Slack Sub-Processors (Salesforce)

This is Salesforce's official sub-processor and infrastructure disclosure list, identifying every third-party entity and Salesforce affiliate authorized to process Customer Data across Salesforce's product portfolio as of June 19, 2026. The document discloses that Amazon Web Services, Microsoft Corporation (Azure), Google LLC, OpenAI, Akamai Technologies, and Cloudflare, among others, process Customer Data for hosting, generative AI inference, content delivery, and analytics purposes, with some CDN providers designated as 'Global,' meaning Customer Data may transit any country regardless of the customer's selected region. The document also states that in the event of an OpenAI service failover, Customer Data is temporarily re-routed to a Microsoft Azure endpoint, with priority given to the customer's provisioned region subject to availability, a condition that may affect data residency commitments for customers with strict localization requirements.

This document is Salesforce's sub-processor and infrastructure disclosure list, published June 19, 2026, governing the processing and storage of Customer Data across Salesforce's portfolio of covered services, with stated legal basis in Salesforce's Master Subscription Agreement and Data Processing Addendum. The document discloses that Customer Data may be processed by a global network of Salesforce-affiliated legal entities, hyperscale cloud providers including Amazon Web Services, Microsoft Azure, and Google LLC, and specialized third-party sub-processors for functions including generative AI inference, text-to-speech, speech-to-text, translation, content delivery, security scanning, and analytics, with processing locations varying by service, feature enablement, and customer-selected region. Notably, several services authorize cross-regional data flows as a function of feature enablement rather than explicit customer election: for example, Einstein Bots NLP functionality routes Customer Data to regions determined by the customer's org location rather than a separate regional selection, and OpenAI failover routing temporarily redirects Customer Data to Microsoft Azure endpoints regardless of the customer's provisioned region. The document engages the EU General Data Protection Regulation, the UK GDPR, and data residency frameworks applicable across the Asia-Pacific, Middle East, and Americas regions, with heightened compliance exposure for customers in regulated industries such as financial services, healthcare, education, and government, particularly where sub-processor chains include global CDN providers described as processing data 'in any country' and generative AI providers operating with failover routing that may cross jurisdictional boundaries.

The document establishes that Customer Data processed through Salesforce's covered services may be handled by a multi-tiered network of sub-processors spanning cloud infrastructure providers, generative AI services, content delivery networks, and specialized vendors, with the specific processors and locations depending on which services and features a customer has enabled. Under these terms, enabling features such as Einstein Bots NLP, Einstein Conversation Insights, Agentforce Speech Foundations, or generative AI capabilities introduces additional sub-processors and may route Customer Data to regions beyond the customer's primary provisioned location. The document states that customers may subscribe to notifications of new sub-processors for active subscriptions by completing a designated form, and may contact their Account Executive or Customer Support regarding data hosting region preferences.