How our DPAs work
For most providers, the DPA is incorporated by reference into the vendor’s commercial terms: when we accept those terms to use the service, the DPA’s data-protection obligations (including GDPR Standard Contractual Clauses for international transfers, UK/Swiss equivalents, and CCPA/CPRA) apply automatically, with no separate signature required. Where a provider offers a separately executed DPA, we link it next to the service below. Separately, HIPAA protections require a signed Business Associate Agreement (BAA). Only providers with a signed BAA (currently Google Cloud) may process data for HIPAA-enabled (PHI) workspaces; every other provider is blocked server-side for those workspaces. See HIPAA compliance for what that allows and blocks.Infrastructure & hosting
AI processing
When you use AI features (Bird chat, voice transcription, photo text extraction, document processing), your content is sent to one of these providers for inference. Your data is not used to train AI models.
Voice transcription uses Google Cloud Speech-to-Text by default. If it’s temporarily unavailable, workspaces not in Restricted mode fall back to OpenAI so transcription keeps working. Restricted-mode workspaces never use the OpenAI fallback; they stay on Google only, enforced server-side. OpenAI does not train on data submitted via its API; its Data Processing Addendum is incorporated by reference into the OpenAI Services Agreement (effective 1 January 2026), so no separate signature is required; acceptance is deemed by use of the API.
Document conversion
Word imports in Restricted-mode workspaces never reach Tiptap; Bower converts those files itself, and embedded images are not imported. This is enforced server-side. See HIPAA compliance for the full list of what changes in Restricted mode.
Agreement status: Bower does not currently have a signed DPA or BAA with Tiptap. That is why Word imports are converted locally for Restricted-mode workspaces, and why no PHI workspace’s document content reaches them. If you need a DPA to be in place before using Word import on a non-Restricted workspace, contact us. You can also enable Restricted mode to keep document conversion entirely inside Bower.
Integrations & identity
When you connect external services to Bower (either letting Bird search your other tools, or letting an external AI client read your Bower workspace), these providers process the OAuth tokens that broker that access. Bower never stores the underlying access tokens itself.
Connectors and external AI access are not yet available in Restricted-mode workspaces; neither provider’s BAA is signed yet. Both surfaces are blocked server-side for Restricted-mode workspaces until that’s in place.
Documentation and help search
Restricted-mode workspaces never send help-search queries to Mintlify. Bird blocks the external documentation lookup server-side and instead directs you to browse the public help centre without copying workspace content.
Agreement status: Bower does not currently have a signed DPA or BAA with Mintlify. The help centre itself contains public Bower documentation. Bird-generated help-search queries are sent to Mintlify only from non-Restricted workspaces.
Payment processing
Bower uses Stripe for all payment processing. Card numbers, CVCs, and full payment details are handled entirely by Stripe’s hosted Checkout and Customer Portal surfaces; they never touch Bower servers. Bower’s systems only see opaque Stripe IDs (
cus_…, sub_…) and transaction amounts. Stripe is PCI-DSS Level 1 certified; Bower’s integration is PCI SAQ-A (the lowest-scope form).
The Stripe Data Processing Agreement applies automatically to our use of the service under Australian, EU (GDPR), and UK (UK-GDPR) data-protection law, so no manual signature is required; acceptance is deemed by use of the Stripe platform.