Bird Trust Center

Trust starts with
a closer look.

Explore how we protect your data. Find the security documents, independent assessments and answers you need to evaluate Bird.

Evidence, with context

Built for your review.

Certificates, reports and security documentation. Each item lists the platforms and dates it covers.

Documents

Bird Platform

Confidential documents

Sign in to download confidential reports. We’ll ask you to review confidentiality terms if needed.

Sign in to access

Penetration test

Bird Platform

Sign in

How we protect your data

Security, at every layer.

Explore the safeguards described in our Data Processing Agreement. These commitments apply to services covered by that agreement. The platform-specific certificates and reports above define their own scope.

Infrastructure and physical security

The Data Processing Agreement describes administrative, technical, organizational and physical safeguards, including a teleworking policy for remote work. Use the platform-specific security overview for architecture and hosting details.

Encryption

The Data Processing Agreement describes protection of personal data in storage and transit, including encryption at rest and TLS in transit. Check the agreement and service scope relevant to your review.

Access control

The Data Processing Agreement describes need-to-know and least-privilege access, role-based controls, security oversight of provisioning, and regular access reviews.

Application security

Bird’s published security program addresses security threats and vulnerabilities. Review the penetration-test evidence for the platform and revision under evaluation; a report covers its stated scope and assessment period.

Monitoring

The Data Processing Agreement describes centrally stored audit logs, regular monitoring for security events, and protection against tampering.

Incident response

Bird’s Incident Management Policy sets out its incident response procedures, as described in the Data Processing Agreement. Contractual notification obligations depend on the applicable agreement.

Business continuity

The Data Processing Agreement describes preparation for extended outages and restoration of services. Consult the applicable service commitments for recovery requirements.

Privacy

The Data Processing Agreement and privacy statement describe data-processing responsibilities and safeguards. The applicable terms determine their scope.

Vendor management

Bird publishes its subprocessors and a procedure for subscribing to changes. The Data Processing Agreement describes confidentiality obligations for employees, contractors, vendors and subprocessors.

Read our Data Processing Agreement

Here to help

A few common questions.

Get the right evidence and understand how access works.

Evidence for your security review

Start with Bird Platform, or select the platform your organization uses. Each published document and attestation lists its own scope. An assessment for one platform does not establish certification for another.

Use the document revision, validity dates and audit period when evaluating evidence. An assessment marked in progress has not been achieved. If current evidence is unavailable, ask your account team before relying on a certification claim.

What is Bird Platform?

Bird Platform is the current Bird platform for customer communications, bringing messaging channels and customer data into one platform. Choose Bird Platform when reviewing that product. Certifications for a legacy platform do not automatically cover Bird Platform.

What do the other platform names mean?

Email (SparkPost) covers the email platform, including SparkPost email delivery. Connectivity refers to the communications APIs used for services such as SMS, voice and numbers.

Bird Box and CRM are the same platform, listed as Bird Box (CRM). Taxi for Email has its own platform selection. Check the scope on each document before using it for your review.

Pusher provides realtime messaging through Channels and push notifications through Beams. eDataSource provides email intelligence and deliverability tools. 24sessions provides video calling services. If you are unsure which platform your agreement covers, ask your Bird account team.

Which certifications cover my platform?

Read the scope and effective status of each attestation below. Only a current attestation covering your selected platform supports a current claim. Missing or unavailable evidence does not establish that a platform is certified.

How do I open confidential documents?

Select a document and sign in with your Bird account. Verify your email address and accept the current confidentiality agreement. You can read its exact text before agreeing. Confidential distribution may be temporarily unavailable.

Do existing customers need another NDA?

Yes. Customers and prospects must accept the current Trust Center NDA before downloading confidential documents. You can reuse that acceptance across documents.

How do I return to my documents?

Sign in with the same verified account. Acceptance of the current confidentiality terms can be reused across documents. When Bird publishes a new NDA version, you must review and accept it before their next confidential download. Access can still be withdrawn. Check validity dates even when an older document remains available.

Where can I report a security issue?

Use Bird’s responsible disclosure program on HackerOne to report a vulnerability. The security contact is also published in bird.com/.well-known/security.txt. For a vendor questionnaire or platform-specific scope question, contact your Bird account team.

Our service providers

Subprocessors by platform

Review who processes data for each service, their role and processing locations. The list below comes from Bird’s approved subprocessor policy.

Approved Subprocessors

Last updated: 4 September 2026

End-user personal data is processed by Bird as a processor on behalf of the customer for the provision of the services. The below entities act as subprocessors on behalf of Bird.

Subscribe to receive notifications when subprocessors change.

All platforms
PlatformService NameSubprocessor NameSubprocessor FunctionProcessing Location
All platformsAll servicesBird AffiliatesPerformance of the Agreement, support servicesThe Netherlands, UK, USA
All platformsAll servicesAnthropic Ireland Ltd. (end-user data optional)Customer Support AI LLM Service ProviderUSA
Bird platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
All servicesAmazon Web Services EMEA SARLCloud Hosting Service ProviderAs determined by customer
All servicesNot Just Tickets Ltd (Plain) (optional Subprocessor)Internal Customer Support Ticketing SystemUK
EmailAmazon Web Services EMEA SARLCloud Hosting Service ProviderUSA, Ireland (optional, as selected by customer)
SMSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
SMSClickHouse Inc.Analytics Database Service ProviderIreland
SMSSvix Inc.Webhook Delivery Infrastructure ProviderIreland
WhatsApp for BusinessWhatsApp Ireland LimitedWhatsApp for Business Service ProviderUSA
VoiceSee All servicesSee All servicesSee All services
Realtime (Mobile Push)See All servicesSee All servicesSee All services
RCSGoogle Ireland LimitedProvision of Google RCS Business Messaging (RBM) servicesEU
RCSVibes Media, LLCProvision of Rich Communication Services (RCS) - US & CAN onlyUSA
NumbersMicrosoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
VideoSee All servicesSee All servicesSee All services
VideoLiveKit Inc. (optional)Conduit processing of video and audio streamsGlobal (close-to-customer, carrier peering and geo-spreading)
WorkflowsSee All servicesSee All servicesSee All services
ConnectorsSee All servicesSee All servicesSee All services
Omnichannel WidgetSee All servicesSee All servicesSee All services
ContactsSee All servicesSee All servicesSee All services
Conversation ChannelsSee All servicesSee All servicesSee All services
Engagement Platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
InboxAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
EmailAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
SMSAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
SMSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
SMSClickhouse Inc.Analytics Data Base Service ProviderIreland
VoiceAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer) and Germany, Singapore, Australia, Brazil, USA
NumbersAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
NumbersMicrosoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
WhatsApp for BusinessAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
WhatsApp for BusinessWhatsApp Ireland LimitedProvision of, WhatsApp for, Business servicesUSA
RCSAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
RCSGoogle Ireland Limited by means of their subsidiary Jibe Mobile Ltd.Provision of, Google Business, Messages (RCS), servicesEU
Conversation ChannelsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
Mobile PushAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
VideoAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
VideoLiveKit Inc. (optional)Conduit processing of video and audio streamsGlobal (close-to-customer, carrier peering and geo-spreading)
WorkflowsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
ConnectorsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
Omnichannel WidgetAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
ContactsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
PaymentsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
ExpensesAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
Email platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
Cloud Email SendingAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland (optional), USA
Recipient ValidationAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland (optional), USA
Inbox TrackerThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
Competitive TrackerThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
PowerMTAThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
MomentumThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
TaxiThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
Connectivity platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
SMSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
SMSClickhouse Inc.Analytics Data Base Service ProviderIreland
VoiceGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium, Singapore, UK, USA
NumbersGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
NumbersMicrosoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
ContactsGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
WhatsApp for BusinessGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
WhatsApp for BusinessWhatsApp Ireland LimitedProvision of, WhatsApp for, Business servicesEU and USA
Google RCSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
Google RCSGoogle Ireland Limited by means, of their subsidiary Jibe Mobile Ltd.Provision of, Google Business, Messages (RCS), servicesEU
Conversation ChannelsGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium, Germany
Omnichannel WidgetGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
Omnichannel platform (Pusher, 24sessions and Telserv)
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
Push Channels & Beams (Pusher)Amazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, Australia, Brazil, Japan, Singapore, South Korea, India, UK, USA
Push Channels & Beams (Pusher)SentryError monitoringUSA
Push Channels & Beams (Pusher)PostmarkDashboard - Log management and Analysis softwareUSA
Video (24sessions)Amazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, Germany
Video (24sessions)Digital OceanTurn Server providerThe Netherlands
Video (24sessions)FlowmailerEmail Service ProviderThe Netherlands
Video (24sessions)LuzmoIn-app dashboard providerIreland
Video (24sessions)Hubper (optional)Online Learning AcademyThe Netherlands
Video (24sessions)Google Cloud EMEA Limited (optional)Speech to text conversionGlobal
Video (24sessions)Twilio (optional)Recorded dial-in, SMS, Phone number verificationGlobal
Numbers (Telserv)Google Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
Numbers (Telserv)Microsoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
Read the full subprocessor policy

More ways to get the details.

Your next idea.
Ready to connect.