedules, sheet content.
Family library contents and shared parameters.
Your .rvt / .rfa / .rte files.
Your file path, document title, worksharing username, and project name/number -- redacted by default before each request leaves (from v0.8.10; admins can manage this via [privacy] in alladd.ini).
Project-level metadata beyond what's listed on the left.

The wire shape is verifiable: every request is a small JSON envelope. If you want to inspect a request before it leaves, set diagnostic_mode = true in %APPDATA%\AllAddin\alladd.ini and AllAddin will log the full body to a local file before sending.

One deliberate exception. The table above describes what happens automatically when you chat. If you choose to publish a share link (a feature you trigger by hand), a snapshot of the dashboard data you selected -- which can include parameter values, schedule and sheet content, and 3D geometry -- is uploaded so a recipient can open it in a browser. It is encrypted on your machine first and stored as ciphertext only. Section 8 explains exactly how.

2. Encryption

In transit. TLS 1.2+ on every connection between AllAddin and our backend. HSTS enforced via the Railway edge plus an application-layer fallback.
Tokens at rest. Your authentication token is encrypted with Windows DPAPI in the user-scope, so only the Windows account that pasted it can decrypt it. A stolen alladd.ini on a different machine is useless.
Server-side. Database is managed Postgres on Railway with provider-level encryption at rest. Crash reports go to Sentry's EU (Germany) ingest with send_default_pii = False, user identity stripped, and report text sanitised -- sent automatically on a crash so we can fix what broke.
AI providers. We use Anthropic (US) for language features and Mistral (France, EU) for search/embedding features as sub-processors; their data-processing agreements are linked from that page. Both run on zero-data-retention for our account -- they keep nothing after returning the response -- and neither trains on your content.

3. Sandboxed code execution

The AI generates C# code that runs inside Revit's process. Before execution, the script engine rejects code matching any of 28 blocked patterns:

Filesystem. No System.IO, File.*, Directory.*, or path manipulation outside Revit's own document handles.
Network. No HttpClient, WebClient, Socket, or Process.Start for outbound connections.
Process spawn. No Process.Start, Assembly.Load from disk, or shell invocation.
Reflection. No System.Reflection abuse to bypass the above.
Persistence. No registry writes, no service installs, no scheduled tasks.

A blocked script never runs -- it's surfaced back to the chat as a script-engine reject, with the offending pattern highlighted, before Revit ever sees it. The full pattern list is available on request, if you want to verify.

4. Compliance posture

UK GDPR. MeliUX Ltd is registered with the UK Information Commissioner's Office (ICO registration ZC137214). We are the data controller; processing details are in the privacy policy and the sub-processor list.

ISO 27001:2022. Our Information Security Management System (ISMS) is documented: a master register tracks 54 artefacts (51 in draft, the rest scaffolded) -- 13 ISMS management documents (including a Statement of Applicability mapping all 93 Annex A controls), 16 information-security policies, 7 UK GDPR / DPA 2018 artefacts, 4 MeliUX-specific policies, a customer contract-clause library, and 12 live records. Certification is not yet in progress -- this is honest drafted-not-certified status. We surface the work because it shapes how we operate today, not because we're claiming a certificate we don't have.

SOC 2. Not yet on roadmap; revisit once ISO 27001 certification is in motion and we have a US-customer pull demanding it.

5. Ongoing security testing

Dynamic application security testing (DAST). OWASP ZAP baseline scan against our staging environment, weekly cron. Findings auto-ingested into our security_findings ledger and triaged.
Static analysis (SAST). Semgrep + Bandit on every push. Patterns covering injection, secrets, dangerous APIs.
Software composition analysis (SCA). Trivy + pip-audit + GitHub Dependabot on every dependency change.
Secret scanning. gitleaks on every commit; pre-commit hooks block secret-shaped strings before they leave a developer machine.
Independent third-party penetration test. Scheduled for Q3 2026.

6. Uninstall guarantee

The MSI uninstaller removes everything AllAddin put on your machine, in four places:

%APPDATA%\AllAddin\ -- config, cache, logs.
%LOCALAPPDATA%\AllAddin\ -- local-machine state.
Revit add-in manifests (%APPDATA%\Autodesk\Revit\Addins\<version>\).
The Authenticode publisher trust entry (only if it was added by us; we don't touch the Windows trust store otherwise).

What we don't leave behind: registry orphans, scheduled tasks, Windows services, telemetry beacons. The uninstaller is the standard Programs and Features entry; no special ceremony required.

If you want to see this in motion before installing, ask us for the 60-second screen recording of the full install / use / uninstall cycle at trust@alladdin.dev.

7. What we won't do

We won't let your data train AI models. Your content is contractually excluded from model training with both of our AI providers (Anthropic and Mistral).
We won't sell or share your data with advertisers. We are a paid tool, not an ad-supported one. Sub-processors are listed at /sub-processors and the list is contractually bounded.
We won't read your model contents. In normal use your model contents never leave your machine (see section 1), so there is nothing for us to read. The one exception is a feature you trigger on purpose: when you publish a share link, a snapshot of the dashboard data you chose is uploaded -- encrypted on your machine first, stored as ciphertext only. See section 8.
We won't auto-update without your knowledge. AllAddin checks for updates on launch and prompts you; the install step is yours.
We won't survive on dark patterns. Cancellation is a single click in the panel. Uninstall is a standard MSI uninstall. We don't email you "win-back" campaigns.

AllAddin can publish a frozen snapshot of a dashboard workspace to a link anyone can open in a browser -- no Revit, no login. This is the one time model-derived data leaves your machine on purpose, so here is exactly how it is handled.

Encrypted on your machine first. The workspace is AES-256-GCM encrypted on your device with a one-off key before it is uploaded. The plaintext never leaves your machine.
Stored as ciphertext only. The encrypted blob is held in an EU-jurisdiction Cloudflare R2 bucket. The storage provider only ever sees ciphertext, and the key is not stored alongside it, so no single provider holds both the key and the data.
Unguessable, revocable, expiring. The link carries a 192-bit random id, defaults to a 30-day expiry, and you can revoke it at any time -- revoking hard-deletes the stored blob. You can also add an optional password.
Honest limit: this is not zero-knowledge. To let a recipient open a link, our backend hands the decryption key to their browser, which means we could technically decrypt a shared workspace. So this is strong client-side encryption, in transit and at rest -- not end-to-end / zero-knowledge encryption. If you need a mode where even we cannot decrypt, tell us; we can offer it.

9. Who we are

AllAddin is built by MeliUX Ltd, a UK limited company registered in England and Wales (Companies House number 12413967), based in southeast London, operated by Rene Pellicer Garcia. The founder has been a Revit user since 2008 and a member of the Autodesk Expert Elite program since 2015. He also co-authored, as subject matter expert, Pearson VUE's Revit professional certification exam in 2018.

We are venture-unbacked at the time of writing. We do not currently have outside investors with influence over data or product decisions.

What you can verify

Trust signals that are useful only if you can check them yourself:

Our installer is signed; right-click the MSI -> Properties -> Digital Signatures should show MeliUX Ltd.
Our network egress endpoints are listed at /it-policy for IT teams to allow-list.
Our vulnerability disclosure policy and security.txt are at /security and /.well-known/security.txt.
Our sub-processor list is at /sub-processors.
Our privacy policy with the full retention schedule is at /privacy.

Questions or pushback

If your IT team needs a security memo, security questionnaire, or vendor-risk-assessment response, email trust@alladdin.dev and we'll reply within two business days. We've answered most of the common ones already; we maintain a template that we'll send back filled in for your firm's questionnaire.

If you spot something on this page that doesn't match what AllAddin actually does, please tell us -- that's exactly the kind of feedback that improves this page. trust@alladdin.dev.