Privacy & Security
Treams adheres to the highest standards in the field of security and privacy. We know how important it is to handle your employees’ information securely.
Trusted by HR teams across the Netherlands
Where we start.
ISO27001 certified
Audited every year against the ISO/IEC 27001 standard by an external party. The certificate and the statement of applicability are available on request.
Secure AI
Our AI is trained on our beliefs about performance, so you can trust it is aligned with your vision. It runs inside a European AWS region, it never trains on your data, and it only ever suggests.
EU data hosting
Your data is stored and processed on Amazon Web Services in Ireland. All sub-processors sit inside the European Economic Area.
Performance data is what people said when they trusted the room.
ISO 27001 certified
Treams is ISO 27001 certified. That matters less as a badge than as a habit: it means information security is built into how we work every day, not reviewed once a year in a panic. Our Information Security Management System is actively managed by our Security Officer. We keep track of risks, improvements, incidents and any change that could affect the security of customer and employee data. An external party audits us against the standard annually. On request, we share the certificate, the statement of applicability, and further security documentation.
Secure AI
AI in Treams is optional, and it never decides anything. It runs on Anthropic Claude through Amazon Bedrock, inside a European AWS region. Your data is never used to train or improve the model, and never shared with other users of it. What comes out is a suggestion. The manager reads it, changes it, and decides what to keep. That is deliberate: performance management is human work.
EU data hosting
Production data in Treams is stored and processed on Amazon Web Services, in the Ireland region. All data in the platform stays inside the European Economic Area, and so does the data held by our sub-processors. If that ever changed, it would only happen under a transfer mechanism the GDPR allows, and we would tell you which one and why.
Sub-processors
Treams uses a small number of carefully selected sub-processors, for hosting, storage, support, product features and payment processing. Every one is bound in writing to at least the same level of protection we owe you. Our register lists, per sub-processor, what it is used for, which data it processes, where that data sits and how long it is kept. We tell you before we add or replace one, and you can object.
The details
Forward this section to IT. It is written for them.
All traffic is encrypted with TLS 1.2 or 1.3. Disk encryption on every machine with access to data or source code. Access runs through AWS IAM on least privilege, tables are separated by workspace, and logs are kept 90 days at most.
A full back-up is created daily, stored encrypted with Amazon Web Services, and kept for seven days. We can test a restore with you on request. We target 99.9% availability.
An external party runs a penetration test at least once a year, and the results are available on request. Critical components are reviewed as part of development, and functionality is tested in a staging environment holding no personal data.
Incidents and threats are logged and analysed, and what we learn goes back into the policy. If a breach affects you, we notify you within 12 hours, with the full picture within 24.
Everyone at Treams takes part in a security awareness programme. Developers are tested on their knowledge and complete a trial assignment before they are hired. Our Security Officer owns the management system, day to day.
When the agreement ends, we return your data within 30 days in a structured format, or you retrieve it yourself. Remaining copies and back-ups are destroyed within 90 days. Found a vulnerability? See our responsible disclosure policy.
What our
clients say.
Ready to see it
for yourself?
How does Treams handle backups and availability?
We use encrypted backups to support the availability and recoverability of the Treams platform. Backups are made daily and retained for a maximum of 7 days. We also continuously monitor the availability of the platform, so that we can respond promptly to any disruptions.
Where is our data stored and processed?
Treams uses carefully selected subprocessors for, among other things, hosting, storage, support, product features, and payment processing. The subprocessors page describes, for each subprocessor, the purpose for which it is used, what data is processed, where the data is stored, and the applicable retention period.
The primary hosting and processing of data in OnTreams takes place within Europe, including via Amazon Web Services and Microsoft Azure. The current list of subprocessors is available at: https://treams.com/hr-software/security-privacy/subverwerkers/
Is Treams ISO 27001 certified?
Yes. Treams is ISO 27001 certified. This demonstrates that information security is structurally embedded and part of our day-to-day way of working. Our Information Security Management System is actively managed by our Security Officer. We continuously monitor risks, areas for improvement, incidents, and changes relevant to the security of customer and employee data. Upon request, we can share the ISO 27001 certificate and additional security documentation.
How is access to Treams secured?
Treams supports Single Sign-On and two-factor authentication to prevent unwanted access to the system. In addition, Treams works with various roles and authorization levels. This allows a customer to determine which users have access to which parts and data within the platform.
Is customer data used for AI training?
No. Customer data processed via the AI functionality is, according to Treams, not used to train or improve the underlying AI model. The AI functionality is optional, only generates suggestions, and does not make independent decisions. The user remains responsible for reviewing and, if applicable, adopting AI output. Treams uses Anthropic Claude via AWS's Amazon Bedrock, with processing set up within a European AWS region.
Does Treams use AI to write evaluations?
No. Treams uses AI to surface insights and help managers prepare. Not to write evaluation text for them. The conversation stays human. AI supports the manager; it doesn't replace them.