Slack
Messaging · slack.com · last read 2026-11-09
At a glance
- Is Slack GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Slack itself publishes, each answer linked to its source and the date we read it.
- Does Slack have a data processing agreement (DPA)?
- Slack publishes an agreement, but its site refuses automated readers, so its terms are not recorded here yet. Source and date
- Does Slack have a SOC 2 report?
- Slack states SOC 2 Type 2 on its own page, but does not say there how to get a report. In Slack's words: “GovSlack SOC 2 (Type Ⅱ) Trust Services Principles.” Slack also publishes a SOC 3 report. We read this on 2026-10-04. Source and date
- Is Slack ISO 27001 certified?
- Slack states ISO/IEC 27001 certification, and its own page links to the certificate. We read this on 2026-10-04. Source and date
- Where is Slack's trust center?
- Slack publishes a page it calls “Trust Center” at slack.com/trust. Its front page shows no request or sign-in step; documents further in may still have one. The page mentions a DPA. We read it on 2026-11-03. Source and date
- Does Slack use your data to train AI models?
- For business plans (AI in Slack): Customer Data not used to train generative AI models unless the customer gives affirmative opt-in consent. For business plans (Slack AI features): Customer data is never used to train LLMs, including third-party LLMs. For business plans (Slack global models (non-generative ML)): Customer Data used to train Slack global ML models (e.g. emoji, channel recommendations); Org/Workspace Owners can opt out by emailing [email protected]. Source and date
- What is Slack's data retention for AI prompts and outputs?
- For business plans (Slack AI conversation summaries and search answers): Ephemeral responses, not stored on devices or servers. For business plans (Slack AI recaps): Recap data stored for 90 days; deleted earlier if source messages are deleted. Source and date
- Does Slack offer zero data retention?
- For business plans (AI in Slack): Third-party LLMs do not retain Customer Data after a request; LLM providers have no access to Customer Data. For business plans (Slack AI features): Third-party LLMs hosted in Slack's infrastructure do not retain information after the request is processed. Source and date
- How does Slack transfer personal data out of the EU?
- Salesforce (covered entity: Slack Technologies, LLC) is on the official Data Privacy Framework List (status: Active). Source and date
- Does Slack offer EU data residency?
- An EU location exists but requires a paid plan or add-on. Plan it needs: Business+ or Enterprise. Source and date
- How do you report a security vulnerability to Slack?
- Slack publishes a security.txt at slack.com naming https://hackerone.com/slack/. The file falls short of RFC 9116: no Expires field. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Slack Technologies, LLC |
|---|---|
| HQ | US |
| Parent company | Salesforce |
| Ultimate ownership | — |
| EU contracting entity | Slack Technologies Limited |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | slack.com · 2026-10-08 |
Slack data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Paid upgrade | Business+ or Enterprise | slack.com | 2026-09-18 |
EU: CORRECTION of our 2026-09-17 reading of unstated, which came from a subprocessor document that refused our client. Page states data residency is 'Available on Business+ and Enterprise plans', that free and Pro customers 'need to upgrade to the Business+ plan first', that only the Primary Owner can enable it, and that Sales must set it up. Without it, page states data is stored in the US.
The same question for every vendor: where SaaS vendors store EU data.
Subprocessor chain
Processing terms
The vendor's data processing agreement could not be read: the site refused our crawler.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What Slack's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| Business AI in Slack | Training on your data | Not used unless you opt in Customer Data not used to train generative AI models unless the customer gives affirmative opt-in consent | slack.com | 2026-10-28 |
| Business Slack AI features | Training on your data | Not used Customer data is never used to train LLMs, including third-party LLMs | slack.com | 2026-10-28 |
| Business Slack global models (non-generative ML) | Training on your data | Used unless you opt out Customer Data used to train Slack global ML models (e.g. emoji, channel recommendations); Org/Workspace Owners can opt out by emailing [email protected] | slack.com | 2026-10-28 |
| Business Slack AI conversation summaries and search answers | Data retention | Not stored Ephemeral responses, not stored on devices or servers | slack.com | 2026-10-28 |
| Business Slack AI recaps | Data retention | 90 days Recap data stored for 90 days; deleted earlier if source messages are deleted | slack.com | 2026-10-28 |
| Business AI in Slack | Zero data retention | With its model providers Third-party LLMs do not retain Customer Data after a request; LLM providers have no access to Customer Data | slack.com | 2026-10-28 |
| Business Slack AI features | Zero data retention | With its model providers Third-party LLMs hosted in Slack's infrastructure do not retain information after the request is processed | slack.com | 2026-10-28 |
Assurance
Does Slack have a SOC 2 report?
Slack states SOC 2 Type 2 on its own page, but does not say there how to get a report. Slack also publishes a SOC 3 report. We read this on 2026-10-04.
- Claimed “GovSlack SOC 2 (Type Ⅱ) Trust Services Principles”
- Claimed “SOC 2 (Type Ⅱ) Trust Services Principles”
Source: slack.com, 2026-10-04
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Slack ISO 27001 certified?
Slack states ISO/IEC 27001 certification, and its own page links to the certificate. We read this on 2026-10-04.
On the same list Slack also names ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Global CBPR Certification · APECCBPR | Certificate published | Global Cross Border Privacy Rules Minimum Requirements | slack.com | 2026-10-04 |
| Global PRP Certification · APECPRP | Certificate published | Global Privacy Recognition for Processors Minimum Requirements | slack.com | 2026-10-04 |
| C5 | Available on request | — | slack.com | 2026-10-04 |
| CCPA | Claimed | — | slack.com | 2026-10-04 |
| CSA | Certificate published | Cloud Security Alliance; STAR Registry Listing | slack.com | 2026-10-04 |
| Esquema Nacional de Seguridad (ENS) · ENS | Certificate published | ENS High, which is the highest achievable level of accreditation possible | slack.com | 2026-10-04 |
| Spain Esquema Nacional de Seguridad (ENS) · ENS | Certificate published | ENS High | slack.com | 2026-10-04 |
| FedRAMP JAB High · FedRAMP | Certificate published | GovSlack | slack.com | 2026-10-04 |
| FedRAMP Moderate · FedRAMP | Certificate published | Slack with an Enterprise or Enterprise+ Slack plan and properly configured in accordance with the Secure Configuration Guide | slack.com | 2026-10-04 |
| GDPR | Claimed | — | slack.com | 2026-10-04 |
| Information Security Registered Assessors Program (IRAP) · IRAP | Available on request | against the requirements of the Australian Information Security Manual (ISM) | slack.com | 2026-10-04 |
| ISMAP | Certificate published | Japanese Government program evaluating the security posture of cloud service providers | slack.com | 2026-10-04 |
| ISO/IEC 27001 · ISO27001 | Certificate published | Information Security Management System (ISMS) | slack.com | 2026-10-04 |
| ISO/IEC 27017 · ISO27017 | Certificate published | Security Controls for the Provision and Use of Cloud Services | slack.com | 2026-10-04 |
| ISO/IEC 27018 · ISO27018 | Certificate published | Protection of Personally Identifiable Information (PII) | slack.com | 2026-10-04 |
| ISO/IEC 27701 · ISO27701 | Certificate published | Privacy Information Management System (PIMS) | slack.com | 2026-10-04 |
| ISO/IEC 42001 · ISO42001 | Certificate published | Information technology — Artificial intelligence — Management system | slack.com | 2026-10-04 |
| South Korea Cloud Service Providers (CSP) Safety Assessment | Available on request | performed by the Korean Financial Security Institute (K-FSI) | slack.com | 2026-10-04 |
| GovSlack SOC 2 · SOC2T2 | Claimed | GovSlack; (Type Ⅱ) Trust Services Principles | slack.com | 2026-10-04 |
| SOC 2 · SOC2T2 | Claimed | (Type Ⅱ) Trust Services Principles | slack.com | 2026-10-04 |
| GovSlack SOC 3 · SOC3 | Certificate published | GovSlack; Service Organization Control | slack.com | 2026-10-04 |
| SOC 3 · SOC3 | Certificate published | Service Organization Controls | slack.com | 2026-10-04 |
| TISAX | Available on request | Scope-ID SHYV0T, Assessment-ID AMHN37 | slack.com | 2026-10-04 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Salesforce (covered entity: Slack Technologies, LLC) | Active | HR data, non-HR data | 2027-10-06 | 2026-10-19 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Salesforce (covered entity: Slack Technologies, LLC) | Active | HR data, non-HR data | 2027-10-06 | 2026-10-19 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Salesforce (covered entity: Slack Technologies, LLC) | Active | HR data, non-HR data | 2027-10-06 | 2026-10-19 |
| ENS certificates of conformity (CCN, Spain) | Los Sistemas de Información que soportan los servicios de Slack, ubicados en Centros de Datos externalizados en US East (Norte de Virginia, Estados Unidos de América), US East (Ohio, Estados Unidos de América), Fráncfort (Alemania), París (Francia), Tokio (Japón), Mumbai (India), Singapur (Singapur)… · Salesforce Inc | certified | ENS ALTA | 2027-11-18 | 2026-10-19 |
| FedRAMP Marketplace (US) | GovSlack · Slack Technologies | FedRAMP Authorized | High | — | 2026-10-19 |
| FedRAMP Marketplace (US) | Slack · Slack Technologies | FedRAMP Authorized | Moderate | — | 2026-10-19 |
- ACN qualified cloud (Italy): checked 2026-11-02, no entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
- DORA critical ICT third-party providers (ESAs): checked 2026-10-26, no entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
- Data Privacy Framework List (US): checked 2026-11-02, 3 entries under Slack; Slack Technologies Limited; Slack Technologies, LLC
- ENS certificates of conformity (CCN, Spain): checked 2026-11-02, 1 entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-02, no entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
- FedRAMP Marketplace (US): checked 2026-11-02, 2 entries under Slack; Slack Technologies Limited; Slack Technologies, LLC
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-02, no entry under Slack; Slack Technologies Limited; Slack Technologies, LLC
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Slack (SaaS) | — | Service only | unknown | slack.com | 2026-09-18 |
| Slack desktop app | 12 months | Declared | unknown | slack.com | 2026-10-11 |
| Slack mobile app | 12 months | Declared | unknown | slack.com | 2026-10-11 |
Vulnerability reporting: hackerone.com (security.txt, no Expires field; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is Slack's trust center?
Slack publishes a page it calls “Trust Center” at slack.com/trust. Its front page shows no request or sign-in step; documents further in may still have one. The page mentions a DPA. We read it on 2026-11-03. Open slack.com/trust
- Name “Our Trust Center connects you to our privacy, security and compliance programs, so you have all of the information you need to manage your data.”
Source: slack.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-28 |
| ai-2 | Public | full | 200 | 2026-10-28 |
| dpa | Refused | partial | — | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| subprocessors | Refused | partial | 403 | 2026-09-18 |
| tia | Public | full | 200 | 2026-10-20 |
| tia-2 | Public | full | 200 | 2026-10-20 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-10-19 | Status Active - Re-certification under Review → Active | the vendor changed it | dataprivacyframework.gov |
| 2026-10-19 | Status Active - Re-certification under Review → Active | the vendor changed it | dataprivacyframework.gov |
| 2026-10-19 | Status Active - Re-certification under Review → Active | the vendor changed it | dataprivacyframework.gov |
| 2026-10-12 | Status Active → Active - Re-certification under Review Valid until 2026-10-20 → 2027-10-06 | the vendor changed it | dataprivacyframework.gov |
| 2026-10-12 | Status Active → Active - Re-certification under Review Valid until 2026-10-20 → 2027-10-06 | the vendor changed it | dataprivacyframework.gov |
| 2026-10-12 | Status Active → Active - Re-certification under Review Valid until 2026-10-20 → 2027-10-06 | the vendor changed it | dataprivacyframework.gov |
| 2026-09-18 | EU data location Not stated → Paid upgrade Minimum plan set to Business+ or Enterprise Note rewritten | we read a better page | slack.com |
Every reviewed change across the registry, newest first: vendor changes.