Privacy policy
ThreeHat is a compliance, privacy and security workspace operated by Epic Technologies, LLC ("we") for authorized users of participating organizations. This policy explains what ThreeHat collects, how it is used, and the choices you have.
Information we collect
- Account and sign-in information: your email address, sign-in times, IP address, approximate location (city, region and country, as reported by our hosting provider), and browser type. We use it to control access and to keep an activity log.
- Work you enter: questions, notes, vendors, incidents and drafts you create are saved in your own browser on your device. They are not stored on our servers.
- Connected accounts (optional): if you connect a Google or Microsoft account, ThreeHat requests read-only access to email and files. ThreeHat reads an email conversation or a file only when you choose it. We store an encrypted access token so the connection keeps working; we do not store your email or file contents.
- Activity log: a record of sign-ins, sign-outs, administrative changes, and each read of connected email, files or Google Vault: who, what action, when, and from where. By default, email subjects, file names and search words are not recorded.
How we use information
- To sign you in, keep your session secure, and let administrators manage access.
- To show you the email or file you selected and, if you ask, send its text to the AI service so Hattie can review it and draft a response.
- To keep an audit record that administrators of your organization can review.
We do not sell personal information, use it for advertising, or use it to build profiles. We do not use data from your connected accounts to develop, improve or train generalized artificial intelligence or machine learning models.
Google user data
ThreeHat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Scopes requested: read-only Gmail (
gmail.readonly), read-only Google Drive (drive.readonly), and your email address. - Google data is used only to show you the items you select and to provide the review you request. It is not transferred to others except the AI service you invoke for that review, as described below, or as required by law.
- No person at Epic Technologies, LLC reads your Google data unless you ask us to for support, it is needed for security or legal reasons, or the data has been aggregated and anonymized.
AI processing
When you ask Hattie to review something, the relevant text is sent to Anthropic's API to generate the answer. Anthropic's commercial terms govern that processing; Anthropic deletes API inputs and outputs within 30 days unless a separate agreement says otherwise. If the content looks like protected health information or other sensitive personal information, ThreeHat asks you to confirm that your organization's business associate agreement covers it before sending.
Service providers
- Cloudflare: hosting, sign-in and encrypted storage of access tokens and the activity log.
- Google and Microsoft: only if you connect an account from them.
- Anthropic: AI processing when you request it.
Retention and deletion
- Disconnect an account any time in ThreeHat (Help, Connected accounts). Its token is deleted and, for Google, revoked. You can also remove access at myaccount.google.com/permissions.
- Work saved in your browser stays on your device until you clear it; ThreeHat's Sign out offers to remove it.
- Activity log entries are kept for the period your organization sets, to support audits.
Security
Access requires an administrator-approved sign-in. Connections use encryption in transit; access tokens are encrypted at rest; administrators can end any session immediately.
Your choices and contact
To ask about, access or delete your information, contact chris.walters@trudiagnostic.com. If ThreeHat is provided to you by your employer, your organization's administrator may also manage your account.
Changes
We will post updates here and change the effective date. Material changes affecting Google user data will be communicated before they take effect.