渗透测试
Bird Platform
附带上下文的证据
证书、报告和安全文档。每项均列出其覆盖的平台和有效日期。
我们如何保护您的数据
Bird’s security program combines technical safeguards, staff training and ongoing risk assessment to protect customer data. Explore our general practices below, then use the documents for your selected platform to review service-specific details and certification coverage.
Our security and compliance teams work with engineering and operations to maintain security policies and assess risk. Internal assessments and a risk register guide mitigation work, with senior management reviewing audit findings and security risks.
Bird uses cloud infrastructure from Amazon Web Services and Google Cloud Platform, with separate development, staging and production environments. Our Data Processing Agreement describes the physical and organizational safeguards, including policies for remote work.
We encrypt customer data at rest and use TLS to protect sensitive information in transit over public networks.
Access to internal systems follows job responsibilities and the principle of least privilege. We use role-based access controls, single sign-on and multi-factor authentication, review access regularly, and revoke access when employees leave.
Secure coding practices, code reviews and a formal change management process support application development. We commission third-party penetration tests annually and develop remediation plans for critical and high-severity findings. Platform-specific test reports describe the systems and assessment period covered.
We collect and protect audit logs and use a security information and event management (SIEM) tool to monitor our network and systems continuously. Security tools help us identify suspicious activity and deviations from established configurations.
Disk encryption protects data stored on company endpoints. Anti-malware and threat detection tools help protect endpoints and relevant production servers, with routine updates to keep those protections current.
Employees and contractors complete security and data protection training when they join Bird and annually thereafter. Employee confidentiality agreements and ongoing awareness programs reinforce their responsibilities for handling sensitive information.
Our incident management process defines how security events are reported, investigated and resolved. We track incidents through recovery and communicate with the relevant parties. Customer notification follows our breach notification procedure and the applicable agreement.
Backup and recovery procedures support systems that store sensitive customer data. Business continuity and disaster recovery plans guide service restoration after an outage. Our public status page provides service updates that you can subscribe to.
Our Data Processing Agreement and privacy statement explain how we handle personal data and the responsibilities of Bird and our customers. We follow customer instructions for data retention and deletion, subject to applicable legal retention requirements.
We assess third-party vendors against security requirements. Our published subprocessor list identifies providers that process customer data, their role and processing locations. You can subscribe to notifications when that list changes.
随时为您服务
获取所需凭证,了解访问机制。
Start with Bird Platform, or select the platform your organization uses. Each published document and attestation lists its own scope. An assessment for one platform does not establish certification for another.
Use the document revision, validity dates and audit period when evaluating evidence. An assessment marked in progress has not been achieved. If current evidence is unavailable, ask your account team before relying on a certification claim.
Bird Platform is the current Bird platform for customer communications, bringing messaging channels and customer data into one platform. Choose Bird Platform when reviewing that product. Certifications for a legacy platform do not automatically cover Bird Platform.
Email (SparkPost) covers the email platform, including SparkPost email delivery. Connectivity refers to the communications APIs used for services such as SMS, voice and numbers.
Bird Box and CRM are the same platform, listed as Bird Box (CRM). Taxi for Email has its own platform selection. Check the scope on each document before using it for your review.
Pusher provides realtime messaging through Channels and push notifications through Beams. eDataSource provides email intelligence and deliverability tools. 24sessions provides video calling services. If you are unsure which platform your agreement covers, ask your Bird account team.
Read the scope and effective status of each attestation below. Only a current attestation covering your selected platform supports a current claim. Missing or unavailable evidence does not establish that a platform is certified.
Select a document and sign in with your Bird account. Verify your email address and accept the current confidentiality agreement. You can read its exact text before agreeing. Confidential distribution may be temporarily unavailable.
Yes. Customers and prospects must accept the current Trust Center NDA before downloading confidential documents. You can reuse that acceptance across documents.
Sign in with the same verified account. Acceptance of the current confidentiality terms can be reused across documents. When Bird publishes a new NDA version, you must review and accept it before their next confidential download. Access can still be withdrawn. Check validity dates even when an older document remains available.
Use Bird’s responsible disclosure program on HackerOne to report a vulnerability. The security contact is also published in bird.com/.well-known/security.txt. For a vendor questionnaire or platform-specific scope question, contact your Bird account team.
我们的服务提供商
查看每项服务的数据处理方及其角色和处理地点。以下列表来自 Bird 批准的子处理者政策。
Approved Subprocessors
Last updated: 4 September 2026
End-user personal data is processed by Bird as a processor on behalf of the customer for the provision of the services. The below entities act as subprocessors on behalf of Bird.
Subscribe to receive notifications when subprocessors change.
| Platform | Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|---|
| All platforms | All services | Bird Affiliates | Performance of the Agreement, support services | The Netherlands, UK, USA |
| All platforms | All services | Anthropic Ireland Ltd. (end-user data optional) | Customer Support AI LLM Service Provider | USA |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| All services | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | As determined by customer |
| All services | Not Just Tickets Ltd (Plain) (optional Subprocessor) | Internal Customer Support Ticketing System | UK |
| Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | USA, Ireland (optional, as selected by customer) | |
| SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| SMS | ClickHouse Inc. | Analytics Database Service Provider | Ireland |
| SMS | Svix Inc. | Webhook Delivery Infrastructure Provider | Ireland |
| WhatsApp for Business | WhatsApp Ireland Limited | WhatsApp for Business Service Provider | USA |
| Voice | See All services | See All services | See All services |
| Realtime (Mobile Push) | See All services | See All services | See All services |
| RCS | Google Ireland Limited | Provision of Google RCS Business Messaging (RBM) services | EU |
| RCS | Vibes Media, LLC | Provision of Rich Communication Services (RCS) - US & CAN only | USA |
| Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |
| Video | See All services | See All services | See All services |
| Video | LiveKit Inc. (optional) | Conduit processing of video and audio streams | Global (close-to-customer, carrier peering and geo-spreading) |
| Workflows | See All services | See All services | See All services |
| Connectors | See All services | See All services | See All services |
| Omnichannel Widget | See All services | See All services | See All services |
| Contacts | See All services | See All services | See All services |
| Conversation Channels | See All services | See All services | See All services |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| Inbox | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) | |
| SMS | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| SMS | Clickhouse Inc. | Analytics Data Base Service Provider | Ireland |
| Voice | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) and Germany, Singapore, Australia, Brazil, USA |
| Numbers | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |
| WhatsApp for Business | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| WhatsApp for Business | WhatsApp Ireland Limited | Provision of, WhatsApp for, Business services | USA |
| RCS | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| RCS | Google Ireland Limited by means of their subsidiary Jibe Mobile Ltd. | Provision of, Google Business, Messages (RCS), services | EU |
| Conversation Channels | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Mobile Push | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Video | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Video | LiveKit Inc. (optional) | Conduit processing of video and audio streams | Global (close-to-customer, carrier peering and geo-spreading) |
| Workflows | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Connectors | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Omnichannel Widget | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Contacts | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Payments | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Expenses | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, India, USA (as selected by customer) |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| Cloud Email Sending | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland (optional), USA |
| Recipient Validation | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland (optional), USA |
| Inbox Tracker | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Competitive Tracker | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| PowerMTA | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Momentum | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Taxi | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird | These Email Services do not require processing of personal data by Bird |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| SMS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| SMS | Clickhouse Inc. | Analytics Data Base Service Provider | Ireland |
| Voice | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium, Singapore, UK, USA |
| Numbers | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Numbers | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |
| Contacts | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| WhatsApp for Business | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| WhatsApp for Business | WhatsApp Ireland Limited | Provision of, WhatsApp for, Business services | EU and USA |
| Google RCS | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Google RCS | Google Ireland Limited by means, of their subsidiary Jibe Mobile Ltd. | Provision of, Google Business, Messages (RCS), services | EU |
| Conversation Channels | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium, Germany |
| Omnichannel Widget | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Service Name | Subprocessor Name | Subprocessor Function | Processing Location |
|---|---|---|---|
| Push Channels & Beams (Pusher) | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, Australia, Brazil, Japan, Singapore, South Korea, India, UK, USA |
| Push Channels & Beams (Pusher) | Sentry | Error monitoring | USA |
| Push Channels & Beams (Pusher) | Postmark | Dashboard - Log management and Analysis software | USA |
| Video (24sessions) | Amazon Web Services EMEA SARL | Cloud Hosting Service Provider | Ireland, Germany |
| Video (24sessions) | Digital Ocean | Turn Server provider | The Netherlands |
| Video (24sessions) | Flowmailer | Email Service Provider | The Netherlands |
| Video (24sessions) | Luzmo | In-app dashboard provider | Ireland |
| Video (24sessions) | Hubper (optional) | Online Learning Academy | The Netherlands |
| Video (24sessions) | Google Cloud EMEA Limited (optional) | Speech to text conversion | Global |
| Video (24sessions) | Twilio (optional) | Recorded dial-in, SMS, Phone number verification | Global |
| Numbers (Telserv) | Google Cloud EMEA Limited | Cloud Hosting Service Provider | The Netherlands, Belgium |
| Numbers (Telserv) | Microsoft Azure | Cloud Hosting Service Provider | The Netherlands, Hong Kong, USA |