Tree-Nation

Spain · tree-nation.com · 16 vendors

Tree-Nation is a digital platform that enables individuals and companies to plant trees worldwide to combat deforestation and climate change. It provides technological solutions, including virtual trees and online forests, to connect reforestation projects with sponsors and facilitate CO2 offsetting. The platform offers tools for tracking planted trees and managing environmental impact.

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 1 category; runs on 16 sub-vendors.

Insights

Last updated 2026-07-30 · revision 5

16 direct vendors, 249 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 4/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Tree-Nation's migration readiness is assessed as medium. While the company utilizes a modern PHP Laravel framework and a REST API architecture, there is no explicit mention of cloud-native principles, containerization (e.g., Docker, Kubernetes), or microservices. This suggests a potentially monolithic application that could require significant refactoring for optimal cloud migration, increasing complexity and cost. A major challenge for migration is the stringent regulatory environment, particularly GDPR, which is 'Assessment Required' and 'High Risk.' This, coupled with strict EU data residency requirements, will heavily influence cloud provider selection and migration strategy, necessitating robust data transfer agreements (SCCs/BCRs). The current 'Assessment Required' status for SOC2 and ISO 27001 also indicates a need to establish these controls, which would be a prerequisite or a major component of a secure and compliant migration. Financial stability, crucial for funding a potentially complex migration, cannot be assessed due to missing revenue data. Vendor lock-in risk is 'Unknown,' and the contradictory 'Total Vendors: 0' versus 'Total Services: 28' makes it difficult to ascertain the extent of current vendor dependencies. If there is reliance on a few key vendors for their services, migrating away could be challenging. Opportunities include the existing REST API architecture, which provides a foundation for potential modularization or integration with cloud services. However, the significant regulatory hurdles, unconfirmed cloud-native architecture, and unknown financial and vendor lock-in factors collectively place Tree-Nation in a medium readiness state for a smooth migration.

Compliance

3 in-scope frameworks identified; showing 3.

GDPR (source) — Assessment Required

GDPR applies with high certainty as Tree-Nation is headquartered in Spain (EU member state) and operates a digital platform that processes personal data of users, customers, and employees. Non-compliance risks include fines up to 4% of annual turnover or €20M. Given their technology platform business model, they likely process significant amounts of personal data including user accounts, payment information, and behavioral data. The risk is high due to the severity of GDPR penalties and the universal applicability to EU-based companies.

SOC 2 (source) — Assessment Required

SOC2 may be relevant as Tree-Nation operates a technology platform that likely processes customer data and may provide services to business clients. While not legally mandatory, SOC2 compliance is often expected by enterprise customers and partners for trust and security assurance. The risk is medium as non-compliance could impact business relationships and customer trust, but does not carry direct regulatory penalties.

ISO 27001 (source) — Assessment Required

ISO 27001 is relevant for any technology company handling personal or sensitive data, as it provides a framework for information security management. While not legally mandatory, it demonstrates security best practices and may be required by enterprise customers or partners. The risk is medium as lack of certification could impact business opportunities and customer trust, particularly in the EU where data protection is highly valued.

Financials

Three-year financials

Financial Resilience Score: 5/10

Tree-Nation operates an asset-light reforestation marketplace model that minimizes capex and operational risk by intermediating between corporate sponsors and on-the-ground NGOs rather than owning forests directly. The business benefits from structural tailwinds from EU CSRD reporting requirements driving corporate ESG demand, along with established brand recognition among European SME and tech-company buyers, and a diversified portfolio across approximately 30 countries that reduces single-project failure risk. However, as a small private Spanish SME (Tree-Nation S.L., Barcelona), the company likely has limited capital cushion and is reliant on continued sales growth and modest margins. The voluntary carbon market has faced significant volatility, particularly following 2023 press coverage by The Guardian regarding Verra-certified offsets, creating reputational headwinds across the industry. Additional risks include the EU Green Claims Directive potentially constraining customer marketing of tree-planting purchases, FX and country risk from operations in Madagascar, Kenya, Nicaragua, and Indonesia, and reliance on third-party MRV certification standards whose credibility has periodically come under scrutiny. Statutory financials were not retrievable in this session, limiting quantitative assessment. The midrange score reflects qualitative strengths balanced against SME-scale vulnerabilities and sector-wide reputational risks.

Key strengths: Asset-light platform model with limited capex, Structural tailwind from EU CSRD corporate ESG reporting requirements, Established brand recognition among European SME and tech-company ESG buyers, Diversified project portfolio across ~30 countries, Recurring B2B corporate subscription demand, API/e-commerce integrations (Shopify, WooCommerce) scaling B2B adoption

Risk factors: Voluntary carbon market volatility and reputational headwinds (Guardian/Verra coverage in 2023), Small private SME with limited capital cushion, EU Green Claims Directive and anti-greenwashing regulation tightening, FX and country risk from projects in Madagascar, Kenya, Nicaragua, Indonesia, etc., Reliance on third-party MRV certification standards with periodic credibility scrutiny, Concentration risk in voluntary carbon market certification ecosystem

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report