Linear
Work management · linear.app · last read 2026-11-09
At a glance
- Is Linear GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Linear itself publishes, each answer linked to its source and the date we read it.
- Does Linear have a data processing agreement (DPA)?
- Yes. Linear publishes a data processing agreement at linear.app. It gives 30 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Where is Linear's trust center?
- Linear publishes a page it calls “Trust Center” at trust.linear.app. Some of its documents sit behind a request or sign-in: the page says “Request access”. Its text appears only after JavaScript runs: a client without it, as most tooling is, gets an empty page. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Source and date
- How does Linear transfer personal data out of the EU?
- Linear's agreement relies on the EU standard contractual clauses and the UK transfer addendum. We found no entry for Linear on the official Data Privacy Framework List. Source and date
- Does Linear offer EU data residency?
- The vendor documents an EU region but states nothing about which plan reaches it or what it costs. Source and date
- Who are Linear's subprocessors?
- Linear lists 34 third-party subprocessors; 33 of them name at least one processing country outside the EEA. We last read the list on 2026-10-25. Source and date
- How do you report a security vulnerability to Linear?
- Linear publishes a security.txt at linear.app naming [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | LINEAR ORBIT, INC. |
|---|---|
| HQ | — |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | linear.app · 2026-10-25 |
Linear data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | linear.app | 2026-10-25 |
EU: Customers can choose EU or US storage when creating a new workspace, and the default is set from the system timezone. The document names no plan and no cost for it.
The same question for every vendor: where SaaS vendors store EU data.
Linear's subprocessor list names AWS and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
34 third parties · 33 with a country outside the EEA · all read 2026-10-25
| Subprocessor | Country | Purpose |
|---|---|---|
| AC PM, LLC (Postmark) | US | Email delivery |
| Amazon Web Services, Inc | US, EU | Cloud provider, artificial intelligence |
| Anthropic, PBC | US | Artificial intelligence |
| Astrodon Corp (Loops) | US | Marketing |
| Braintrust Data Inc. | US | Artificial intelligence |
| Clay Labs Inc | US | Marketing |
| Cloudflare, Inc. | — | Cloud provider |
| Cohere Inc | US, EU | Artificial intelligence |
| Common Room, Inc | US | Sales |
| Datadog, Inc. | US | Cloud monitoring |
| Enterpret Inc | US | Customer support |
| Fireworks AI, Inc | US | Artificial intelligence |
| Fivetran Inc. | US | Data storage and processing |
| Functional Software Inc (Sentry) | US | Cloud monitoring |
| Gong.io Ltd | US | Sales |
| Google LLC | US, EU | Cloud provider, artificial intelligence, collaboration / productivity |
| Hevo Data, Inc | US | Data storage and processing |
| Hex Technologies Inc. | US | Data analytics |
| HubSpot, Inc. | US | Customer relationship management |
| Intercom, Inc. | US | Customer support |
| Modal Labs, Inc. | US, EU | Cloud provider |
| OpenAI OpCo, LLC | US, EU | Artificial intelligence |
| Outreach Corporation | US | Sales |
| PlanetScale, Inc. | US, EU | Managed database services |
| PostHog, Inc | US | Product analytics |
| Pylon Labs, Inc. | US | Customer support |
| Retool Inc. | US | Product analytics and management |
| Slack Technologies LLC | US | Collaboration and community |
| Snowflake Inc | US | Data storage and processing |
| Stripe, LLC | US | Payments |
| The Pierre Computer Company, Inc. | US, EU | Code storage and processing |
| turbopuffer Inc. | US, EU | Search |
| TypeSafe AI, Inc | US | Artificial intelligence |
| ZenLeads Inc (Pocus) | US | Sales |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-25 · linear.app
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | SCC module 4 |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 30 days before engaging a new sub-processor, by adding it to the List and notifying Customer via email (subscription mechanism also offered) |
| If you object to one | Customer may object in writing within 30 days of notice, on reasonable data protection grounds |
| If you object to one | If Linear cannot offer a commercially reasonable alternative within a reasonable time, Customer may stop using the affected Service by written notice (fees still owed) |
| Obligations passed to subprocessors | Written agreement imposing data protection obligations comparable to those imposed on Linear under the DPA; Linear remains liable for sub-processor performance |
| Breach notification | without undue delay |
| Deletion when the service ends | On completion of the Services, at Customer's choice, return or delete Customer's Personal Data unless further storage is required or authorized by law; if deletion is impracticable or prohibited, block the data from further processing and keep protecting it; SCC deletion certification provided only on Customer's request |
| Getting your data back | On completion of the Services, at Customer's choice, Personal Data is returned (or deleted), unless further storage is required or authorized by law |
| Requests from data subjects | Notifies Customer of Data Subject Requests it receives (to the extent permitted by law) and advises the data subject to submit the request to Customer; at Customer's request, assists with appropriate technical and organizational measures where Customer cannot respond without its help, at Customer's cost |
| Audit | Certifications/reports on request at reasonable intervals; if insufficient, audit by customer's independent third-party representative, with reasonable prior written notice, during business hours, at most once per calendar year, at customer's cost |
| Audit | Right to review, audit and copy Linear's compliance records at Linear's offices during regular business hours, with reasonable notice |
| Processing on your instructions | Processes only for purposes in the Agreement/Exhibit A and per the DPA or Customer's other documented instructions, including for transfers to third countries, unless otherwise legally required (with prior notice where permitted) |
| Confidentiality of staff | all employees sign a non-disclosure agreement before gaining access to Linear information |
| Security measures | Appropriate technical and organizational measures ensuring security appropriate to the risk; additional information set out in Exhibit C |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
No certification claims transcribed yet.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- Data Privacy Framework List (US): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under LINEAR ORBIT, INC.; Linear
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2027-12-31; read 2026-10-25)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is Linear's trust center?
Linear publishes a page it calls “Trust Center” at trust.linear.app. Some of its documents sit behind a request or sign-in. Its text appears only after JavaScript runs: a client without it, as most tooling is, gets an empty page. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Open trust.linear.app
- Name “Linear's Trust Center”
- Request step “Request access”
Source: trust.linear.app, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-10-25 |
| identity | Public | full | 200 | 2026-10-25 |
| residency | Public | full | 200 | 2026-10-25 |
| subprocessors | Public | full | 200 | 2026-10-25 |
History
Nothing has moved since we started watching this vendor on 2026-10-25. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.