Trust & Security

Last updated: 7 October 2026 - Version 0.4 - Operated by MeliUX Ltd. Looking to report a security issue? See our disclosure policy.

Why this page exists. AllAddin runs inside Revit, on machines holding billable client work. Architects and engineers are personally liable for that work. Before you install us, you should be able to answer three questions in plain language: what leaves your machine, what protects what stays, and what happens when you uninstall. This page answers those, with sources you can verify yourself.

Signed installerAuthenticode

ISO 27001ISMS drafted

UK GDPRICO registered

DPAPI tokensper-user encryption

UK-basedMeliUX Ltd - 12413967

Processing regions: EU (our backend databases and servers in the Netherlands, Mistral, Sentry, Cloudflare R2 share-link and detail-library storage), US (Anthropic, and a replica of our production web service in Virginia), under SCCs / UK IDTA. MeliUX Ltd is UK-registered -- that's where the company is, not where your data sits. See the sub-processor register.

1. What leaves your machine

AllAddin sends the smallest amount of data that lets the AI help you. Two columns: what travels, what doesn't.

Sent to our backend

The natural-language question you typed.
The Revit version, language pack, and active view name.
A small structured summary of the active selection (category and family/type names with counts -- not geometry).
The generated code, its error text and what it printed, when the AI fixes an error or summarises a result. Printed output can include values the script read from your model.
Pseudonymous usage telemetry (request timing, model used; linked to your account, and the project reference is a one-way hash, not a name).
The prompt, generated code, and outcome of a completed turn are submitted to our improvement corpus. This is on by default. Turn it off with share_tricks = false under [privacy] in %APPDATA%\AllAddin\alladd.ini -- see the privacy notice.
Requests that fix an error, summarise a result or tag a failure can be processed by Mistral (France, EU) instead of Anthropic. Keynote suggestions send element and keynote descriptions to Mistral to compute search embeddings. Mistral keeps none of it (zero-data-retention for our account) and does not train on it.
What a feature you use needs: room data sheet export and import, dashboard narration and Excel export, compliance checks (the EIR document, the model title and element names), procurement records and rule libraries. The privacy notice lists what each sends and how long we keep it.

Stays on your machine

Your .rvt / .rfa / .rte files.
Your model geometry, except inside a share link you publish (section 8).
Family library contents and shared parameters.
In chat requests, your file path, document title, worksharing username, and project name/number -- redacted by default before each request leaves (from v0.8.10; admins can manage this via [privacy] in alladd.ini). A compliance check sends the model title with the EIR it checks.

Share links. If you choose to publish a share link (a feature you trigger by hand), a snapshot of the dashboard data you selected -- which can include parameter values, schedule and sheet content, and 3D geometry (included by default) -- is uploaded so a recipient can open it in a browser. It is encrypted on your machine first and stored as ciphertext only. Section 8 explains exactly how.

2. Encryption

In transit. TLS 1.2+ on every connection between AllAddin and our backend. HSTS enforced via the Railway edge plus an application-layer fallback.
Tokens at rest. Your authentication token is encrypted with Windows DPAPI in the user-scope, so only the Windows account that pasted it can decrypt it. A stolen alladd.ini on a different machine is useless.
Server-side. Database is managed Postgres on Railway (EU, Netherlands) with provider-level encryption at rest. Crash reports go to Sentry's EU (Germany) ingest with send_default_pii = False, user identity stripped, and report text sanitised -- sent automatically on a crash so we can fix what broke.
AI providers. We use Anthropic (US) and Mistral (France, EU) as sub-processors (section 1 says which requests each handles); their data-processing agreements are linked from that page. Both run on zero-data-retention for our account -- they keep nothing after returning the response -- and neither trains on your content.

3. Safeguards around generated code

Generated code runs inside Revit on your machine, like any Revit add-in, behind layered safeguards:

Checked before it runs. Generated C# is screened for blocked APIs (file system, network, process control, code loading, the registry and AllAddin's own internals) before it compiles. A rejected script never runs; the AI writes a version without it.
Undoable changes. Model changes go through Revit transactions, each one an Undo step. When Revit reports an error, that transaction is rolled back.
Signed extensions. Marketplace extensions are signed, and AllAddin installs them only with a valid signature.

As with any tool that edits your model, review what a request will change before you run it on a model that matters, and keep backups.

4. Compliance posture

UK GDPR. MeliUX Ltd is registered with the UK Information Commissioner's Office (ICO registration ZC137214). We are the data controller; processing details are in the privacy policy and the sub-processor list.

ISO 27001:2022. Our Information Security Management System (ISMS) is documented: a master register tracks 54 artefacts (51 in draft, the rest scaffolded) -- 13 ISMS management documents (including a Statement of Applicability mapping all 93 Annex A controls), 16 information-security policies, 7 UK GDPR / DPA 2018 artefacts, 4 MeliUX-specific policies, a customer contract-clause library, and 12 live records. Certification is not yet in progress -- this is honest drafted-not-certified status. We surface the work because it shapes how we operate today, not because we're claiming a certificate we don't have.

SOC 2. Not yet on roadmap; revisit once ISO 27001 certification is in motion and we have a US-customer pull demanding it.

5. Ongoing security testing

Dynamic application security testing (DAST). OWASP ZAP baseline scan against our staging environment, weekly. Findings are reviewed by hand.
Static analysis (SAST). Semgrep + Bandit, weekly and on demand. Patterns covering injection, secrets, dangerous APIs.
Software composition analysis (SCA). Trivy + pip-audit, weekly and on demand. GitHub Dependabot keeps our build pipeline's actions up to date.
Secret scanning. gitleaks on every pull request, and weekly across the repository.
Security assessment. An internal security assessment ran in August 2026; its fixes shipped by 30 September 2026. An independent third-party penetration test is not yet scheduled.

6. Uninstalling

The MSI uninstaller is the standard Programs and Features entry. It removes:

The AllAddin program files and Revit add-in manifests (%APPDATA%\Autodesk\Revit\Addins\<version>\).
The Authenticode publisher trust entry (only if it was added by us; we don't touch the Windows trust store otherwise).

It keeps your settings and data, so a reinstall picks up where you left off: %APPDATA%\AllAddin\ (including alladd.ini with your encrypted sign-in token), %LOCALAPPDATA%\AllAddin\, and a few values under HKCU\SOFTWARE\AllAddin. To remove those too, delete the two folders and the registry key, or ask us for the cleanup script at trust@alladdin.dev.

AllAddin installs no scheduled tasks, Windows services or background processes.

7. What we won't do

We won't let your data train AI models. Your content is contractually excluded from model training with both of our AI providers (Anthropic and Mistral).
We won't sell or share your data with advertisers. AllAddin is not ad-supported. Sub-processors are listed at /sub-processors and the list is contractually bounded.
We won't read your model contents. Model data reaches our backend only through the requests and features listed in section 1, to do what you asked. A share link is encrypted on your machine first and stored as ciphertext only. See section 8.
We won't auto-update without your knowledge. AllAddin checks for updates while Revit runs and asks before installing one when Revit closes, unless you chose silent updates. The chat interface's web files update in the background; they are signed and verified before use.
We won't survive on dark patterns. Uninstall is a standard MSI uninstall. We don't email you "win-back" campaigns.

AllAddin can publish a frozen snapshot of a dashboard workspace to a link anyone can open in a browser -- no Revit, no login. It is the one way AllAddin hands model data to someone outside it, so here is exactly how it is handled.

Encrypted on your machine first. The workspace is AES-256-GCM encrypted on your device with a one-off key before it is uploaded. The plaintext never leaves your machine.
Stored as ciphertext only. The encrypted blob is held in an EU-jurisdiction Cloudflare R2 bucket. The storage provider only ever sees ciphertext, and the key is not stored alongside it, so no single provider holds both the key and the data.
Unguessable, revocable, expiring. The link carries a 192-bit random id, defaults to a 30-day expiry, and you can revoke it at any time -- revoking hard-deletes the stored blob. You can also add an optional password.
Honest limit: this is not zero-knowledge. To let a recipient open a link, our backend hands the decryption key to their browser, which means we could technically decrypt a shared workspace. So this is strong client-side encryption, in transit and at rest -- not end-to-end / zero-knowledge encryption. If you need a mode where even we cannot decrypt, tell us; we can offer it.

9. Who we are

AllAddin is built by MeliUX Ltd, a UK limited company registered in England and Wales (Companies House number 12413967), based in southeast London, operated by Rene Pellicer Garcia. The founder has been a Revit user since 2008 and a member of the Autodesk Expert Elite program since 2015. He also co-authored, as subject matter expert, Pearson VUE's Revit professional certification exam in 2018.

We are venture-unbacked at the time of writing. We do not currently have outside investors with influence over data or product decisions.

What you can verify

Trust signals that are useful only if you can check them yourself:

Our installer is signed; right-click the MSI -> Properties -> Digital Signatures should show MeliUX Ltd.
Our network egress endpoints are listed at /it-policy for IT teams to allow-list.
Our vulnerability disclosure policy and security.txt are at /security and /.well-known/security.txt.
Our sub-processor list is at /sub-processors.
Our privacy policy with the full retention schedule is at /privacy.

Questions or pushback

If your IT team needs a security memo, security questionnaire, or vendor-risk-assessment response, email trust@alladdin.dev and we'll reply within two business days. We've answered most of the common ones already; we maintain a template that we'll send back filled in for your firm's questionnaire.

If you spot something on this page that doesn't match what AllAddin actually does, please tell us -- that's exactly the kind of feedback that improves this page. trust@alladdin.dev.