Security

§1 Our Approach

SlackXO archives sensitive business communications, so we state plainly what we do, what we don't do yet, and where the limits are. Nothing on this page is a certification claim.

§2 What We Do Today

• Encrypted at rest. Slack access tokens, archived messages, and downloaded attachments are encrypted before they are written to storage, using authenticated encryption (Fernet: AES-128 with HMAC-SHA256).
• Tamper-evident audit trail. Every backup, search, export, hold, restore, and settings change is written to a hash-chained log. Altering an earlier entry breaks the chain visibly.
• Invite-only access. The person who installs becomes the workspace admin. Everyone else must be invited by an admin, and roles are limited to admin and viewer.
• Workspace isolation. Each customer workspace is separated by account in our database and archive storage.
• U.S. hosting. The Hosted plan runs on Railway in a U.S. region.
• Deletion policy. After cancellation your data stays exportable for 90 days, then is permanently deleted.
• Payments. Handled by Stripe. We never store card numbers.

§3 Slack Access

SlackXO uses Slack's standard Web API through the normal install flow. It requests these bot permissions: channels:history, channels:read, groups:history, groups:read, im:history, im:read, mpim:history, mpim:read, users:read, files:read, and chat:write. Together they allow reading message history and member names in the public and private channels the app has been invited to, reading shared files, and posting messages (used only by the Restore feature). Slack does not give apps access to direct messages between other people, so those are not archived. SlackXO can only archive conversations it has been added to. You can remove the app from Slack at any time, which immediately revokes our access.

§4 What Gets Archived

• Public and private channels the app has been invited to
• Not archived: direct messages between people, which Slack does not make available to apps like SlackXO
• Threads and replies
• Files shared in those conversations, where Slack permits access
• Edit history only for versions observed across our daily backups. Backups are daily, not continuous.

SlackXO does not use Slack's Discovery API, so it does not capture content it has not been added to across an Enterprise Grid org. See Support for details.

§5 Restore Behavior

Slack does not allow apps to repost as the original author or with the original timestamp. Restored messages are posted by the SlackXO app with a label naming the original author and date. They are labeled reconstructions, not exact replays. Every restore is recorded in the audit trail.

§6 Limits and What We Have Not Done Yet

• SlackXO is not SOC 2 certified. It is a tool that helps support your own SOC 2 and SOX work, not a substitute for your auditor's sign-off.
• We have not yet had an independent security assessment or penetration test.
• Encryption keys are held by SlackXO in our hosting environment, not by the customer, and we do not offer customer-managed keys. Someone with administrative access to that environment could in principle obtain them.
• Backups are daily and capture only what the app can see at that time.

§7 Data Processing Agreement

A data processing agreement is available on request. Email hello@slackxo.com.

§8 Security Incidents

If we confirm a security incident affecting a workspace's archived data, we will notify that workspace's administrators without undue delay and tell them what we know.

§9 If SlackXO Ever Shuts Down

If we ever discontinue the service, we will give customers at least 90 days' notice and keep full export available throughout that period. You can also export your entire archive at any time, so you are never dependent on us to hold the only copy.

§10 SlackXO and Slack's Built-In Tools

Depending on your plan, Slack has its own retention and export features, and you should check what yours includes. SlackXO is for teams that want an independent copy kept outside Slack, with its own tamper-evident audit trail, litigation holds, and restore. It does not replace Slack's Discovery API program for org-wide legal discovery.

§11 Reporting a Security Issue

If you believe you've found a vulnerability, email hello@slackxo.com with details. We'll acknowledge it and follow up.