Statement of Policies Regarding Data Security & Confidentiality

Each person and each team using Slack expects their data to be private, secure and confidential. We understand how important this is to our customers and work to the best of our abilities to ensure all three expectations are met. Please review the information below regarding our current policies and practices. This is a living document and we will update it as our service evolves and industry practices change.

Privacy
By default, anything you post to Slack is private to your team. That is, viewing the messages and files shared within a specific team requires authentication as a member of that team. You may also post things (such as files and messages) which are only available to you, or to a restricted group of other team members, but not the entire team. We attempt to clearly label all privacy controls and explain their function.

There is currently no way for other members of your team to discover files you have kept private (unless you share it with them), read your direct messages (unless they are the recipient) or discover or read the messages inside private groups you create (unless you invite them). However, we plan to allow team owners or administrators to enable an optional feature which would allow them to view anything inside their teams. When this feature is added, notices will be visible to all members on teams where it is enabled.

The only feature which allows sharing something outside of your team is the “Get public link” feature for files. Public links can be used to share files with people outside of your Slack team, though you would still need to send them the link as the URLs are deliberately hard to guess or predict. Once created, public links may be revoked. When you revoke a public link, it will stop working and the file will once again be private to your team.

When someone leaves your team, your team administrators can quickly and easily deactivate their account. The account is preserved in a deactivated state so that you may still view the files and messages associated with the account, but that person will not longer be able to sign in to Slack and any sessions they currently have open will be terminated.

Security
As a company, we use Slack for everything we do. Ensuring that the Slack service remains secure is vital to protecting our own data. We protect your data with the exact same mechanisms we use to protect our own. The security of your information is required for our success as a business. Below are some details on our security practices.

End-to-End Encrypted Communication
Whether you're at your computer or on your phone, absolutely nothing goes over the network in the clear. Slack uses 256-bit AES, supports TLS 1.2 for all of your messages, and uses the ECDHE_RSA Key Exchange Algorithm. We monitor the security community's output closely and work promptly to upgrade the service to respond to new vulnerabilities as they are discovered.

External Security Audits
We contract with respected external security firms who perform regular audits of Slack to verify that our security practices are sound and to monitor the service in light of new vulnerabilities discovered by the security research community.

Secure Physical Location
Our servers are located in Amazon's AWS data centers. They've devoted an entire portion of their site to explaining their security measures, which you can find here: http://aws.amazon.com/compliance/

Experienced Team
We've been putting services on the internet for a long time. We're good at it. Our engineering, quality assurance and technical operations team members are experienced and keep their skills up to date as industry best practices evolve. We’ve coded, tested and administered services running on thousands of physical servers in data centers around the world and we bring the collective wisdom that comes with many decades of secure practice to operation of the Slack service.

Security Features for Team Members & Administrators
The highest security risk to any system is usually the behavior of its users. We want to provide you with the tools you need to protect your own data, We make it easy for each user to remotely close all connections and sign out all devices authenticated with their credentials at any time.

We will soon be rolling out several additional features which afford you more control over the security of your own Slack instance, some of which will be available to all (such as timestamped logs of account sign-in and PIN-lock functionality for Slack’s mobile apps) and some of which will be options available to administrators (such as establishing password strength requirements or use of the PIN-lock feature).

Confidentiality
We regard the information you share within your Slack instance as absolutely and unconditionally private and confidential. We place strict controls over our employee’s access to internal data and are committed to ensuring that your data is never seen by anyone who should not see it.

While the operation of the Slack service would not be possible unless there were some technical employees with sufficient system permissions to enable them to access and control software that stores and indexes the content you add to your Slack instance, all are prohibited from using these permissions to view customer data.

All of our employees are bound to our policies regarding customer data and we treat these issues as matters of the highest importance within our company. If, in order to diagnose a problem you are having with the service, we would need to do something which would expose your data to one of our employees in a readable form, we will always ask you prior to taking action and will not proceed without your permission. Our platform will automatically generate an audit entry of any such access.

We know how important these issues are to you. They are equally important to us. The security, privacy and confidentiality of your information are core to our success as a business and we will continue to be proactive, vigilant and diligent in ensuring its safety.

If you have additional questions regarding data privacy, security or confidentiality we’d be happy to answer them. Please write to feedback@slack.com and we’ll respond as quickly as we can.