Slack AI

Slack states as a stated AI principle that customer data is never used to train large language models, naming messages and files specifically.

Slack documents global retention policies, legal holds and e-discovery support as customer-configurable controls over how long content is kept.

Requires written confirmation — see Before you sign ↓

Not found in the public sources scanned — ask the vendor directly.

Requires written confirmation — see Before you sign ↓

Data residency appears in Slack's compliance resource set as a named control area, indicating regional storage options are offered rather than a single global location.

Confirm in writing: Ask the vendor to state this in writing before signing.

Slack publishes an RFC 9116 security.txt naming its HackerOne programme as the contact and policy for reporting vulnerabilities, with a public acknowledgements page.

Confirm in writing: Ask the vendor to state this in writing before signing.

Slack publishes three AI principles, the first of which is that customer data is never used to train large language models, naming messages and files specifically rather than referring vaguely to "your data".

Slack carries an unusual amount of an organisation's unstructured internal conversation, so this is the question that decides whether Slack AI is adoptable at all. Naming messages and files removes the ambiguity most vendors leave in place.

Question for vendor: Please restate the no-training commitment contractually, covering any AI feature added after signature.

Admins can turn AI features on or off at any time, and Slack AI operates only on content the requesting user already has permission to view.

Together these support a staged rollout and remove the most common AI failure in a collaboration tool — surfacing content to someone who could not otherwise reach it. The permission inheritance matters more here than in most products, because Slack's private channels and DMs are exactly where the sensitive material sits.

Question for vendor: Do the permission rules apply identically to private channels, DMs and connected external channels?

Slack states it also uses predictive machine learning models for experience features such as emoji suggestions and name autocomplete, described separately from its LLM features.

The no-training commitment is scoped to large language models. Predictive ML on customer signals sits outside that wording, and an organisation switching AI features off may still be within scope of these models. It is a scope question, not an allegation — but it is the kind of gap a governance review should close in writing.

Question for vendor: Does the "never used to train" commitment extend to your predictive ML models, and can those be disabled?

ISO/IEC 27001, 27017 and 27018 each carry a download link, and SOC 2 and SOC 3 are stated alongside them.

Most vendors in this directory list certifications without publishing the certificate, which leaves scope unverifiable from outside. Offering the documents is the difference between a claim and something a buyer can check — though this collection captured the index rather than the certificates, so the scope statements are still unread.

Question for vendor: Do the ISO/IEC 27001 and 27701 scope statements name Slack AI?

Nothing in the sources scanned names which large language models or providers sit behind Slack AI, and no subprocessor register was retrievable in this collection.

The no-training commitment binds Slack, but a buyer cannot see whose models process their content, in which jurisdiction, or what changes when Slack swaps one. Slack has published elsewhere that its LLMs run inside its own AWS VPC, which would materially reduce this exposure — that page did not survive collection here, so it is unresolved rather than absent.

Question for vendor: Which model providers serve Slack AI, are the models hosted within your own infrastructure, and where is the subprocessor list?

Slack publishes a coordinated vulnerability disclosure route through HackerOne, but nothing in the collected sources covers breach notification timeframes or how customers are told when AI features or underlying models change.

These are ordinary contract schedule items rather than exotic asks. Their absence from the public material does not imply absence from a negotiated agreement, but they cannot be assessed from outside and should be requested directly.

Question for vendor: What are your breach notification timeframes, and how are customers notified of changes to AI features or models?