TechPrufer
Get started
Slack
Slack logoSlack · Feature trail

Enterprise Search and External App Integration

2 posts · Apr 2024 – Mar 2025

What this trail covers

This thread tracks the evolution of Slack's enterprise search capabilities, focusing on secure and private integration of external application data. Initial posts detail the foundational architecture for securely surfacing content from sources like Google Drive and GitHub directly within Slack's search and AI Answers. Key principles include data isolation within Slack's trust boundary, no training on customer data, operating only on user-visible data, and seamless integration with existing compliance offerings. This post details the architecture for Slack AI, emphasizing how customer data is kept within Slack's trust boundary, LLMs are not trained on customer data, AI operates only on user-visible data, and enterprise-grade security and compliance are upheld. It highlights the use of AWS escrow VPCs for hosting foundational models and Retrieval Augmented Generation (RAG) for stateless, context-aware AI operations.

All Slack trails
  1. How we built enterprise search to be secure and privateThis post details the federated, real-time architecture for enterprise search, which integrates external application data (Google Drive, GitHub) into Slack search. It emphasizes not storing external data, using public search APIs, and relying on OAuth for up-to-date, permissioned results. The post also highlights the explicit opt-in process for admins and users, and adherence to the principle of least privilege by requesting only necessary OAuth scopes.
  2. How We Built Slack AI To Be Secure and PrivateThis post details the architecture of Slack AI, focusing on security and privacy. Key contributions include: 1. Hosting foundational LLMs within Slack's trust boundary using AWS escrow VPCs to prevent data leakage to model providers. 2. Employing Retrieval Augmented Generation (RAG) to ensure stateless AI operations, preventing LLM training on customer data and grounding results in company knowledge. 3. Enforcing that Slack AI only operates on user-visible data by reusing existing ACLs and data fetching libraries. 4. Integrating Slack AI with existing enterprise compliance infrastructure, such as Encryption Key Management and International Data Residency, and ensuring derived content (e.g., summaries) is invalidated if the source message is tombstoned by DLP.