Bird

Security and trust center evidence

The world’s largest omnichannel communications platform

bird.com Communications and CPaaSLast verified 2 Nov 2026

Request the report Are you Bird?

HIPAAVendor-stated

SOC 2Vendor-stated

GDPRVendor-stated

ISO 27001Vendor-stated

SOC 3Vendor-stated

DPFExpired

CCPAVendor-stated

Bird has 6 vendor-stated rows, and 1 expired in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Bird states on its trust centre that it holds SOC 2 Type II, ISO/IEC 27001:2022, and SOC 3, all as of 17 Sep 2026. Bird also states on its trust centre that it meets GDPR and CCPA/CPRA, as of 17 Sep 2026. For HIPAA, Bird displays a HIPAA badge on its trust centre as of 17 Sep 2026, though BAA availability is not captured in this evidence. Bird is listed in the EU-US Data Privacy Framework registry as of 17 Sep 2026, with active EU-US, SW-US, and UK Extension certifications running through 7 Nov 2026. The EU-US Data Privacy Framework listing shows an original issue date of 1 Sep 2016, as of 17 Sep 2026.

SOC 2 Type II, ISO/IEC 27001:2022, SOC 3 - vendor-stated on trust centre, as of 17 Sep 2026.
HIPAA - badge displayed on trust centre as of 17 Sep 2026; BAA availability not captured.
EU-US Data Privacy Framework - listed in registry, active through 7 Nov 2026, as of 17 Sep 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among communications and cpaas vendors

0verified rows

Category median 1, across 45 indexed communications and cpaas vendors. Bird has no registry-verified row yet, like 36 percent of them; its evidence is vendor-stated or reported.

apiemailomnichannelsmswhatsapp

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for FedRAMP, PCI DSS, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Standard contractual clauses

On request · Listed on the trust centre as "Standard Contractual Clause (SCC)" · as of 12 Oct 2026

Open

Subprocessor list

Public · 79 subprocessors listed on the trust centre · as of 2 Nov 2026

Open

Subprocessors (79)

AP
All platforms
AS
All services
AW
Amazon Web Services EMEA SARL
AD
Analytics Data Base Service Provider
AD
Analytics Database Service Provider
AD
As determined by customer
BA
Bird Affiliates
CI
ClickHouse Inc.
CE
Cloud Email Sending
CH
Cloud Hosting Service Provider
CT
Competitive Tracker
CO
Connectors
CO
Contacts
CC
Conversation Channels
CS
Customer Support AI LLM Service Provider
DO
Digital Ocean
EM
Email
ES
Email Service Provider
EM
Error monitoring
EU
EU
EA
EU and USA
EX
Expenses
FL
Flowmailer
GL
Global
GC
Google Cloud EMEA Limited
GC
Google Cloud EMEA Limited (optional)
GI
Google Ireland Limited
GR
Google RCS
HO
Hubper (optional)
IA
In-app dashboard provider
IN
Inbox
IT
Inbox Tracker
IC
Internal Customer Support Ticketing System
IR
Ireland
IO
Ireland (optional), USA
IG
Ireland, Germany
LU
Luzmo
MA
Microsoft Azure
MP
Mobile Push
MO
Momentum
NU
Numbers
NT
Numbers (Telserv)
OW
Omnichannel Widget
OL
Online Learning Academy
PA
Payments
PO
Performance of the Agreement, support services
PO
Postmark
PO
PowerMTA
PO
Provision of, WhatsApp for, Business services
PC
Push Channels & Beams (Pusher)
RC
RCS
RM
Realtime (Mobile Push)
RV
Recipient Validation
RD
Recorded dial-in, SMS, Phone number verification
SA
See All services
SE
Sentry
SM
SMS
ST
Speech to text conversion
SI
Svix Inc.
TA
Taxi
TN
The Netherlands
TN
The Netherlands, Belgium
TN
The Netherlands, Belgium, Germany
TN
The Netherlands, Belgium, Singapore, UK, USA
TN
The Netherlands, Hong Kong, USA
TN
The Netherlands, UK, USA
TS
Turn Server provider
TO
Twilio (optional)
UK
UK
US
USA
VM
Vibes Media, LLC
VI
Video
V2
Video (24sessions)
VO
Voice
WD
Webhook Delivery Infrastructure Provider
WF
WhatsApp for Business
WF
WhatsApp for Business Service Provider
WI
WhatsApp Ireland Limited
WO
Workflows

Security profile

Pen test cadence: report available

Displayed as a security profile from public statements, not as attestations, as of 12 Oct 2026.

Change history

2 Nov 2026EU-US Data Privacy Framework state changedState moved from Verified to Expired.
13 Oct 2026Subprocessor added: All platformsAll platforms appeared on the subprocessor list.
13 Oct 2026Subprocessor added: All servicesAll services appeared on the subprocessor list.
13 Oct 2026Subprocessor added: Amazon Web Services EMEA SARLAmazon Web Services EMEA SARL appeared on the subprocessor list.
13 Oct 2026Subprocessor added: Analytics Data Base Service ProviderAnalytics Data Base Service Provider appeared on the subprocessor list.
13 Oct 2026Subprocessor added: Analytics Database Service ProviderAnalytics Database Service Provider appeared on the subprocessor list.
13 Oct 2026Subprocessor added: As determined by customerAs determined by customer appeared on the subprocessor list.
13 Oct 2026Subprocessor added: Bird AffiliatesBird Affiliates appeared on the subprocessor list.
13 Oct 2026Subprocessor added: ClickHouse Inc.ClickHouse Inc. appeared on the subprocessor list.
13 Oct 2026Subprocessor added: Cloud Email SendingCloud Email Sending appeared on the subprocessor list.

Similar vendors with evidence

Related by product tags and the Communications and CPaaS category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.