Choose the data region before you create the workspace, because you cannot change it yourself later. Then review Linear's AI subprocessors, limit what agents, apps, and MCP clients can reach, and budget for Enterprise if you need SAML, SCIM, the audit log, or a HIPAA BAA.
When you need this
- Security or legal must approve a tracker that holds roadmap, customer, and code context.
- You plan to turn on Linear Agent, Code Intelligence, or coding sessions.
- You need EU data residency, SSO, or a HIPAA BAA.
Evaluation criteria
Data region
Where is the workspace stored?
Look forYou choose the US or EU region when you create the workspace, and Linear offers no self-serve way to change it later. Account data, API keys, crash data, and usage analytics are stored in the US regardless, and notification emails are held in the US for 7 days.
AI processing
Which models see workspace data, and is it used for training?
Look forLinear states it does not train on customer data and shares data with AI subprocessors only to deliver features. Its DPA lists Anthropic, OpenAI, and Google among them. Coding sessions default to zero-data-retention models.
Code access
Which repositories can Linear read?
Look forCode Intelligence, Reviews, and coding sessions need code access through the GitHub integration. Code Intelligence follows each member's repository access unless an admin extends it to all members, and admins can limit it to chosen repositories. Guests cannot use Code Intelligence.
Agents and apps
What can third-party agents and apps reach?
Look forAdmins choose which teams an agent can access at install. On any paid plan, admins can turn on third-party app approvals so every app needs approval before install. Agents cannot sign in, reach admin functions, or manage users. Each third-party agent's provider sets how it handles your data, so review that provider's terms before you approve the install.
MCP access
Can AI clients write to Linear?
Look forThe hosted MCP server uses OAuth with read-write access by default. A read-only endpoint or read scope prevents writes. Okta customers can require enterprise-managed authorization for supported MCP clients.
Identity
How do people sign in and leave?
Look forGoogle SSO and email login on every plan. SAML and SCIM on Enterprise, with SAML-domain members required to sign in through the identity provider. Guests provisioned through SCIM must use that provider.
Audit and certifications
What evidence can you show an auditor?
Look forThe audit log, on Enterprise, keeps 90 days of access and settings events, readable by workspace owners and through the API. Linear states SOC 2 Type II, GDPR, ISO/IEC 27001:2022, and HIPAA, with a BAA on Enterprise.
Private work
Who can see sensitive teams?
Look forPrivate teams on Business and Enterprise hide issues from non-members. On Enterprise, owners must join a private team to see its issues. On other paid plans admins can see and join them.
Questions to ask vendors
- Which region do we need, and is the US-held account and usage data acceptable?
- Do we turn on Code Intelligence, and for which repositories and people?
- Which agents are approved, for which teams, and who reviews new installs?
- Do AI clients get read-only MCP access by default?
- Do we need SAML, SCIM, or the audit log, which means Enterprise?
Red flags
- Creating the workspace before deciding the data region.
- Extending Code Intelligence to all members without choosing repositories.
- Third-party app approvals left off on a paid plan.
- Read-write MCP access for every AI client by default.
- Assuming a third-party agent follows Linear's data commitments.
Products in this piece
Sources
- Official documentation
- 14
- Linear docs: Security
- Linear security
- Linear Data Processing Agreement (subprocessors)
- Linear docs: Triage Intelligence
- Linear docs: Code Intelligence
- Linear docs: Coding sessions
- Linear docs: AI agents
- Linear docs: Third-party app approvals
- Linear docs: MCP server
- Linear docs: SAML
- Linear docs: SCIM
- Linear docs: Audit log
- Linear docs: Private teams
- Linear docs: Members and roles