# Security How 3RD protects your data: stored in the EU, encrypted at rest and in transit, and never used to train public AI models. Visit the trust center Talk to sales Security and data Stored in the EU, encrypted, and never used to train public AI models. never used to train public AI models 3RD runs on AWS and Google Cloud in EU regions, encrypts your data at rest and in transit, and keeps it out of public AI training. Our policies, the data processing agreement, and the full list of sub-processors are in the trust center. Send this page to your security team. Hosting AWS (Frankfurt, Ireland) and Google Cloud (Belgium, Finland, Netherlands), in EU regions. The infrastructure is defined as code, so every configuration can be audited. Encryption AES-256 at rest, including backups and logs. TLS 1.2 or higher in transit. Keys are managed in AWS KMS and Google Cloud KMS, and rotated regularly. Access Sign in with Google or Microsoft, with MFA available on every account. Our staff need MFA for production systems and hardware keys for privileged access. Access is role-based, on least privilege. Logging and monitoring Every access to customer data is logged, and the logs are kept for at least 12 months. The infrastructure is monitored around the clock, with real-time security alerts. Backups Daily encrypted backups, stored in separate locations, with point-in-time recovery for the last 7 days. Disaster recovery is tested every year. Testing An independent penetration test every year, weekly vulnerability scans, and security checks on every code change. Critical vulnerabilities are patched within 7 days. At a glance How we protect your data No training on your data. We don't use your data to train public AI models, and it's never shared between customers. Which models. 3RD's analysis uses models from OpenAI, Anthropic, and Google. These providers process data in the USA. Short retention. Most requests are deleted as soon as they're processed. Some providers keep requests for up to 30 days for abuse monitoring. You stay in control. You can override any AI output, and nothing 3RD Agent drafts goes live without your approval. AI and your data How AI models handle your data Read the full [AI Transparency & Use Policy](https://trust.get3rd.com/en/ai) in the trust center. Pro Agency Enterprise Monthly uptime 99.5% 99.7% 99.9% Response to critical issues (P1) 4 hours 2 hours 1 hour, 24/7 Response to high-priority issues (P2) 8 hours 4 hours 2 hours Support hours Weekdays, 9:00–17:00 CET Weekdays, 8:00–20:00 CET, plus weekend emergencies 24/7 for critical and high-priority issues Phone support (callback) – ✓ ✓ Dedicated Slack channel and account manager – – ✓ Uptime and support What we commit to Live status at [status.get3rd.com](https://status.get3rd.com). Full terms in the [Service Level Agreement](https://trust.get3rd.com/en/sla). Data Processing Agreement GDPR terms, for every customer. Sub-processors Every provider, what it does, and where it processes data. Security measures Our technical and organizational measures, in detail. AI Transparency & Use How AI is used in 3RD, and how it isn't. Data export and the EU Data Act How to take all your data with you. SLA and Enterprise addendum Uptime, support, and enterprise terms. Documents Everything your legal and security teams will ask for All of it is in the [trust center](https://trust.get3rd.com). Are you SOC 2 or ISO 27001 certified? Not yet. Our controls are based on the ISO 27001 framework and follow SOC 2 Type II principles, and we're working toward both certifications. Agency and Enterprise customers can get the documentation on request. Do you support SAML single sign-on? Your team signs in with Google or Microsoft accounts, with MFA. SAML single sign-on can be set up for Enterprise customers by agreement. Where is our data stored? On AWS and Google Cloud, in EU regions. The AI analysis runs through OpenAI, Anthropic, and Google, which process data in the USA under GDPR safeguards such as Standard Contractual Clauses. Is our data used to train AI? No. We don't use your data to train public AI models, and it's never shared between customers. Can we get a DPA or a penetration test summary? The DPA is in the trust center and covers every customer. Agency and Enterprise customers can request the latest penetration test summary from security@get3rd.com. What happens if there's a security incident? Affected customers hear from us within 4 hours and get a full post-mortem within 7 days. Personal data breaches are reported within 72 hours, as GDPR requires. How do we report a vulnerability? Email security@get3rd.com. We confirm receipt within 2 business days, and we never take legal action against good-faith security research. FAQ Questions security teams ask Check your visibility for free Everything they need is in the trust center. If something's missing, email security@get3rd.com and we'll answer directly.