# Bird Trust Center Explore how we protect your data. Find the security documents, independent assessments and answers you need to evaluate Bird. Platform: Bird Platform ## Evidence for your security review Start with Bird Platform, or select the platform your organization uses. Each published document and attestation lists its own scope. An assessment for one platform does not establish certification for another. Use the document revision, validity dates and audit period when evaluating evidence. An assessment marked in progress has not been achieved. If current evidence is unavailable, ask your account team before relying on a certification claim. ## Security controls and contractual scope Explore the safeguards described in our Data Processing Agreement. These commitments apply to services covered by that agreement. The platform-specific certificates and reports above define their own scope. ## Infrastructure and physical security The Data Processing Agreement describes administrative, technical, organizational and physical safeguards, including a teleworking policy for remote work. Use the platform-specific security overview for architecture and hosting details. ## Encryption The Data Processing Agreement describes protection of personal data in storage and transit, including encryption at rest and TLS in transit. Check the agreement and service scope relevant to your review. ## Access control The Data Processing Agreement describes need-to-know and least-privilege access, role-based controls, security oversight of provisioning, and regular access reviews. ## Application security Bird’s published security program addresses security threats and vulnerabilities. Review the penetration-test evidence for the platform and revision under evaluation; a report covers its stated scope and assessment period. ## Monitoring The Data Processing Agreement describes centrally stored audit logs, regular monitoring for security events, and protection against tampering. ## Incident response Bird’s Incident Management Policy sets out its incident response procedures, as described in the Data Processing Agreement. Contractual notification obligations depend on the applicable agreement. ## Business continuity The Data Processing Agreement describes preparation for extended outages and restoration of services. Consult the applicable service commitments for recovery requirements. ## Privacy The Data Processing Agreement and privacy statement describe data-processing responsibilities and safeguards. The applicable terms determine their scope. ## Vendor management Bird publishes its subprocessors and a procedure for subscribing to changes. The Data Processing Agreement describes confidentiality obligations for employees, contractors, vendors and subprocessors. ## What is Bird Platform? Bird Platform is the current Bird platform for customer communications, bringing messaging channels and customer data into one platform. Choose Bird Platform when reviewing that product. Certifications for a legacy platform do not automatically cover Bird Platform. ## What do the other platform names mean? Email (SparkPost) covers the email platform, including SparkPost email delivery. Connectivity refers to the communications APIs used for services such as SMS, voice and numbers. Bird Box and CRM are the same platform, listed as Bird Box (CRM). Taxi for Email has its own platform selection. Check the scope on each document before using it for your review. Pusher provides realtime messaging through Channels and push notifications through Beams. eDataSource provides email intelligence and deliverability tools. 24sessions provides video calling services. If you are unsure which platform your agreement covers, ask your Bird account team. ## Which certifications cover my platform? Read the scope and effective status of each attestation below. Only a current attestation covering your selected platform supports a current claim. Missing or unavailable evidence does not establish that a platform is certified. ## How do I open confidential documents? Select a document and sign in with your Bird account. Verify your email address and accept the current confidentiality agreement. You can read its exact text before agreeing. Confidential distribution may be temporarily unavailable. ## Do existing customers need another NDA? Yes. Customers and prospects must accept the current Trust Center NDA before downloading confidential documents. You can reuse that acceptance across documents. ## How do I return to my documents? Sign in with the same verified account. Acceptance of the current confidentiality terms can be reused across documents. When Bird publishes a new NDA version, you must review and accept it before their next confidential download. Access can still be withdrawn. Check validity dates even when an older document remains available. ## Where can I report a security issue? Use Bird’s responsible disclosure program on HackerOne to report a vulnerability. The security contact is also published in bird.com/.well-known/security.txt. For a vendor questionnaire or platform-specific scope question, contact your Bird account team. ## Attestations No published attestations are listed for this platform. ## Documents ### Bird Platform pentest attestation letter Attestation letter from Blaze Information Security for the manual penetration test of Bird Platform, performed in production from June 25th 2026, and finishing on July 1st 2026, including the retest results. Platforms: Bird Platform Category: penetration_test; visibility: gated Revision: 1 Issued: 2026-09-10T00:00:00Z Validity: current [Open document](https://bird.com/trust?platform=bird_platform&document=bp-pentest-attestation-letter) Source checked: 2026-10-06T02:26:40.175Z ## Related resources [Data Processing Agreement](/legal/dpa) [Privacy statement](/legal/privacy) [Subprocessors](/legal/subprocessors) [Responsible disclosure](https://hackerone.com/messagebird) [Service status](/status) ## Subprocessors **Approved Subprocessors** **Last updated: 4 September 2026** End-user personal data is processed by Bird as a processor on behalf of the customer for the provision of the services. The below entities act as subprocessors on behalf of Bird. [Subscribe](https://messagebird.com/support-center/KB-Notification) to receive notifications when subprocessors change. ## All platforms | Platform | Service Name | Subprocessor Name | Subprocessor Function | Processing Location | | ------------- | ------------ | ----------------------------------------------------- | ---------------------------------------------- | ------------------------ | | All platforms | All services | [Bird Affiliates](/legal/terms#15-contracting-entity) | Performance of the Agreement, support services | The Netherlands, UK, USA | | All platforms | All services | Anthropic Ireland Ltd. (end-user data optional) | Customer Support AI LLM Service Provider | USA | ## Bird platform | Service Name | Subprocessor Name | Subprocessor Function | Processing Location | | ---------------------- | ---------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------------- | | All services | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | As determined by customer | | All services | Not Just Tickets Ltd (Plain) (optional Subprocessor) | Internal Customer Support Ticketing System | UK | | Email | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | USA, Ireland (optional, as selected by customer) | | SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | SMS | ClickHouse Inc. | Analytics Database Service Provider | Ireland | | SMS | Svix Inc. | Webhook Delivery Infrastructure Provider | Ireland | | WhatsApp for Business | WhatsApp Ireland Limited | WhatsApp for Business Service Provider | USA | | Voice | See All services | See All services | See All services | | Realtime (Mobile Push) | See All services | See All services | See All services | | RCS | Google Ireland Limited | Provision of Google RCS Business Messaging (RBM) services | EU | | RCS | Vibes Media, LLC | Provision of Rich Communication Services (RCS) - US & CAN only | USA | | Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA | | Video | See All services | See All services | See All services | | Video | LiveKit Inc. (optional) | Conduit processing of video and audio streams | Global (close-to-customer, carrier peering and geo-spreading) | | Workflows | See All services | See All services | See All services | | Connectors | See All services | See All services | See All services | | Omnichannel Widget | See All services | See All services | See All services | | Contacts | See All services | See All services | See All services | | Conversation Channels | See All services | See All services | See All services | ## Engagement Platform | Service Name | Subprocessor Name | Subprocessor Function | Processing Location | | --------------------- | -------------------------------------------------------------------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | Inbox | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Email | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | SMS | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | SMS | Clickhouse Inc. | Analytics Data Base Service Provider | Ireland | | Voice | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) and Germany, Singapore, Australia, Brazil, USA | | Numbers | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA | | WhatsApp for Business | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | WhatsApp for Business | WhatsApp Ireland Limited | Provision of, WhatsApp for, Business services | USA | | RCS | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | RCS | Google Ireland Limited by means of their subsidiary Jibe Mobile Ltd. | Provision of, Google Business, Messages (RCS), services | EU | | Conversation Channels | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Mobile Push | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Video | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Video | LiveKit Inc. (optional) | Conduit processing of video and audio streams | Global (close-to-customer, carrier peering and geo-spreading) | | Workflows | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Connectors | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Omnichannel Widget | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Contacts | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Payments | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | | Expenses | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | ## Email platform | Service Name | Subprocessor Name | Subprocessor Function | Processing Location | | -------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------- | | Cloud Email Sending | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland (optional), USA | | Recipient Validation | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland (optional), USA | | Inbox Tracker | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | | Competitive Tracker | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | | PowerMTA | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | | Momentum | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | | Taxi | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | ## Connectivity platform | Service Name | Subprocessor Name | Subprocessor Function | Processing Location | | --------------------- | --------------------------------------------------------------------- | ------------------------------------------------------- | -------------------------------------------- | | SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | SMS | Clickhouse Inc. | Analytics Data Base Service Provider | Ireland | | Voice | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium, Singapore, UK, USA | | Numbers | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA | | Contacts | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | WhatsApp for Business | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | WhatsApp for Business | WhatsApp Ireland Limited | Provision of, WhatsApp for, Business services | EU and USA | | Google RCS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | Google RCS | Google Ireland Limited by means, of their subsidiary Jibe Mobile Ltd. | Provision of, Google Business, Messages (RCS), services | EU | | Conversation Channels | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium, Germany | | Omnichannel Widget | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | ## Omnichannel platform (Pusher, 24sessions and Telserv) | Service Name | Subprocessor Name | Subprocessor Function | Processing Location | | ------------------------------ | ------------------------------------ | ------------------------------------------------ | ------------------------------------------------------------------------- | | Push Channels & Beams (Pusher) | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, Australia, Brazil, Japan, Singapore, South Korea, India, UK, USA | | Push Channels & Beams (Pusher) | Sentry | Error monitoring | USA | | Push Channels & Beams (Pusher) | Postmark | Dashboard - Log management and Analysis software | USA | | Video (24sessions) | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, Germany | | Video (24sessions) | Digital Ocean | Turn Server provider | The Netherlands | | Video (24sessions) | Flowmailer | Email Service Provider | The Netherlands | | Video (24sessions) | Luzmo | In-app dashboard provider | Ireland | | Video (24sessions) | Hubper (optional) | Online Learning Academy | The Netherlands | | Video (24sessions) | Google Cloud EMEA Limited (optional) | Speech to text conversion | Global | | Video (24sessions) | Twilio (optional) | Recorded dial-in, SMS, Phone number verification | Global | | Numbers (Telserv) | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium | | Numbers (Telserv) | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |