Linear and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Linear will not use Customer Data, including AI prompts and outputs, to train, fine-tune or improve its own AI models, and its contracts require third-party AI providers not to train on it either.

Vendor's wording: “Linear will not use Customer Data, including Prompts or Outputs, to train, fine-tune, or otherwise improve Linear’s own AI models.”

Source: linear.appAI Services Addendum, 13.2 Model Training (Linear) and 13.3Checked on 19 October 2026

Chosen when the workspace is created: EU or US (security page). The DPA says Linear's primary processing takes place in the United States and the database runs on Google Cloud; which region is preselected is not stated.

Vendor's wording: “Customer acknowledges that Linear’s primary processing operations take place in the United States”

Source: linear.appDPA, Transfers of Personal DataChecked on 19 October 2026

EU hosting available.

Yes. The security page says you choose EU or US storage for your data when creating a Linear workspace. Which plans offer it is not stated.

Vendor's wording: “Choose to store your data in the European Union or the United States when creating a Linear workspace.”

Source: linear.appSecurity, Multi-region hostingChecked on 19 October 2026

DPA on request.

Yes. The DPA supplements the Terms of Service; by accepting the Terms the customer enters into it, and the EU Standard Contractual Clauses are deemed signed.

Vendor's wording: “By executing the Agreement, Customer enters into this DPA on behalf of itself”

Source: linear.appData Processing Addendum, preambleChecked on 19 October 2026

Published.

Yes, listed in Exhibit B of the DPA at https://linear.app/dpa: 34 entries. AI providers: Google, Amazon Web Services, Anthropic, OpenAI, Fireworks AI, TypeSafe AI, Cohere, Braintrust Data.

Vendor's wording: “The following includes the information required by Annex I and Annex III of the EU SCCs”

Source: linear.appDPA Exhibit B, List of Authorized Sub-ProcessorsChecked on 19 October 2026

Not listed.

No listing found for search term 'Linear Orbit'

Source: dataprivacyframework.govSearch 'Linear Orbit' returned 'Query returned no results'Checked on 19 October 2026

Personal data is kept while the account is open (and longer where the law requires); after the services end, Linear returns or deletes the customer's personal data at the customer's choice. No fixed period for AI prompts stated.

Vendor's wording: “Following completion of the Services, at Customer’s choice, Linear shall return or delete Customer’s Personal Data”

Source: linear.appDPA, return or deletion of Personal DataChecked on 19 October 2026

2 named: SOC 2 Type II and ISO/IEC 27001:2022. HIPAA is offered via a BAA; GDPR is described as a commitment.

Vendor's wording: “Linear has achieved ISO/IEC 27001:2022 certification for its information security management system.”

Source: linear.appSecurity, Enterprise-grade securityChecked on 19 October 2026

Yes. The AI addendum refers to opting out of an AI service or feature through administrator controls, and says Linear will not re-enable it without the customer's action.

Vendor's wording: “If Customer has opted out of an AI Service or feature through Customer’s administrator controls in the Service”

Source: linear.appAI Services Addendum, 13.4 Opt-Out PersistenceChecked on 19 October 2026