Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision states that CDN providers designated as 'Global' in the sub-processor table may process Customer Data in any country worldwide, irrespective of where the customer's Salesforce environment is provisioned or where the customer is located.
This analysis describes what Slack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Cloudflare, Akamai Technologies, and Amazon CloudFront, each designated as Global CDN providers for multiple covered services including B2C Commerce, Commerce Cloud Einstein, and Salesforce Data 360, are authorized to process Customer Data in any country. This creates a structural limitation on data residency controls for content and assets served through these CDNs.
Under this clause, Customer Data or content served through CDN infrastructure designated as 'Global' may transit or be processed in any country, regardless of the customer's selected processing region. The agreement identifies Cloudflare, Akamai Technologies, and Amazon CloudFront as global CDN providers for several commerce and analytics services.
Cross-platform context
See how other platforms handle Global CDN Data Processing Designation and similar clauses.
Compare across platforms →Monitoring
Slack has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Note that if a CDN is described as 'Global' in the Table, it may process data in any country, regardless of the Customer's location, to better support end-users of the applicable Covered Services.Excerpt from Slack's Sub-Processors (Salesforce)
(1) REGULATORY LANDSCAPE: This provision directly implicates GDPR Chapter V and equivalent international transfer frameworks in jurisdictions where data cannot freely flow to third countries without an appropriate legal basis. The designation of CDN processing as occurring in 'any country' may not align with transfer mechanisms that specify enumerated third countries or require adequacy decisions for each destination. Relevant enforcement authorities include EU supervisory authorities and equivalent bodies in the UK, Brazil, South Korea, and other jurisdictions with transfer restrictions. (2) GOVERNANCE EXPOSURE: Medium to High for customers with strict data residency or localization obligations. The 'any country' language means that the set of countries in which CDN-processed data may reside is not bounded by the sub-processor table's regional listings, creating a gap in transfer impact assessment coverage. (3) JURISDICTION FLAGS: EU and EEA customers, UK customers, Swiss customers, South Korean customers, and Brazilian customers face heightened exposure given their respective frameworks' requirements for lawful third-country transfers. Customers in sectors subject to sector-specific data localization requirements, such as financial services and healthcare, should evaluate whether CDN-routed data falls within the scope of those requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that DPAs with Salesforce include explicit authorization for global CDN processing and that the applicable transfer mechanisms cover the unbounded geographic scope implied by the 'any country' designation. Standard DPA templates that enumerate specific sub-processor locations may not adequately address this provision without amendment. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should identify which covered services in their Salesforce environment utilize globally designated CDNs, assess whether the data transiting those CDNs constitutes personal data under applicable law, and evaluate whether existing transfer impact assessments account for indeterminate processing locations.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that Cloudflare, Akamai Technologies, and Amazon CloudFront, each designated as Global CDN providers for multiple covered services including B2C Commerce, Commerce Cloud Einstein, and Salesforce Data 360, are authorized to process Customer Data in any country. This creates a structural limitation on data residency controls for content and assets served through these CDNs.
Under this clause, Customer Data or content served through CDN infrastructure designated as 'Global' may transit or be processed in any country, regardless of the customer's selected processing region. The agreement identifies Cloudflare, Akamai Technologies, and Amazon CloudFront as global CDN providers for several commerce and analytics services.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Slack.