10 Total
4 High severity
6 Medium severity
0 Low severity
Summary

This is Slack's main legal agreement that governs how businesses and their employees can use the Slack workplace messaging and collaboration platform. The most important thing to know is that Slack may use the messages, files, and data shared in your workspace to train and improve its AI features unless your organization's administrator explicitly opts out of this data use. If you work for an organization that uses Slack, ask your IT or legal team whether your workspace has opted out of AI training data use.

Technical Summary

Slack's Main Services Agreement (MSA) governs the contractual relationship between Slack Technologies, LLC (a Salesforce subsidiary) and Customer entities that purchase or use Slack's cloud-based collaboration services, establishing rights and obligations under a B2B framework where individual end users are governed through the Customer's acceptance of the MSA. The agreement imposes significant obligations on Customers to serve as the primary data controller for Customer Data, to obtain all necessary consents from end users, and to ensure compliance with acceptable use policies, while Slack retains broad discretion to modify, suspend, or terminate services with relatively limited notice requirements. Notable provisions include a mutual limitation of liability capping damages at fees paid in the prior 12 months, a carve-out permitting Slack to use aggregated and de-identified usage data for service improvement and business purposes even after agreement termination, and an AI/machine learning training use provision that allows Slack to process Customer Data to develop and improve AI features unless opted out. The agreement engages GDPR (Articles 6, 28, and 46) through its Data Processing Addendum (DPA) framework, CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.) through its privacy policy incorporation, and implicates EU AI Act obligations given Slack's expanding AI feature set. Material compliance considerations include the adequacy of the Customer's data processing authority, the enforceability of the DPA as a GDPR-compliant data processing agreement, and the scope of Slack's reserved rights to use Customer Data for AI training purposes absent an explicit opt-out.

Evidence Provenance
Captured April 19, 2026 06:14 UTC
Document ID CA-D-000191
Version ID CA-V-000732
Wayback Machine View archived versions →
SHA-256 903983353b5e7b5755f681c28b6974fd4ccc7c02ead4886f927d8cde7158004b
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Institutional Analysis

🔒 Institutional analysis locked

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Upgrade to Professional — $149/mo
Change Timeline
View full version history (0 captures) →
High Severity — 4 provisions
Medium Severity — 6 provisions

Cross-platform context

See how other platforms handle AI Training Data Use and similar clauses.

Compare across platforms →

Applicable Regulations

EU AI Act
European Union
CCPA/CPRA
California, USA
CFAA
United States Federal
CAN-SPAM
United States Federal
GDPR
European Union
UK GDPR
United Kingdom