Security

Last updated: August 29, 2026

How Tree Down Media works — context first

Tree Down Media isn't a login on somebody else's shared platform. We run our clients' workspaces on our own private deployment of the CRM — one system, operated by us, on cloud accounts we control. Your workspace lives inside that deployment alongside our other clients' workspaces, each one sealed off from the others. Everything below describes how that deployment protects the data inside it.

Security claims are easy to make and hard to check. This page explains, in specific terms, how Tree Down Media protects the data inside it — the architecture, the defaults, and, honestly, the parts that are your responsibility as a user.

1. Built on best-in-class managed services

Tree Down Media does not run on hand-managed servers. Data storage, payments, and hosting are each delegated to best-in-class managed cloud platforms — the same infrastructure providers trusted by banks, healthcare companies, and Fortune 500 enterprises.

That means there is:

• No exposed database. The data layer has no open port, no connection string to leak, and no direct network access. It is reachable only through authenticated, permission-checked paths.
• No card data in the platform, ever. Payments are processed end-to-end by a certified payment provider (PCI DSS Level 1). Card numbers never touch Tree Down Media's code or database — and when your customers pay you through the platform, the money settles directly into your own payment account.
• Managed patching. The infrastructure providers manage the operating systems, networks, and runtimes underneath the data and payment layers — security updates are their job, applied continuously.

The most common causes of real-world data leaks — unpatched servers, exposed database ports, default credentials — are not risks this architecture merely mitigates. They are categories of mistake that cannot happen, because the components they apply to don't exist here.

2. Fail-closed by default

A fair question about any software that holds your customer list: “what if something is set up wrong?” The answer here is that the platform is designed to fail closed:

• The database denies all access by default. Access rules must be explicitly deployed before anything can be read — a skipped setup step produces a broken feature, not exposed data.
• Sign-up is locked. There is no open registration: every user is explicitly invited into a specific workspace, at a specific role, by someone already authorized to do so.
• Optional features ship off and must be deliberately enabled per workspace.

In other words: the failure mode of an incomplete or incorrect setup is an app that doesn't work yet — not an app that leaks.

3. Workspace isolation, enforced three times

Each client workspace holds its own contacts, deals, conversations, and records. Isolation between workspaces is enforced at three independent layers, so a failure in any one layer is caught by the others:

1. Database-level security rules — every read and write is checked against the caller's verified workspace membership, at the data layer itself, before any data moves.
2. Server-side permission checks — every API endpoint independently re-verifies the caller's identity, role, and workspace membership from their authenticated session. Nothing is trusted from the browser.
3. Record-level re-anchoring — whenever one record references another (a deal's contact, a task's owner), the platform re-verifies the referenced record belongs to the same workspace before acting. A crafted or mistaken ID cannot reach another workspace's data.

4. Roles and access control

• Authentication uses secure, signed session cookies managed by an enterprise-grade identity service — not home-rolled password handling.
• Access is role-based: workspace administrators and collaborators each see and do only what their role allows. As the operator, Tree Down Media holds administrative access to the workspaces it runs — that's how we run them, and our Privacy Policy describes it plainly.
• Feature availability is controlled per workspace — a workspace cannot switch on capabilities it hasn't been granted.
• Removing a member takes effect immediately: their access is revoked, their sessions are invalidated, and their sign-in is disabled if they hold no other access.

5. Secrets and credentials

• The codebase ships with zero embedded credentials. Every service key is stored in the hosting platform's encrypted configuration — never in source code.
• API keys are stored as one-way cryptographic hashes only. The full key is shown exactly once at creation. Even a complete copy of the database cannot recover a working key.
• Keys are revocable and scoped: each API key belongs to one workspace and can only ever see that workspace's data.
• Secrets are masked in logs, so an accidental debug line can't leak a credential.

6. Public links that can't be forged

Some pages are deliberately public — a quote sent to a customer, a booking page, an unsubscribe link, a payment link. Every one of them is protected by a cryptographically signed token:

• Tokens are signed (HMAC) and cannot be guessed or forged.
• Only a one-way hash of each token is stored — the working link exists solely in the recipient's email.
• Re-sending rotates the token, which instantly invalidates every older copy of the link.

7. Verified integrations

Every inbound webhook — payment events, inbound messages, call events, scheduled jobs — is signature-verified before a single byte is processed. A request that doesn't carry a valid cryptographic signature from the expected service is rejected. There is no unauthenticated write path into the platform. Outbound webhooks are signed too, so your own integrations can verify that events genuinely came from your workspace.

8. AI, with a human in the loop

Tree Down Media includes AI assistants and AI conversation agents. They are governed by strict, structural limits:

• The assistant can only invoke a fixed, audited list of capabilities — it has no general access to the database and no way to compose its own queries.
• No AI action can modify data without a human explicitly confirming it first. Reads run instantly; every write requires a click.
• Every AI capability is anchored to the caller's own workspace, and an automated check runs on every code change to enforce that rule — it is a build failure, not a code-review hope.
• Every AI action — proposed, executed, or failed — is written to an append-only audit trail.

9. A private deployment — a smaller blast radius

On a traditional SaaS platform, thousands of companies' data sits in one shared system, and a single breach exposes everyone. Your workspace instead lives in Tree Down Media's own private deployment, which holds only our clients' data, on accounts we control. Your data is not pooled with a stranger's, is not mined or resold, and can be exported by you — or deleted at your request — at any time.

10. No black box

Perhaps the most important difference: Tree Down Media is not renting a black box and neither are you. We hold the complete source code of the platform we operate, so every claim on this page is verifiable by reading it — by us, or by any security professional of your choosing. Closed platforms ask for trust; this one can be audited.

11. What's on you (honesty matters)

No architecture removes every responsibility. The platform's security assumes you and your team will:

• Use strong, unique passwords for your workspace logins — and never share one login between two people (invites are free and unlimited; ask and we'll send one).
• Tell us when someone leaves your team, so their access is revoked the same day.
• Protect the accounts you connect — your payment account, your social pages, your domain — with two-factor authentication where it's offered.

These are the same obligations you'd have with any business software — including big-name SaaS, where your team's passwords are just as much the weakest link.

12. Reporting a security concern

If you believe you've found a vulnerability, we want to hear about it — please report it privately rather than publicly, so it can be fixed before details circulate. Email hello@treedownmedia.com and we'll take it from there. Good-faith reports are always welcome and never punished.