Trust Center
Security and data protection at Three Horizons Capital
How we host, protect and process our clients' data, who processes it for us, and how to request our security and data protection documents.
Who we are
Three Horizons Capital (Ventures) Limited is an Irish company (company no. 781799). We provide a research and analytics platform to investment firms. We operate it as a fully managed service: clients do not run or install any infrastructure.
Data protection law: the EU General Data Protection Regulation and the Irish Data Protection Act 2018, and the UK GDPR for personal data of people in the UK. Our supervisory authority is the Data Protection Commission, Ireland.
Hosting and security
Hosting
All client data is stored and processed on Google Cloud, in the us-central1 region (Iowa, United States).
Encryption
TLS in transit. AES-256 at rest on our database, storage and data warehouse.
Access
Production access is limited to named staff with individual accounts. No shared accounts. Our client-facing service runs under its own least-privilege identity.
Logging
Every administrative action on our cloud environment is logged and kept for 400 days.
AI processing
We use Anthropic's Claude models under Anthropic's commercial terms. Anthropic does not train its models on our inputs or outputs.
Breach notification
We notify affected clients within 48 hours of becoming aware of a personal data breach that affects their data.
Certifications
Three Horizons Capital does not hold its own ISO 27001 certificate or SOC 2 report. Our infrastructure providers hold their own independent certifications:
- Google Cloud: SOC 1, SOC 2 and SOC 3 reports; ISO 27001, 27017, 27018 and 27701; PCI DSS. Google Cloud compliance offerings
- Anthropic: SOC 2 Type II; ISO 27001; ISO 42001. Anthropic Trust Center
These reports belong to the providers and are available from them, under NDA where they require it.
Subprocessors
These companies process client data for us. We give clients advance notice of any change to this list.
| Subprocessor | Service | Location | Transfer basis |
|---|---|---|---|
| Google Cloud — Google Cloud EMEA Limited, Ireland (contracting entity); infrastructure of Google LLC, USA | Hosting (Cloud Run), database (Firestore), object storage, data warehouse (BigQuery), logging, task scheduling | USA — us-central1 region (Iowa); BigQuery US multi-region | Contract with an Irish entity, so 3HC's transfer to Google stays in the EEA. Google's onward transfers: SCCs (EU) 2021/914 Module 3 (Processor-to-Processor, Google Exporter) in the Cloud Data Processing Addendum, or Google's Alternative Transfer Solution where it applies. Google LLC: EU-US Data Privacy Framework, UK Extension and Swiss-US, all active (re-certification due 2027-09-13) |
| Google Workspace — Google Cloud EMEA Limited, Ireland | The mailbox for the platform's email channel | Wherever Google or its subprocessors maintain facilities; Google Cloud EMEA Limited is the contracting entity | As Google Cloud: the Workspace "Data Processing Amendment" is now the same Cloud Data Processing Addendum |
| Anthropic — Anthropic Ireland, Limited (contracting entity for customers in the EEA, Commercial Terms); processing in the USA | AI model processing (Messages API); managed analysis environment (Managed Agents) | USA | Anthropic Data Processing Addendum: SCCs (EU) 2021/914 Module 2 and/or Module 3, as applicable, and UK Addendum, incorporated by reference. Not in the EU-US Data Privacy Framework (participant list searched 2026-10-21: no result) |
| Microsoft Azure — only for clients of the separate document-intelligence product | Document text extraction (AI Document Intelligence; stores inputs and results for 24 hours, then deletes them), language-model extraction (Azure OpenAI), matching (Azure AI Search), hosting (Container Apps) | Azure, EU/US regions as configured for each client | Microsoft Products and Services Data Protection Addendum: SCCs (EU) 2021/914 processor-to-processor module (Microsoft Ireland Operations Limited and Microsoft Corporation); UK IDTA. Microsoft Corporation: EU-US Data Privacy Framework, UK Extension and Swiss-US, all active (re-certification due 2027-08-31) |
Microsoft Azure processes documents only for clients of our separate document-intelligence product.
Transfers to the United States are covered by the European Commission's Standard Contractual Clauses in each provider's data processing terms. Google LLC is also certified under the EU-US Data Privacy Framework.
Request documents
The following documents are available to clients and prospective clients on request:
- Information security summary
- Data Processing Agreement (Art. 28 GDPR), with technical and organisational measures
- GDPR documentation: data protection policy, breach procedure, data subject rights procedure, retention schedule, subprocessor register, transfer impact assessment
Email privacy@threehorizonscapital.com with your company name and the documents you need.
Three Horizons Capital (Ventures) Limited · Ireland · company no. 781799 · Privacy policy · Last updated 23 October 2026