Does Slack AI train on your workspace messages? Opting out is possible, but only the workspace owner can do it and it is done by email rather than a setting.
Important: there are two different Slack AI things
"Slack AI" can refer to two distinct products with different defaults and different privacy postures, and the May 2024 controversy conflated them in ways that still confuse SMB owners.
Slack's general-purpose ML models (channel recommendations, emoji suggestions, search ranking). These have used de-identified aggregate customer data for training by default since at least September 2023. Opt-out exists but requires a workspace owner to email feedback@slack.com with a specific subject line — not a self-serve toggle.
Slack AI (the generative AI features: conversation summaries, channel recaps, AI-powered search, now included in each plan at the level shown below rather than sold as an add-on). Slack says it hosts its off-the-shelf LLMs on its cloud provider's infrastructure, such as AWS, that customer data stays within Slack's trust boundary, that the LLM providers have no access to it, and that “Slack will not use Customer Data to train generative AI models unless Customer provides affirmative opt-in consent.” Corrected 25 October 2026: we previously said Slack AI runs primarily on Anthropic's Claude via AWS Bedrock; Slack's privacy principles do not name a model provider. Re-verified 3 September 2026 against Slack's own Privacy Principles page, which puts this more strongly than we had: "Slack will not use Customer Data to train generative AI models unless Customer provides affirmative opt-in consent." That is an opt-IN requirement for generative AI, the opposite default to the general-purpose ML models above, and that contrast is the whole reason this profile separates the two.
The May 2024 backlash was about the first product. Slack's clarification was substantially about the second product. The two are different. Most SMB owners conflate them.
Plain-English risk rating: 3 of 5
Correction, 5 September 2026: we withdraw our own scope note of 3 September 2026. It said this rating covered a product that does not exist on Slack’s free plan. Slack’s pricing page on 5 September lists “Basic AI” on the Free plan — conversation summaries, Slackbot, workflow generation, AI search, daily recaps and file summaries. The same feature list appears on Pro; Business+ and Enterprise+ group it as “Advanced AI” and “Enterprise-Grade AI” without the page saying what the difference buys. We cannot tell you whether Slack changed the page in the two days between our readings or whether we read it wrong, and we are not going to guess between those. The rating below has not been moved and is being re-checked.
Mid-range risk for the Slack workspace as a whole. The May 2024 "email to opt out" controversy was a transparency and UX failure rather than a fundamental data-handling failure — the general-purpose ML models do use de-identified aggregate data, not raw message content. But the opt-out posture (workspace-owner-email-required) remained in place even after the policy clarification, which is a deliberate choice that signals where Slack/Salesforce stands on consent defaults.
The inherited Salesforce Einstein Trust Layer for tenant-isolated AI workloads brings the paid Slack AI tier closer to a 2 of 5. But the bundled product where most SMBs encounter Slack AI is the workspace itself, where the default ML training applies.
Recommended for
- Sole proprietor: If you use Slack at all, the default applies. The marginal harm is low for individual users (de-identified aggregate metadata, not message content), but the consent default is worth flagging.
- Small team (2-10 people): If you handle client data in Slack DMs or private channels, have your workspace owner email feedback@slack.com with the opt-out request. Slack AI is no longer sold separately, so choose a plan by the AI features your team will actually use.
- Regulated industry: Slack Enterprise Grid with Enterprise Key Management (EKM) for tenant-controlled encryption, plus the workspace-owner opt-out from general-purpose ML training, plus restriction of Slack AI to non-regulated channels only.
- The honest answer for most 1-10 employee businesses: Slack is the workplace messaging substrate for most SMBs and switching is impractical. The right posture is: opt out via the workspace owner email, treat Slack DMs as not-end-to-end-encrypted business communication (because they aren't), and choose a plan by the AI features your team will actually use rather than by feature lists.
Data retention default
- General-purpose ML models: De-identified, aggregate customer data used for training (channel recommendations, emoji suggestions, search ranking) unless workspace owner opts out via email request
- Slack AI: LLMs hosted on Slack's own cloud infrastructure; Slack says the model providers have no access to customer data; not used to train generative models without opt-in
- Standard message retention: Per workspace plan and admin configuration (workspace owners control retention policy)
- Free tier: 90-day message visibility limit (older messages hidden but retained per Slack's retention policy)
Training opt-out
General-purpose ML — TRAINING IS ON BY DEFAULT using de-identified aggregate data. Opt-out is workspace-owner-only and requires emailing feedback@slack.com with the subject line "Slack global model opt-out request" and the workspace/org URL.
Individual users cannot opt out for themselves. The opt-out is workspace-wide and must be initiated by an admin.
Slack AI: NO TRAINING ON CUSTOMER DATA WITHOUT OPT-IN. Slack's privacy principles: “Slack will not use Customer Data to train generative AI models unless Customer provides affirmative opt-in consent.”
What the contract says. Slack's Supplemental Terms (last updated 27 February 2026), which sit under the Salesforce Main Services Agreement, have the customer instruct Salesforce to process Customer Data “to train models for use by the services and features that Customer has access to”, and point to the privacy principles page for how to opt out. The generative-AI opt-in promise quoted above is in the privacy principles, not in those terms. (Read 25 October 2026.)
Zero Data Retention availability
- Slack AI: Slack says its LLMs are hosted on its own cloud infrastructure and the model providers have no access to customer data, which goes further than zero retention at a provider. Slack's privacy principles page does not name the model provider.
- Enterprise Grid with EKM provides tenant-controlled encryption keys for additional data sovereignty
Plan tiers and pricing (as of early 2026)
| Plan | Price (USD, per user per month) | General ML opt-out? | AI features (Slack's plan wording) | Suitable for |
|---|---|---|---|---|
| Free | $0 | Workspace owner must email | Basic AI | Personal/small use; 90-day message visibility |
| Pro | $8.75 monthly or $7.25 billed annually | Workspace owner must email | Basic AI | Small teams |
| Business+ | $18 monthly or $15 billed annually | Workspace owner must email | Advanced AI | Growing teams with admin needs |
| Enterprise+ | Contact sales | Workspace owner must email (no self-serve setting is documented) | Enterprise-Grade AI, plus enterprise search | Larger orgs needing EKM, SSO, compliance |
Prices and plan names as shown on slack.com/pricing, read 15 October 2026 (the page shows no date). Slack no longer lists a separate Slack AI add-on: AI features are included in each plan at the level shown. The only add-on the page names is Enterprise Key Management.
Jurisdiction
- Primary processor: Slack Technologies LLC, a subsidiary of Salesforce, San Francisco, California, USA
- Cloud infrastructure: AWS, which Salesforce's sub-processor list (19 December 2025) names as the hosting provider for all Slack functionality, Slack AI included; Slack AI's LLMs hosted on Slack's cloud infrastructure (privacy principles, read 24 October 2026). The list names no separate AI model provider for Slack.
- EU Data Residency available for qualifying customers
- Subject to Salesforce-level governance per its SEC filings (Cybersecurity & Privacy Committee oversight formalised December 2025)
Breach history (public incidents)
May 2024 — "Email to opt out" controversy and policy clarification
A Slack user posted on Hacker News in May 2024 highlighting that Slack's published privacy principles stated workspace data could be used to train Slack AI models, and that opting out required emailing feedback@slack.com. The post went viral. Industry analysts (Irwin Lazar at Metrigy among others) criticised the consent default. Slack updated its privacy principles to clarify that (a) only de-identified aggregate data is used for general-purpose ML, not raw message content, and (b) the Slack AI does not train LLMs on customer data. The clarification did not change the opt-out mechanism — it remains workspace-owner-email-required.
The incident is important not as a security breach but as a consent-default case study: a policy in place since at least September 2023 only became visible to users when one developer flagged it publicly.
Sources: TechCrunch (May 17, 2024); Polymer analysis; Salesforce Ben coverage; Computerworld policy update reporting (April 2025)
Note on the broader Slack platform: Slack itself has had a substantial history of security incidents that affect Slack AI indirectly (since Slack AI inherits the platform's security posture). The October 2023 EA Sports / Activision Slack breach (social engineering via Slack credentials) and ongoing concerns about session token theft via infostealer malware are baseline platform risks. Slack AI does not introduce new infrastructure-level breach exposure, but it does increase the value of compromising a Slack account (because the AI summarises everything the user has access to).
Note on inherited Salesforce risk: Salesforce-wide breaches (ShinyHunters campaigns against Salesforce Experience Cloud sites during 2025-2026) affect Slack indirectly through the shared infrastructure and identity stack.
Agent features: what it can reach, keep, pass on and do
Checked 23 September 2026. This section describes agent features only and does not change the rating above: agents are not yet part of our scoring method. Everything here comes from Slack’s own published pages, linked at the end of the section. Where Slack does not say something, we say so rather than guess.
What it can reach. Slack calls Slackbot “your personal agent for work” and says it has the same access you do: it only uses Slack data you can already see, so it will not surface private channels or direct messages you are not in. It can also draw on Salesforce, third-party apps installed in your workspace and enterprise search sources, and in deep research mode the web and connected MCP servers.
What it keeps. Slack says AI summaries and AI search answers are temporary and are not stored. Recaps are kept for 90 days. A channel summary produced by a workflow becomes an ordinary message or canvas and follows your workspace retention settings. The pages we read do not say how long Slackbot conversations themselves are kept.
Where your content goes. Slack says customer data never leaves Slack-controlled infrastructure and is never used to train large language models, and that the third-party models it uses run inside its own cloud and do not keep data once a request is processed. That covers Slack’s own AI processing. When Slackbot reaches into a connected app, an MCP server or the web, the pages we read do not describe what those services receive or keep. The general machine-learning default described in the training section above is a separate matter and nothing here changes it.
What it can do without asking. Slackbot can run searches, check your calendar and create documents. Before it edits a shared canvas you have to click confirm. You can also give it recurring tasks, such as sending a reminder, which then run on a schedule (up to three times a day) without a fresh approval each time. Slack names prompt injection as a risk its guardrails are designed to reduce, and owners and admins can restrict which AI features members use and set how strict the content filter is.
What to do.
- Treat every connected app and MCP server as a door Slackbot can open for you. Connect only the ones you need.
- Review recurring Slackbot tasks now and then, because they act without asking each time.
- If you are an admin, decide which AI features your team gets rather than leaving the default.
Sources for this section, read 23 September 2026: Security for AI features in Slack; Guide to the Slack AI guardrails; How to work with Slackbot.
What this means in plain English for SMB owners
Three honest takeaways:
- Your workspace owner needs to send the opt-out email. Individual users cannot do this. The email goes to feedback@slack.com with subject "Slack global model opt-out request" and includes your workspace/org URL. If your workspace owner has not done this, your aggregate metadata is in Slack's general ML training pool.
- Slack's generative AI features have different defaults from its general ML. They do not train LLMs on your data. They are now included in each plan rather than sold as a separate add-on, so the question is which plan's AI level your team will actually use (summaries, recaps, AI search).
- Slack is workplace messaging infrastructure for most SMBs. The realistic posture is configure-and-stay rather than migrate-away. Opt out via the workspace owner email, treat DMs as business records (not private), and choose a plan by the AI features your team will actually use rather than marketing.
Sources
- Slack privacy principles: https://slack.com/trust/data-management/privacy-principles (verified 2026-05-24)
- TechCrunch: Slack under attack over sneaky AI training policy (May 17, 2024)
- Polymer: Inside Slack's AI training controversy (May 2024)
- Salesforce Ben: What's Brewing at Slack controversy coverage (May 2024)
- Computerworld: Slack updates AI privacy principles after user backlash (April 2025)
- Network Right: How to Opt Out of Slack's AI Training Program guide
- Redact.dev: How To Opt Out of Slack AI Training (April 2026)
- AgainstData: How To Opt Out of Slack AI guide (December 2025)
- Salesforce 2026 Proxy Statement (SEC DEF 14A): Cybersecurity & Privacy Committee charter
- Slack: Privacy Principles, Search, Learning and Artificial Intelligence, https://slack.com/trust/data-management/privacy-principles (read 3 September and 24 October 2026)
- Slack Supplemental Terms, https://slack.com/slack-supplemental-terms (last updated 27 February 2026; read 25 October 2026)
- Salesforce Infrastructure and Sub-processors (published 19 December 2025), linked from slack.com/slack-subprocessors (read 25 October 2026)
Related on AI Leakage
- Compare all 29 AI tools in the risk directory — see how Slack AI (Salesforce) stacks up against the rest, tier by tier.
- Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
- Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
- Shadow AI vs AI leakage — why even approved tools like Slack AI (Salesforce) can leak data.
- Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
- Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.
Compare similar tools: Slack AI (Salesforce) is one of 4 tools in AI in team work tools compared, which sets out each one’s rating and what it does with your data, side by side.