What are the institutional and regulatory implications of this document?

(1) REGULATORY LANDSCAPE: This document engages the EU General Data Protection Regulation, the UK GDPR, and national data protection laws across jurisdictions where Salesforce operates data centers or sub-processors, including Australia, Japan, South Korea, India, Brazil, Canada, Switzerland, Israel, and the UAE. GDPR Articles governing data processor obligations, sub-processing authorizations, and international data transfers are directly implicated, particularly where sub-processors are desig…

How does Slack's Slack Sub-Processors (Salesforce) affect users?

The document establishes that Customer Data processed through Salesforce's covered services may be handled by a multi-tiered network of sub-processors spanning cloud infrastructure providers, generative AI services, content delivery networks, and specialized vendors, with the specific processors and locations depending on which services and features a customer has enabled. Under these terms, enabling features such as Einstein Bots NLP, Einstein Conversation Insights, Agentforce Speech Foundatio…

How often is Slack's Slack Sub-Processors (Salesforce) updated?

ConductAtlas monitors this document daily and captures every version with cryptographic hashing and timestamp verification. Update frequency varies — see the change timeline on this page for complete version history.

Can I get alerted when Slack updates this document?

Yes. Monitor subscribers ($19/month) can add Slack to their watchlist and receive same-day email alerts whenever this document or any other Slack document changes.

CA-D-000931

Slack Sub-Processors (Salesforce)

Slack

Last change detected July 6, 2026 Sub processor list

SHA-256: 4d113b73d4233ba0547… 1 version captured 0 changes documented

Create free account

Track 3 platforms and get the weekly governance digest. No credit card required.

View original document at Slack ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

10 Total

0 High severity

7 Medium severity

3 Low severity

Summary

This is Salesforce's official sub-processor and infrastructure disclosure list, identifying every third-party entity and Salesforce affiliate authorized to process Customer Data across Salesforce's product portfolio as of June 19, 2026. The document discloses that Amazon Web Services, Microsoft Corporation (Azure), Google LLC, OpenAI, Akamai Technologies, and Cloudflare, among others, process Customer Data for hosting, generative AI inference, content delivery, and analytics purposes, with some CDN providers designated as 'Global,' meaning Customer Data may transit any country regardless of the customer's selected region. The document also states that in the event of an OpenAI service failover, Customer Data is temporarily re-routed to a Microsoft Azure endpoint, with priority given to the customer's provisioned region subject to availability, a condition that may affect data residency commitments for customers with strict localization requirements.

Technical / Legal Breakdown

This document is Salesforce's sub-processor and infrastructure disclosure list, published June 19, 2026, governing the processing and storage of Customer Data across Salesforce's portfolio of covered services, with stated legal basis in Salesforce's Master Subscription Agreement and Data Processing Addendum. The document discloses that Customer Data may be processed by a global network of Salesforce-affiliated legal entities, hyperscale cloud providers including Amazon Web Services, Microsoft Azure, and Google LLC, and specialized third-party sub-processors for functions including generative AI inference, text-to-speech, speech-to-text, translation, content delivery, security scanning, and analytics, with processing locations varying by service, feature enablement, and customer-selected region. Notably, several services authorize cross-regional data flows as a function of feature enablement rather than explicit customer election: for example, Einstein Bots NLP functionality routes Customer Data to regions determined by the customer's org location rather than a separate regional selection, and OpenAI failover routing temporarily redirects Customer Data to Microsoft Azure endpoints regardless of the customer's provisioned region. The document engages the EU General Data Protection Regulation, the UK GDPR, and data residency frameworks applicable across the Asia-Pacific, Middle East, and Americas regions, with heightened compliance exposure for customers in regulated industries such as financial services, healthcare, education, and government, particularly where sub-processor chains include global CDN providers described as processing data 'in any country' and generative AI providers operating with failover routing that may cross jurisdictional boundaries.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Get Compliance

Medium — 7 provisions

OpenAI Failover Cross-Regional Routing

This provision states that if OpenAI's services experience a failover event, Customer Data will be temporarily redirected to a Microsoft Azure endpoint, with the document noting that regional priority is subject to availability rather than guaranteed.

Added July 6, 2026 Rare
Global CDN Data Processing Designation

This provision states that CDN providers designated as 'Global' in the sub-processor table may process Customer Data in any country worldwide, irrespective of where the customer's Salesforce environment is provisioned or where the customer is located.

Added July 6, 2026 Rare
Sub-processor Notification Subscription Mechanism

This provision establishes an opt-in notification mechanism through which customers can receive advance notice of new sub-processors for services they actively subscribe to, accessed by completing a designated form.

Added July 6, 2026 Rare
Feature-Triggered Sub-processor Activation and Cross-Regional Data Flows

This provision establishes that enabling specific product features, including Einstein and Agentforce capabilities, triggers the activation of additional infrastructure providers and sub-processors beyond those used for the base service, with Customer Data processed by those additional entities and locations as a consequence of feature enablement.

Added July 6, 2026 Rare
Identifying Information Storage Outside Provisioned Region

This provision discloses that identifying information about customer instances and users may be stored across Salesforce's global processing locations for operational purposes including login facilitation and customer support, independent of the customer's selected region, with a specific exception for Government Cloud Plus services where such information is one-way hashed before leaving designated data centers.

Added July 6, 2026 Rare
Middle East Data Routing to European Union

This provision states that due to the ongoing situation in the Middle East, customer organizations hosted in the UAE are routed to an EU location, trial and Scratch Org sign-ups from several Middle Eastern countries are routed to the EU, and Israeli commercial customer data is temporarily backed up to an EU location pending resolution of the crisis.

Added July 6, 2026 Rare
Generative AI Sub-processors for Multiple Covered Services

This provision discloses that OpenAI and Microsoft Corporation (Azure) are authorized sub-processors for generative AI services across multiple covered services including Automotive Cloud, Consumer Goods Cloud, Financial Services Cloud, Education Cloud, Enhanced Messaging, and Agentforce Operations, with Customer Data processed in the United States and additional regions depending on the service.

Added July 6, 2026 Rare

Low — 3 provisions

Customer Data Regional Selection and Region-Affecting Interdependencies

This provision establishes that regional data hosting selection is available for many covered services, either during setup or by request through an Account Executive, subject to availability, and that the selected region for one service may determine the processing region for related or dependent services.

Added July 6, 2026 Rare
Einstein Bots NLP Region-Determined Data Routing

This provision states that enabling NLP functionality for Einstein Bots causes Customer Data to be routed to a specific region determined by the location of the customer's Salesforce Services org: Germany for EMEA, Japan, India, or the United States for APAC, and the United States for all other regions.

Added July 6, 2026 Rare
Scope Inclusion of Pre-General-Availability Services

This provision states that the sub-processor list may include services or features that have not yet been released to general availability, included for the purpose of advance disclosure, and that such inclusion does not create an obligation for Salesforce to deliver those services or features.

Added July 6, 2026 Rare