Penetration test
Bird Platform
Bird Trust Center
Explore how we protect your data. Find the security documents, independent assessments and answers you need to evaluate Bird.
Evidence, with context
Certificates, reports and security documentation. Each item lists the platforms and dates it covers.
Confidential documents
Sign in to download confidential reports. We’ll ask you to review confidentiality terms if needed.
Penetration test
Bird Platform
How we protect your data
Explore the safeguards described in our Data Processing Agreement. These commitments apply to services covered by that agreement. The platform-specific certificates and reports above define their own scope.
The Data Processing Agreement describes administrative, technical, organizational and physical safeguards, including a teleworking policy for remote work. Use the platform-specific security overview for architecture and hosting details.
The Data Processing Agreement describes protection of personal data in storage and transit, including encryption at rest and TLS in transit. Check the agreement and service scope relevant to your review.
The Data Processing Agreement describes need-to-know and least-privilege access, role-based controls, security oversight of provisioning, and regular access reviews.
Bird’s published security program addresses security threats and vulnerabilities. Review the penetration-test evidence for the platform and revision under evaluation; a report covers its stated scope and assessment period.
The Data Processing Agreement describes centrally stored audit logs, regular monitoring for security events, and protection against tampering.
Bird’s Incident Management Policy sets out its incident response procedures, as described in the Data Processing Agreement. Contractual notification obligations depend on the applicable agreement.
The Data Processing Agreement describes preparation for extended outages and restoration of services. Consult the applicable service commitments for recovery requirements.
The Data Processing Agreement and privacy statement describe data-processing responsibilities and safeguards. The applicable terms determine their scope.
Bird publishes its subprocessors and a procedure for subscribing to changes. The Data Processing Agreement describes confidentiality obligations for employees, contractors, vendors and subprocessors.
Here to help
Get the right evidence and understand how access works.
Start with Bird Platform, or select the platform your organization uses. Each published document and attestation lists its own scope. An assessment for one platform does not establish certification for another.
Use the document revision, validity dates and audit period when evaluating evidence. An assessment marked in progress has not been achieved. If current evidence is unavailable, ask your account team before relying on a certification claim.
Bird Platform is the current Bird platform for customer communications, bringing messaging channels and customer data into one platform. Choose Bird Platform when reviewing that product. Certifications for a legacy platform do not automatically cover Bird Platform.
Email (SparkPost) covers the email platform, including SparkPost email delivery. Connectivity refers to the communications APIs used for services such as SMS, voice and numbers.
Bird Box and CRM are the same platform, listed as Bird Box (CRM). Taxi for Email has its own platform selection. Check the scope on each document before using it for your review.
Pusher provides realtime messaging through Channels and push notifications through Beams. eDataSource provides email intelligence and deliverability tools. 24sessions provides video calling services. If you are unsure which platform your agreement covers, ask your Bird account team.
Read the scope and effective status of each attestation below. Only a current attestation covering your selected platform supports a current claim. Missing or unavailable evidence does not establish that a platform is certified.
Select a document and sign in with your Bird account. Verify your email address and accept the current confidentiality agreement. You can read its exact text before agreeing. Confidential distribution may be temporarily unavailable.
Yes. Customers and prospects must accept the current Trust Center NDA before downloading confidential documents. You can reuse that acceptance across documents.
Sign in with the same verified account. Acceptance of the current confidentiality terms can be reused across documents. When Bird publishes a new NDA version, you must review and accept it before their next confidential download. Access can still be withdrawn. Check validity dates even when an older document remains available.
Use Bird’s responsible disclosure program on HackerOne to report a vulnerability. The security contact is also published in bird.com/.well-known/security.txt. For a vendor questionnaire or platform-specific scope question, contact your Bird account team.
Our service providers
Review who processes data for each service, their role and processing locations. The list below comes from Bird’s approved subprocessor policy.
Approved Subprocessors
Last updated: 4 September 2026
End-user personal data is processed by Bird as a processor on behalf of the customer for the provision of the services. The below entities act as subprocessors on behalf of Bird.
Subscribe to receive notifications when subprocessors change.
| Platform | Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|---|
| All platforms | All services | Bird Affiliates | Performance of the Agreement, support services | The Netherlands, UK, USA |
| All platforms | All services | Anthropic Ireland Ltd. (end-user data optional) | Customer Support AI LLM Service Provider | USA |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| All services | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | As determined by customer |
| All services | Not Just Tickets Ltd (Plain) (optional Subprocessor) | Internal Customer Support Ticketing System | UK |
| Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | USA, Ireland (optional, as selected by customer) | |
| SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| SMS | ClickHouse Inc. | Analytics Database Service Provider | Ireland |
| SMS | Svix Inc. | Webhook Delivery Infrastructure Provider | Ireland |
| WhatsApp for Business | WhatsApp Ireland Limited | WhatsApp for Business Service Provider | USA |
| Voice | See All services | See All services | See All services |
| Realtime (Mobile Push) | See All services | See All services | See All services |
| RCS | Google Ireland Limited | Provision of Google RCS Business Messaging (RBM) services | EU |
| RCS | Vibes Media, LLC | Provision of Rich Communication Services (RCS) - US & CAN only | USA |
| Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |
| Video | See All services | See All services | See All services |
| Video | LiveKit Inc. (optional) | Conduit processing of video and audio streams | Global (close-to-customer, carrier peering and geo-spreading) |
| Workflows | See All services | See All services | See All services |
| Connectors | See All services | See All services | See All services |
| Omnichannel Widget | See All services | See All services | See All services |
| Contacts | See All services | See All services | See All services |
| Conversation Channels | See All services | See All services | See All services |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| Inbox | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | |
| SMS | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| SMS | Clickhouse Inc. | Analytics Data Base Service Provider | Ireland |
| Voice | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) and Germany, Singapore, Australia, Brazil, USA |
| Numbers | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |
| WhatsApp for Business | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| WhatsApp for Business | WhatsApp Ireland Limited | Provision of, WhatsApp for, Business services | USA |
| RCS | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| RCS | Google Ireland Limited by means of their subsidiary Jibe Mobile Ltd. | Provision of, Google Business, Messages (RCS), services | EU |
| Conversation Channels | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Mobile Push | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Video | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Video | LiveKit Inc. (optional) | Conduit processing of video and audio streams | Global (close-to-customer, carrier peering and geo-spreading) |
| Workflows | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Connectors | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Omnichannel Widget | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Contacts | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Payments | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Expenses | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| Cloud Email Sending | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland (optional), USA |
| Recipient Validation | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland (optional), USA |
| Inbox Tracker | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Competitive Tracker | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| PowerMTA | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Momentum | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Taxi | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| SMS | Clickhouse Inc. | Analytics Data Base Service Provider | Ireland |
| Voice | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium, Singapore, UK, USA |
| Numbers | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |
| Contacts | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| WhatsApp for Business | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| WhatsApp for Business | WhatsApp Ireland Limited | Provision of, WhatsApp for, Business services | EU and USA |
| Google RCS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Google RCS | Google Ireland Limited by means, of their subsidiary Jibe Mobile Ltd. | Provision of, Google Business, Messages (RCS), services | EU |
| Conversation Channels | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium, Germany |
| Omnichannel Widget | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| Push Channels & Beams (Pusher) | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, Australia, Brazil, Japan, Singapore, South Korea, India, UK, USA |
| Push Channels & Beams (Pusher) | Sentry | Error monitoring | USA |
| Push Channels & Beams (Pusher) | Postmark | Dashboard - Log management and Analysis software | USA |
| Video (24sessions) | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, Germany |
| Video (24sessions) | Digital Ocean | Turn Server provider | The Netherlands |
| Video (24sessions) | Flowmailer | Email Service Provider | The Netherlands |
| Video (24sessions) | Luzmo | In-app dashboard provider | Ireland |
| Video (24sessions) | Hubper (optional) | Online Learning Academy | The Netherlands |
| Video (24sessions) | Google Cloud EMEA Limited (optional) | Speech to text conversion | Global |
| Video (24sessions) | Twilio (optional) | Recorded dial-in, SMS, Phone number verification | Global |
| Numbers (Telserv) | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Numbers (Telserv) | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |