信任始于 深入了解。

了解我们如何保护您的数据。查找安全文档、独立评估以及评估 Bird 所需的解答。

附带上下文的证据

专为您的审查而设。

证书、报告和安全文档。每项均列出其覆盖的平台和有效日期。

文档

Bird Platform

机密文档

登录以下载机密报告。如有需要,我们会请您审阅保密条款。

登录以访问

渗透测试

Bird Platform

登录

我们如何保护您的数据

每一层,都有安全保障。

Bird’s security program combines technical safeguards, staff training and ongoing risk assessment to protect customer data. Explore our general practices below, then use the documents for your selected platform to review service-specific details and certification coverage.

Security governance

Our security and compliance teams work with engineering and operations to maintain security policies and assess risk. Internal assessments and a risk register guide mitigation work, with senior management reviewing audit findings and security risks.

Infrastructure and physical security

Bird uses cloud infrastructure from Amazon Web Services and Google Cloud Platform, with separate development, staging and production environments. Our Data Processing Agreement describes the physical and organizational safeguards, including policies for remote work.

Encryption

We encrypt customer data at rest and use TLS to protect sensitive information in transit over public networks.

Access control

Access to internal systems follows job responsibilities and the principle of least privilege. We use role-based access controls, single sign-on and multi-factor authentication, review access regularly, and revoke access when employees leave.

Application security

Secure coding practices, code reviews and a formal change management process support application development. We commission third-party penetration tests annually and develop remediation plans for critical and high-severity findings. Platform-specific test reports describe the systems and assessment period covered.

Monitoring

We collect and protect audit logs and use a security information and event management (SIEM) tool to monitor our network and systems continuously. Security tools help us identify suspicious activity and deviations from established configurations.

Endpoint security

Disk encryption protects data stored on company endpoints. Anti-malware and threat detection tools help protect endpoints and relevant production servers, with routine updates to keep those protections current.

People security

Employees and contractors complete security and data protection training when they join Bird and annually thereafter. Employee confidentiality agreements and ongoing awareness programs reinforce their responsibilities for handling sensitive information.

Incident response

Our incident management process defines how security events are reported, investigated and resolved. We track incidents through recovery and communicate with the relevant parties. Customer notification follows our breach notification procedure and the applicable agreement.

Business continuity

Backup and recovery procedures support systems that store sensitive customer data. Business continuity and disaster recovery plans guide service restoration after an outage. Our public status page provides service updates that you can subscribe to.

Privacy

Our Data Processing Agreement and privacy statement explain how we handle personal data and the responsibilities of Bird and our customers. We follow customer instructions for data retention and deletion, subject to applicable legal retention requirements.

Vendor management

We assess third-party vendors against security requirements. Our published subprocessor list identifies providers that process customer data, their role and processing locations. You can subscribe to notifications when that list changes.

阅读我们的数据处理协议

随时为您服务

一些常见问题。

获取所需凭证,了解访问机制。

Evidence for your security review

Start with Bird Platform, or select the platform your organization uses. Each published document and attestation lists its own scope. An assessment for one platform does not establish certification for another.

Use the document revision, validity dates and audit period when evaluating evidence. An assessment marked in progress has not been achieved. If current evidence is unavailable, ask your account team before relying on a certification claim.

What is Bird Platform?

Bird Platform is the current Bird platform for customer communications, bringing messaging channels and customer data into one platform. Choose Bird Platform when reviewing that product. Certifications for a legacy platform do not automatically cover Bird Platform.

What do the other platform names mean?

Email (SparkPost) covers the email platform, including SparkPost email delivery. Connectivity refers to the communications APIs used for services such as SMS, voice and numbers.

Bird Box and CRM are the same platform, listed as Bird Box (CRM). Taxi for Email has its own platform selection. Check the scope on each document before using it for your review.

Pusher provides realtime messaging through Channels and push notifications through Beams. eDataSource provides email intelligence and deliverability tools. 24sessions provides video calling services. If you are unsure which platform your agreement covers, ask your Bird account team.

Which certifications cover my platform?

Read the scope and effective status of each attestation below. Only a current attestation covering your selected platform supports a current claim. Missing or unavailable evidence does not establish that a platform is certified.

How do I open confidential documents?

Select a document and sign in with your Bird account. Verify your email address and accept the current confidentiality agreement. You can read its exact text before agreeing. Confidential distribution may be temporarily unavailable.

Do existing customers need another NDA?

Yes. Customers and prospects must accept the current Trust Center NDA before downloading confidential documents. You can reuse that acceptance across documents.

How do I return to my documents?

Sign in with the same verified account. Acceptance of the current confidentiality terms can be reused across documents. When Bird publishes a new NDA version, you must review and accept it before their next confidential download. Access can still be withdrawn. Check validity dates even when an older document remains available.

Where can I report a security issue?

Use Bird’s responsible disclosure program on HackerOne to report a vulnerability. The security contact is also published in bird.com/.well-known/security.txt. For a vendor questionnaire or platform-specific scope question, contact your Bird account team.

我们的服务提供商

按平台划分的子处理者

查看每项服务的数据处理方及其角色和处理地点。以下列表来自 Bird 批准的子处理者政策。

Approved Subprocessors

Last updated: 4 September 2026

End-user personal data is processed by Bird as a processor on behalf of the customer for the provision of the services. The below entities act as subprocessors on behalf of Bird.

Subscribe to receive notifications when subprocessors change.

All platforms
PlatformService NameSubprocessor NameSubprocessor FunctionProcessing Location
All platformsAll servicesBird AffiliatesPerformance of the Agreement, support servicesThe Netherlands, UK, USA
All platformsAll servicesAnthropic Ireland Ltd. (end-user data optional)Customer Support AI LLM Service ProviderUSA
Bird platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
All servicesAmazon Web Services EMEA SARLCloud Hosting Service ProviderAs determined by customer
All servicesNot Just Tickets Ltd (Plain) (optional Subprocessor)Internal Customer Support Ticketing SystemUK
EmailAmazon Web Services EMEA SARLCloud Hosting Service ProviderUSA, Ireland (optional, as selected by customer)
SMSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
SMSClickHouse Inc.Analytics Database Service ProviderIreland
SMSSvix Inc.Webhook Delivery Infrastructure ProviderIreland
WhatsApp for BusinessWhatsApp Ireland LimitedWhatsApp for Business Service ProviderUSA
VoiceSee All servicesSee All servicesSee All services
Realtime (Mobile Push)See All servicesSee All servicesSee All services
RCSGoogle Ireland LimitedProvision of Google RCS Business Messaging (RBM) servicesEU
RCSVibes Media, LLCProvision of Rich Communication Services (RCS) - US & CAN onlyUSA
NumbersMicrosoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
VideoSee All servicesSee All servicesSee All services
VideoLiveKit Inc. (optional)Conduit processing of video and audio streamsGlobal (close-to-customer, carrier peering and geo-spreading)
WorkflowsSee All servicesSee All servicesSee All services
ConnectorsSee All servicesSee All servicesSee All services
Omnichannel WidgetSee All servicesSee All servicesSee All services
ContactsSee All servicesSee All servicesSee All services
Conversation ChannelsSee All servicesSee All servicesSee All services
Engagement Platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
InboxAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
EmailAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
SMSAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
SMSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
SMSClickhouse Inc.Analytics Data Base Service ProviderIreland
VoiceAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer) and Germany, Singapore, Australia, Brazil, USA
NumbersAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
NumbersMicrosoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
WhatsApp for BusinessAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
WhatsApp for BusinessWhatsApp Ireland LimitedProvision of, WhatsApp for, Business servicesUSA
RCSAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
RCSGoogle Ireland Limited by means of their subsidiary Jibe Mobile Ltd.Provision of, Google Business, Messages (RCS), servicesEU
Conversation ChannelsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
Mobile PushAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
VideoAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
VideoLiveKit Inc. (optional)Conduit processing of video and audio streamsGlobal (close-to-customer, carrier peering and geo-spreading)
WorkflowsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
ConnectorsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
Omnichannel WidgetAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
ContactsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
PaymentsAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
ExpensesAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, India, USA (as selected by customer)
Email platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
Cloud Email SendingAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland (optional), USA
Recipient ValidationAmazon Web Services EMEA SARLCloud Hosting Service ProviderIreland (optional), USA
Inbox TrackerThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
Competitive TrackerThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
PowerMTAThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
MomentumThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
TaxiThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by BirdThese Email Services do not require processing of personal data by Bird
Connectivity platform
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
SMSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
SMSClickhouse Inc.Analytics Data Base Service ProviderIreland
VoiceGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium, Singapore, UK, USA
NumbersGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
NumbersMicrosoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
ContactsGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
WhatsApp for BusinessGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
WhatsApp for BusinessWhatsApp Ireland LimitedProvision of, WhatsApp for, Business servicesEU and USA
Google RCSGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
Google RCSGoogle Ireland Limited by means, of their subsidiary Jibe Mobile Ltd.Provision of, Google Business, Messages (RCS), servicesEU
Conversation ChannelsGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium, Germany
Omnichannel WidgetGoogle Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
Omnichannel platform (Pusher, 24sessions and Telserv)
Service NameSubprocessor NameSubprocessor FunctionProcessing Location
Push Channels & Beams (Pusher)Amazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, Australia, Brazil, Japan, Singapore, South Korea, India, UK, USA
Push Channels & Beams (Pusher)SentryError monitoringUSA
Push Channels & Beams (Pusher)PostmarkDashboard - Log management and Analysis softwareUSA
Video (24sessions)Amazon Web Services EMEA SARLCloud Hosting Service ProviderIreland, Germany
Video (24sessions)Digital OceanTurn Server providerThe Netherlands
Video (24sessions)FlowmailerEmail Service ProviderThe Netherlands
Video (24sessions)LuzmoIn-app dashboard providerIreland
Video (24sessions)Hubper (optional)Online Learning AcademyThe Netherlands
Video (24sessions)Google Cloud EMEA Limited (optional)Speech to text conversionGlobal
Video (24sessions)Twilio (optional)Recorded dial-in, SMS, Phone number verificationGlobal
Numbers (Telserv)Google Cloud EMEA LimitedCloud Hosting Service ProviderThe Netherlands, Belgium
Numbers (Telserv)Microsoft AzureCloud Hosting Service ProviderThe Netherlands, Hong Kong, USA
阅读完整的子处理者政策

更多方式获取详细信息。

你的下一个创意。 随时连接。