Slack makes big change to direct message privacy settings

2025-04-27 15:41:47admin

Your boss can probably already read your Slack direct messages.

And if they can't? Well, Slack may be making it easier for them to do so. What's more, the company is changing the process for employees to discover if their bosses are indeed peeping.

SEE ALSO: Beware! Slack leaks are the new email leaks

Slack is a wonderful tool for collaborating with coworkers, and anyone who uses it on a daily basis knows it's also a great way to talk trash, hash out problems, and just generally stay in touch with team members scattered across the globe. A big part of that is the direct message: an ostensibly private chat between up to nine people.

Slack claims that "Only the members included the DM can view and search for its messages and content," which is helpful if, say, you're trying to secretly unionize. Unfortunately, it's not exactly true.

The company has long allowed those paying for its Plus plan to enable something called compliance exports. Once enabled, bosses can export a log of all slack data — including your DMs. However, there was always one large pro-worker catch: You could see if compliance exports were turned on. Additionally, if your boss suddenly enabled them you would be notified, and any direct message you sent before that time would be in the clear.

Things appear to be changing.

In an update buried on a help page, Slack says that as of April 20, 2018, it's doing away with compliance exports. Good news for the privacy-inclined, right? Not exactly. That's because the associated power to read private messages isn't going anywhere.

"Workspaces with Compliance Exports enabled will still have access to all workspace data through the new export tool," explains the update.

A new export tool, you say? And just what powers are included in that tool?

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

"Workspace Owners [with Plus and Enterprise Grid plans] can request access to a self-service export tool to download all data from their workspace," notes the help page. "This includes content from public and private channels and direct messages."

In other words, your boss can still read your direct messages — you just may not have the associated heads up that came when compliance exports were enabled.

To make matters more confusing, the new process for accessing DMs is rather opaque. According to the company, it takes just a few clicks for your boss to apply to get access to every single message.

To request the ability to export, workspace owners follow a simple process:

From your desktop, click your workspace name in the top left.

Select Administration, then Workspace settingsfrom the menu.

Choose Import/Export Datain the top right.

Select Apply Here.

Slack has to approve this application, but here's where it gets tricky: The help page makes no mention as to what goes into the company's decision to approve or deny the application. Over the phone, a Slack spokesperson declined to provide details on the application process.

Notably, it doesn't appear that employees are notified if an employer applies for and is granted the ability to export DMs. This differs from compliance exports, which, when enabled, notified employees. Thankfully, however, a Slack spokesperson confirmed that there is still a way you can check if your boss has access to your DMs.

When logged into Slack, head on over to slack.com/account/team. Once you're on that page, scroll down to the bottom. Under "Exports," check and see what privileges are listed. If it onlylists "PUBLIC DATA CAN BE EXPORTED," then the spokesperson assured us that your boss cannot pull your DMs. If it lists private data, well, then you're out of luck.

Oh, also, it's not clear just how far back into your DMs the export goes. Is it for all time, or just for the time following the approval of the company's application?

Importantly, just because your company has applied for and been granted the ability export your DMs doesn't mean it has actually exported them. Confusing, right? Determining whether or not your boss has done so, unfortunately, is going to take some goodwill on their part. Slack confirmed that it is the employer's responsibility to notify their employees if they have accessed their DMs.

But you are not completely powerless. In addition to checking the aforementioned settings page, go ahead and switch the message retention policy on every single oneof your direct message conversations. Set it to one day. That way, your DMs will be deleted after 24 hours. To do so, go to the direct message thread in question, click the gear icon, select "edit message retention," choose "use custom retention settings for this conversation," and under "delete messages and their revisions after:" put in one day. Make sure you click save.

Slack may have changed things on its end, but that doesn't mean you can't look out for yourself.

UPDATE: March 21, 2018, 3:59 p.m. EDT: This story has been updated to include additional details provided by a Slack spokesperson.

Featured Video For You

Here's 5 tips for Spring cleaning your digital footprint