Slack AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Slack may transfer your Personal Data to countries other than the one in which you live, including transfers to the United States. To the extent that Personal Data is transferred abroad, Slack will ensure compliance with the requirements of the applicable laws in the respective jurisdiction in line with Slack’s obligations. In particular, we offer the following safeguards if Slack transfers Personal Data from jurisdictions with differing data protection laws: European Commission’s Standard Contractual Clauses. Slack uses Standard Contractual Clauses approved by the European Commission (and the equivalent standard contractual clauses for the UK where appropriate) for transfers to, among others, Australia, Canada, India, Japan, South Korea, and the United States. Slack will transfer your Personal Data to facilitate the provision of the Services. A copy of our standard data processing addendum, incorporating the Standard Contractual Clauses, is available here , and a copy of the executed version of the Standard Contractual Clauses may be obtained by contacting us as described in the “Contacting Slack” section below. Asia-Pacific Economic Cooperation Cross-Border Privacy Rules System And Privacy Recognition For Processors. Slack’s privacy practices, described in this Privacy Policy, comply with the Asia-Pacific Economic Cooperation (“APEC”) Cross Border Privacy Rules (“CBPR”) system and the Privacy Recognition for Processors (“PRP”). ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Data protection law in certain jurisdictions differentiates between the “controller” and “processor” of information. In general, Customer is the controller of Customer Data. In general, Slack is the processor of Customer Data and the controller of Other Information. Different Slack entities provide the Services in different parts of the world. Slack Technologies Limited , an Irish company based in Dublin, Ireland, is the controller of Other Information and a processor of Customer Data relating to Authorized Users who use Workspaces established for Customers outside of the U.S. and Canada. Slack Technologies , LLC, a U.S. company based in San Francisco, California is the controller of Other Information and a processor of Customer Data relating to Authorized Users who use Workspaces established for Customers in the US and Canada.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “The APEC CBPR system provides a framework for organizations to ensure protection of personal data transferred among participating APEC economies and the PRP demonstrates an organization’s ability to provide effective implementation of a personal data controller’s privacy obligations related to the processing of personal information. If you have an unresolved privacy or data use concern related to our APEC CBPR or PRP certifications that we have not addressed satisfactorily, you may contact our third-party dispute resolution provider.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Transfer, store or process your information outside the European Economic Area. As the Websites and Services operate globally, with Customers around the world, we need to share information we collect globally. We carry out necessary transfers outside the European Economic Area, including to Australia, Canada, Japan, India, South Korea, and the United States, to provide, update, maintain and protect our Services, Websites and business. For more information, review the “International Data Transfers” section below. In our and your interests to provide, update, maintain and protect our Services, Websites and business. ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Slack will retain Customer Data in accordance with a Customer’s instructions (including to perform any applicable terms in the Customer Agreement and through Customer’s use of Services functionality) and as required by applicable law. Customer may customize its retention settings and, depending on the Services plan, apply those customized settings at the Workspace level, channel level or other level. The Customer may also apply different settings to messages, files or other types of Customer Data. The deletion of Customer Data and other use of the Services by the Customer may result in the deletion and/or de-identification of certain associated Other Information. For more detail, please review the Help Center or contact the Customer.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Slack may retain Other Information pertaining to you for as long as necessary for the purposes described in this Privacy Policy (such as to provide the Services, including any optional features you use, and to provide customer support). This may include keeping your Other Information after you have deactivated your account for the period of time needed for Slack to pursue legitimate business interests, conduct audits, comply with (and demonstrate compliance with) legal obligations, resolve disputes, and enforce our agreements. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Share information with others including law enforcement and to respond to legal requests. It is in our interest and the interest of the general public to prevent and address fraud, unauthorized use of Slack, violations of our terms or other harmful or illegal activity; to protect ourselves, our users or others, including as part of investigations or regulatory enquiries; or to prevent death or imminent bodily harm. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Cookie information : Slack uses a variety of cookies and similar technologies in our Websites and Services to help us collect Other Information. For more details about how we use these technologies, and your opt-out controls and other options, please visit our Cookie Policy . Third-Party Services information : A Customer can choose to permit or restrict Third-Party Services for its Workspace and Slack can receive personal data from such Third-Party Services. Typically, Third-Party Services are software that integrate with our Services, and a Customer can permit its Authorized Users to enable and disable these integrations for its Workspace (for more details on third-party application management, settings and permissions, click here ). Slack may also develop and offer Slack applications that connect the Services with a Third-Party Service. Once enabled, the provider of a Third-Party Service may share certain information with Slack. For example, if a cloud storage application you are using is enabled to permit files to be imported to a Workspace, we may receive the user name and email address of Authorized Users, along with additional information that the application makes available to Slack to facilitate the integration. Authorized Users should check the privacy settings and notices in these Third-Party Services to understand what data may be disclosed to Slack. When a Third-Party Service is enabled, Slack is authorized to connect and access Other Information made available to Slack in accordance with our agreement with the provider of the Third-Party Service and any permission(s) granted by our Customer (including, by its Authorized User(s)). ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ ‘Information We Collect and Receive’ section may be shared or transferred, subject to standard confidentiality arrangements. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Law Enforcement and Regulators. If we receive a request for information, we may disclose Other Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation or legal process.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We share this information as described in the ‘ How We Share and Disclose Information ’ section above. Slack does not sell (as such term is defined in the CCPA or otherwise) the personal information we collect (and will not sell it without providing a right to opt out). We may also share personal information (in the form of identifiers and internet activity information) with third party advertisers for purposes of targeting advertisements on non-Slack websites, applications, and services. In addition, we may allow third parties to collect personal information from our sites or services if those third parties are authorized service providers who have agreed to our contractual limitations as to their retention, use, and disclosure of such personal information, or if you use our sites or services to interact with third parties or direct us to disclose your personal information to third parties.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “During a Change to Slack’s Business. If Slack engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of Slack’s assets or stock, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities, some or all of the Information described in the ‘Information We Collect and Receive’ section may be shared or transferred, subject to standard confidentiality arrangements.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Corporate Affiliates. Slack may share Information with our corporate affiliates, parents and/or subsidiaries.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Once enabled, the provider of a Third-Party Service may share certain information with Slack. For example, if a cloud storage application you are using is enabled to permit files to be imported to a Workspace, we may receive the user name and email address of Authorized Users, along with additional information that the application makes available to Slack to facilitate the integration.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ This section describes how Slack may share and disclose Information, as described in the section entitled 'Information We Collect and Receive' above. Customers determine their own policies and practices for the sharing and disclosure of Information to third parties. Slack does not control how a Customer or any third party chooses to share or disclose Information. The Customer’s Instructions. Slack may share and disclose Information in accordance with a Customer’s instructions and with appropriate consent, including any applicable terms in the Customer Agreement and the Customer’s use of Services functionality and in compliance with applicable law and legal process. Some sharing at a Customer’s request may incur additional fees. To enable Slack to follow our Customers’ instructions, Slack provides several administrator controls to allow Customers to manage their Workspaces. For example, we follow our Customers’ instructions to enable or disable Authorized Users use of various features of the Services, such as Clips or Slack Huddles , channel posting permissions , the sharing and visibility of direct messages including files, or whether and how Authorized Users can connect with other organizations’ Workspaces through Slack Connect. We also follow Customer and Authorized User instructions on how an Authorized User’s profile may be displayed within a Customer’s Workspace or when shared through Slack Connect or other features. Customers may also provide their Authorized Users with the ability to adjust the audience and visibility of certain Customer Data. To learn more, visit our Help Center to understand what choices and settings are available. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Aggregated or De-identified Data. We may disclose or use aggregated or de-identified Information for any purpose. For example, we may share aggregated or de-identified Information with prospects or partners for business or research. Law Enforcement and Regulators. If we receive a request for information, we may disclose Other Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation or legal process. Please review the Data Request Policy , Data Request Overview , and Transparency Report to understand how Slack responds to requests to disclose data from government agencies, law enforcement entities, and other sources. This may at times include information that Slack Technologies, LLC processes on behalf of Slack Technologies Limited in its role as a subprocessor, including as pursuant to the terms of any data protection agreement between Slack and its Customers. To enforce our rights, prevent fraud, and for safety. To protect and defend the rights, property, or safety of Slack, its users, or third parties, including enforcing its contracts or policies, or in connection with investigating and preventing illegal activity, fraud, or security issues, including to prevent death or imminent bodily harm. With Consent. Slack may share Information with third parties when we have consent to do so or as otherwise permitted in this Privacy Policy. For Workspaces registered to corporate entities, Slack may share Information with consent of the Workspace primary owner or authorized corporate officer, or their designee. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Aggregated or De-identified Data. We may disclose or use aggregated or de-identified Information for any purpose. For example, we may share aggregated or de-identified Information with prospects or partners for business or research.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “A Customer can choose to permit or restrict Third-Party Services for its Workspace and Slack can receive personal data from such Third-Party Services. Typically, Third-Party Services are software that integrate with our Services, and a Customer can permit its Authorized Users to enable and disable these integrations for its Workspace” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “This may include, for example, your employer using features of the Services to access or modify your profile details, or to export logs of Workspace activity. For information about your Workspace settings, please visit https://slack.com/account/settings . Third-Party service providers and partners. We may engage third-party companies or individuals as service providers or business partners to process Information and support our business. These third parties may, for example, provide virtual computing and storage services, assist Slack with verifying Owners and Customers, or we may share business information to develop strategic partnerships with Third-Party service providers to support our common customers. In this respect, depending on the Third-Party service provided, Slack may share your Information. Additional information about the subprocessors we use to support delivery of our Services is set forth in the Salesforce Infrastructure & Sub-processors Documentation . Third-Party Services. A Customer may enable, or permit Authorized Users to enable, Third-Party Services. We require each Third-Party Service provider to disclose all permissions for information accessible through the Services, but we do not guarantee that they do so. When Third-Party Services are enabled by a Customer or an Authorized User, Slack may share Information with Third-Party Services. Third-Party Services are not owned or controlled by Slack and third parties that have been granted access to Information may have their own policies and practices for its collection, use, and sharing. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Please check the permissions, privacy settings, and notices for these Third-Party Services or contact the provider for any questions. Forums. The Information you choose to provide in a community forum including personal data will be publicly available. Organizers and sponsors of Events/Webinars. If you attend an event or webinar organized by Slack, we may share your profile and organizational information with the event or webinar sponsors when you register, have your badge scanned, or join a breakout room. If required by applicable law, you may consent to such sharing via the registration form or by allowing your attendee badge to be scanned at a sponsor booth. In these circumstances, your information will be subject to the sponsors’ privacy statements. For more information, please refer to the terms provided when you register for such an event or webinar. Professional advisers. We may share your Information with professional advisers acting as service providers, processors, controllers, or joint controllers - including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance and accounting services, and to the extent we are legally obliged to share or have a legitimate interest in sharing your Information containing personal data. Corporate Affiliates. Slack may share Information with our corporate affiliates, parents and/or subsidiaries. During a Change to Slack’s Business. If Slack engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of Slack’s assets or stock, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities, some or all of the Information described in the” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.