Security and data
Stored in the EU, encrypted, and never used to train public AI models.
3RD runs on AWS and Google Cloud in EU regions, encrypts your data at rest and in transit, and keeps it out of public AI training. Our policies, the data processing agreement, and the full list of sub-processors are in the trust center.
Send this page to your security team.
At a glance
How we protect your data
Hosting
AWS (Frankfurt, Ireland) and Google Cloud (Belgium, Finland, Netherlands), in EU regions. The infrastructure is defined as code, so every configuration can be audited.
Encryption
AES-256 at rest, including backups and logs. TLS 1.2 or higher in transit. Keys are managed in AWS KMS and Google Cloud KMS, and rotated regularly.
Access
Sign in with Google or Microsoft, with MFA available on every account. Our staff need MFA for production systems and hardware keys for privileged access. Access is role-based, on least privilege.
Logging and monitoring
Every access to customer data is logged, and the logs are kept for at least 12 months. The infrastructure is monitored around the clock, with real-time security alerts.
Backups
Daily encrypted backups, stored in separate locations, with point-in-time recovery for the last 7 days. Disaster recovery is tested every year.
Testing
An independent penetration test every year, weekly vulnerability scans, and security checks on every code change. Critical vulnerabilities are patched within 7 days.
AI and your data
How AI models handle your data
Read the full AI Transparency & Use Policy in the trust center.
- No training on your data. We don't use your data to train public AI models, and it's never shared between customers.
- Which models. 3RD's analysis uses models from OpenAI, Anthropic, and Google. These providers process data in the USA.
- Short retention. Most requests are deleted as soon as they're processed. Some providers keep requests for up to 30 days for abuse monitoring.
- You stay in control. You can override any AI output, and nothing 3RD Agent drafts goes live without your approval.
Uptime and support
What we commit to
| Pro | Agency | Enterprise | |
|---|---|---|---|
| Monthly uptime | 99.5% | 99.7% | 99.9% |
| Response to critical issues (P1) | 4 hours | 2 hours | 1 hour, 24/7 |
| Response to high-priority issues (P2) | 8 hours | 4 hours | 2 hours |
| Support hours | Weekdays, 9:00–17:00 CET | Weekdays, 8:00–20:00 CET, plus weekend emergencies | 24/7 for critical and high-priority issues |
| Phone support (callback) | – | ✓ | ✓ |
| Dedicated Slack channel and account manager | – | – | ✓ |
Live status at status.get3rd.com. Full terms in the Service Level Agreement.
Documents
Everything your legal and security teams will ask for
All of it is in the trust center.
Data Processing Agreement
GDPR terms, for every customer.
Sub-processors
Every provider, what it does, and where it processes data.
Security measures
Our technical and organizational measures, in detail.
AI Transparency & Use
How AI is used in 3RD, and how it isn't.
Data export and the EU Data Act
How to take all your data with you.
SLA and Enterprise addendum
Uptime, support, and enterprise terms.
FAQ
Questions security teams ask
Are you SOC 2 or ISO 27001 certified?
Not yet. Our controls are based on the ISO 27001 framework and follow SOC 2 Type II principles, and we're working toward both certifications. Agency and Enterprise customers can get the documentation on request.
Do you support SAML single sign-on?
Your team signs in with Google or Microsoft accounts, with MFA. SAML single sign-on can be set up for Enterprise customers by agreement.
Where is our data stored?
On AWS and Google Cloud, in EU regions. The AI analysis runs through OpenAI, Anthropic, and Google, which process data in the USA under GDPR safeguards such as Standard Contractual Clauses.
Is our data used to train AI?
No. We don't use your data to train public AI models, and it's never shared between customers.
Can we get a DPA or a penetration test summary?
The DPA is in the trust center and covers every customer. Agency and Enterprise customers can request the latest penetration test summary from security@get3rd.com.
What happens if there's a security incident?
Affected customers hear from us within 4 hours and get a full post-mortem within 7 days. Personal data breaches are reported within 72 hours, as GDPR requires.
How do we report a vulnerability?
Email security@get3rd.com. We confirm receipt within 2 business days, and we never take legal action against good-faith security research.
Security
Send this page to your security team.
Everything they need is in the trust center. If something's missing, email security@get3rd.com and we'll answer directly.