Snapshot 185078
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Inspect security controls and audit evidence for every Bird platform. Filter certificates, independent audit reports, and subprocessor disclosures by the exact Bird platform you are evaluating, and download confidential evidence under NDA. Browse documentsExplore our security Your security review, in one place. Select a platform to view its current attestations and validity dates, or sign in with your work email to accept the NDA and download gated audit reports. How document access works Security & privacy Standards you recognize. Explore security assurance and privacy frameworks. Review the documents below for current status and platform coverage. Security assurance ISO/IEC 27001:2022 SOC 2 SOC 3 Privacy & data protection GDPR UK GDPR CCPA CPRA HIPAA EU–US DPF UK Extension to the EU–US DPF PDPA PIPEDA Standard Contractual Clauses Evidence, with context Filter reports and certificates by platform. Browse public and gated security documentation, with explicit platform scope, issue dates, and audit validity windows on every record. Documents Bird Platform Confidential documents Sign in to download confidential reports. We’ll ask you to review confidentiality terms if needed. Sign in to access Select shown Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Security overview Bird Platform · Email (SparkPost) · Connectivity · Bird Box (CRM) · Pusher · Taxi for Email · eDataSource · 24sessions Sign in Audit report Bird Platform · Connectivity Sign in Penetration test Bird Platform Sign in Compliance Independent assessments for the selected platform. An assessment in progress is not a certification. No published assessments for this platform yet. How we protect your data Security, at every layer. Bird’s security program combines technical safeguards, staff training and ongoing risk assessment to protect customer data. Explore our general practices below, then use the documents for your selected platform to review service-specific details and certification coverage. Security governance Our security and compliance teams work with engineering and operations to maintain security policies and assess risk. Internal assessments and a risk register guide mitigation work, with senior management reviewing audit findings and security risks. Infrastructure and physical security Bird uses cloud infrastructure from Amazon Web Services and Google Cloud Platform, with separate development, staging and production environments. Our Data Processing Agreement describes the physical and organizational safeguards, including policies for remote work. Encryption We encrypt customer data at rest and use TLS to protect sensitive information in transit over public networks. Access control Access to internal systems follows job responsibilities and the principle of least privilege. We use role-based access controls, single sign-on and multi-factor authentication, review access regularly, and revoke access when employees leave. Application security Secure coding practices, code reviews and a formal change management process support application development. We commission third-party penetration tests annually and develop remediation plans for critical and high-severity findings. Platform-specific test reports describe the systems and assessment period covered. Monitoring We collect and protect audit logs and use a security information and event management (SIEM) tool to monitor our network and systems continuously. Security tools help us identify suspicious activity and deviations from established configurations. Endpoint security Disk encryption protects data stored on company endpoints. Anti-malware and threat detection tools help protect endpoints and relevant production servers, with routine updates to keep those protections current. People security Employees and contractors complete security and data protection training when they join Bird and annually thereafter. Employee confidentiality agreements and ongoing awareness programs reinforce their responsibilities for handling sensitive information. Incident response Our incident management process defines how security events are reported, investigated and resolved. We track incidents through recovery and communicate with the relevant parties. Customer notification follows our breach notification procedure and the applicable agreement. Business continuity Backup and recovery procedures support systems that store sensitive customer data. Business continuity and disaster recovery plans guide service restoration after an outage. Our public status page provides service updates that you can subscribe to. Privacy Our Data Processing Agreement and privacy statement explain how we handle personal data and the responsibilities of Bird and our customers. We follow customer instructions for data retention and deletion, subject to applicable legal retention requirements. Vendor management We assess third-party vendors against security requirements. Our published subprocessor list identifies providers that process customer data, their role and processing locations. You can subscribe to notifications when that list changes. Read our Data Processing Agreement Here to help Common security review questions. Learn how NDA-gated downloads work, how platform scopes are separated, and how to verify control coverage. Evidence for your security review Start with Bird Platform, or select the platform your organization uses. Each published document and attestation lists its own scope. An assessment for one platform does not establish certification for another. Use the document revision, validity dates and audit period when evaluating evidence. An assessment marked in progress has not been achieved. If current evidence is unavailable, ask your account team before relying on a certification claim. What is Bird Platform? Bird Platform is the current Bird platform for customer communications, bringing messaging channels and customer data into one platform. Choose Bird Platform when reviewing that product. Certifications for a legacy platform do not automatically cover Bird Platform. What do the other platform names mean? Email (SparkPost) covers the email platform, including SparkPost email delivery. Connectivity refers to the communications APIs used for services such as SMS, voice and numbers. Bird Box and CRM are the same platform, listed as Bird Box (CRM). Taxi for Email has its own platform selection. Check the scope on each document before using it for your review. Pusher provides realtime messaging through Channels and push notifications through Beams. eDataSource provides email intelligence and deliverability tools. 24sessions provides video calling services. If you are unsure which platform your agreement covers, ask your Bird account team. Which certifications cover my platform? Read the scope and effective status of each attestation below. Only a current attestation covering your selected platform supports a current claim. Missing or unavailable evidence does not establish that a platform is certified. How do I open confidential documents? Select a document and sign in with your Bird account. Verify your email address and accept the current confidentiality agreement. You can read its exact text before agreeing. Confidential distribution may be temporarily unavailable. Do existing customers need another NDA? Yes. Customers and prospects must accept the current Trust Center NDA before downloading confidential documents. You can reuse that acceptance across documents. How do I return to my documents? Sign in with the same verified account. Acceptance of the current confidentiality terms can be reused across documents. When Bird publishes a new NDA version, you must review and accept it before their next confidential download. Access can still be withdrawn. Check validity dates even when an older document remains available. Where can I report a security issue? Use Bird’s responsible disclosure program on HackerOne to report a vulnerability. The security contact is also published in bird.com/.well-known/security.txt. For a vendor questionnaire or platform-specific scope question, contact your Bird account team. Our service providers Subprocessors by platform Review who processes data for each service, their role and processing locations. The list below comes from Bird’s approved subprocessor policy. Approved Subprocessors Last updated: 4 September 2026 End-user personal data is processed by Bird as a processor on behalf of the customer for the provision of the services. The below entities act as subprocessors on behalf of Bird. Subscribe to receive notifications when subprocessors change. All platforms Platform Service Name Subprocessor Name Subprocessor Function Processing Location All platforms All services Bird Affiliates Performance of the Agreement, support services The Netherlands, UK, USA All platforms All services Anthropic Ireland Ltd. (end-user data optional) Customer Support AI LLM Service Provider USA Bird platform Service Name Subprocessor Name Subprocessor Function Processing Location All services Amazon Web Services EMEA SARL Cloud Hosting Service Provider As determined by customer All services Not Just Tickets Ltd (Plain) (optional Subprocessor) Internal Customer Support Ticketing System UK Email Amazon Web Services EMEA SARL Cloud Hosting Service Provider USA, Ireland (optional, as selected by customer) SMS Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium SMS ClickHouse Inc. Analytics Database Service Provider Ireland SMS Svix Inc. Webhook Delivery Infrastructure Provider Ireland WhatsApp for Business WhatsApp Ireland Limited WhatsApp for Business Service Provider USA Voice See All services See All services See All services Realtime (Mobile Push) See All services See All services See All services RCS Google Ireland Limited Provision of Google RCS Business Messaging (RBM) services EU RCS Vibes Media, LLC Provision of Rich Communication Services (RCS) - US & CAN only USA Numbers Microsoft Azure Cloud Hosting Service Provider The Netherlands, Hong Kong, USA Video See All services See All services See All services Video LiveKit Inc. (optional) Conduit processing of video and audio streams Global (close-to-customer, carrier peering and geo-spreading) Workflows See All services See All services See All services Connectors See All services See All services See All services Omnichannel Widget See All services See All services See All services Contacts See All services See All services See All services Conversation Channels See All services See All services See All services Engagement Platform Service Name Subprocessor Name Subprocessor Function Processing Location Inbox Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Email Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) SMS Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) SMS Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium SMS Clickhouse Inc. Analytics Data Base Service Provider Ireland Voice Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) and Germany, Singapore, Australia, Brazil, USA Numbers Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Numbers Microsoft Azure Cloud Hosting Service Provider The Netherlands, Hong Kong, USA WhatsApp for Business Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) WhatsApp for Business WhatsApp Ireland Limited Provision of, WhatsApp for, Business services USA RCS Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) RCS Google Ireland Limited by means of their subsidiary Jibe Mobile Ltd. Provision of, Google Business, Messages (RCS), services EU Conversation Channels Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Mobile Push Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Video Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Video LiveKit Inc. (optional) Conduit processing of video and audio streams Global (close-to-customer, carrier peering and geo-spreading) Workflows Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Connectors Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Omnichannel Widget Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Contacts Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Payments Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Expenses Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, India, USA (as selected by customer) Email platform Service Name Subprocessor Name Subprocessor Function Processing Location Cloud Email Sending Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland (optional), USA Recipient Validation Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland (optional), USA Inbox Tracker These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird Competitive Tracker These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird PowerMTA These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird Momentum These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird Taxi These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird These Email Services do not require processing of personal data by Bird Connectivity platform Service Name Subprocessor Name Subprocessor Function Processing Location SMS Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium SMS Clickhouse Inc. Analytics Data Base Service Provider Ireland Voice Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium, Singapore, UK, USA Numbers Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium Numbers Microsoft Azure Cloud Hosting Service Provider The Netherlands, Hong Kong, USA Contacts Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium WhatsApp for Business Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium WhatsApp for Business WhatsApp Ireland Limited Provision of, WhatsApp for, Business services EU and USA Google RCS Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium Google RCS Google Ireland Limited by means, of their subsidiary Jibe Mobile Ltd. Provision of, Google Business, Messages (RCS), services EU Conversation Channels Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium, Germany Omnichannel Widget Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium Omnichannel platform (Pusher, 24sessions and Telserv) Service Name Subprocessor Name Subprocessor Function Processing Location Push Channels & Beams (Pusher) Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, Australia, Brazil, Japan, Singapore, South Korea, India, UK, USA Push Channels & Beams (Pusher) Sentry Error monitoring USA Push Channels & Beams (Pusher) Postmark Dashboard - Log management and Analysis software USA Video (24sessions) Amazon Web Services EMEA SARL Cloud Hosting Service Provider Ireland, Germany Video (24sessions) Digital Ocean Turn Server provider The Netherlands Video (24sessions) Flowmailer Email Service Provider The Netherlands Video (24sessions) Luzmo In-app dashboard provider Ireland Video (24sessions) Hubper (optional) Online Learning Academy The Netherlands Video (24sessions) Google Cloud EMEA Limited (optional) Speech to text conversion Global Video (24sessions) Twilio (optional) Recorded dial-in, SMS, Phone number verification Global Numbers (Telserv) Google Cloud EMEA Limited Cloud Hosting Service Provider The Netherlands, Belgium Numbers (Telserv) Microsoft Azure Cloud Hosting Service Provider The Netherlands, Hong Kong, USA Read the full subprocessor policy More ways to get the details. Start building with Bird in minutes. Get StartedContact Sales