Skip to content
Plain Help Center home
Plain Help Center home

Slack App - Security & Data retention

This document is intended to help IT and security teams understand how Plain's Slack integration works, what data it accesses, how that data is protected, and Plain's approach to AI data handling.

1. How the Integration Works

During setup, an admin installs the Plain app into their Slack workspace and explicitly authorizes the scopes listed below. Plain only reads from channels where the bot has been manually invited. No data is collected from Slack channels the app has not been added to.

2. What Data Plain Stores

Plain only processes and stores data from Slack channels where the bot has been explicitly added.

Stored:

  • Message content (text, attachments, files)

  • Message metadata (timestamp, sender, thread structure)

  • Channel membership (which users are in connected channels)

  • Channel metadata (name, ID, type)

Not stored:

  • Data from any channel the Plain bot has not been invited to

  • Slack workspace-level administrative data

  • Direct messages

Retention rules:

  • If a message is deleted in Slack, Plain deletes the message content. A minimal audit trail is retained (the fact that a message existed and was deleted, without the content).

  • If we receive any additional data from Slack's APIs that's not needed for Plain to operate, we automatically delete it after 14 days.

3. AI Features & Zero Data Retention

Plain offers optional AI features that can be used within Slack-connected threads (e.g. AI-suggested replies, thread summarization, smart message grouping). Here is how AI data handling works:

AI Providers

Plain uses OpenAI (GPT-4o) and Anthropic (Claude) to power its AI features.

Zero Data Retention

Plain has opted into OpenAI's Zero Data Retention (ZDR) policy. This means:

  • Conversation data sent to OpenAI is not stored by OpenAI after the API call completes.

  • OpenAI does not use Plain customer data to train its models.

The same applies to Anthropic: customer data sent to Anthropic is not used for model training.

Opt-in / Opt-out

  • AI features are enabled by default but can be disabled entirely by a workspace admin in Settings → Plain AI → Configuration

  • When AI is disabled, no customer conversation data is sent to any third-party AI provider

  • Changes take effect immediately

Sub-processors

Full details on data processing agreements with OpenAI and Anthropic are covered in Plain's Data Processing Agreement (DPA) and our SOC2 report can be found at trust.plain.com.

Powered by Plain