# Slack Security Review
# Classification: Confidential
# Date: 2026-06-09
# Reviewer: Claude Code (drafted); pending Founder approval
# Status: Draft

---

## 1. Vendor / Device Overview

| Field | Value |
|---|---|
| **Name** | Slack Technologies, LLC (a Salesforce, Inc. company) |
| **Website** | slack.com · trust: slack.com/trust · compliance.salesforce.com/en/services/slack |
| **Service / purpose** | Internal team communications |
| **CBB use case** | Internal comms — per-repo GitHub activity channels, product discussion, ops. Classified a **General (Tier 2)** surface. |
| **Data tier(s) accessed** | Tier 2 (General) only — by written, pinned policy |
| **Access type** | Slack app/bot (OAuth scopes) + member accounts; MCP integration for messaging |
| **Proposed onboarding date** | Already in production — retrospective review |

---

## 2. Data Exposure Assessment

### 2.1 What CBB data will this vendor / device access?

- Internal team messages, channel contents, uploaded files
- GitHub activity notifications (commit/PR/issue metadata per repo)
- Product discussion (`#scopedope-general`) — non-trade-secret level

**Pinned data-classification policy explicitly prohibits in Slack:** SPEC/engine internals, financial records, legal documents, customer/user data, credentials/secrets. Policy is posted and pinned in `#all-cold-bore-ballistics-llc`.

### 2.2 Where will CBB data be stored by this vendor?

On Slack/Salesforce infrastructure. **Current plan: Slack Free** → only the most recent **90 days** of message history is accessible (older messages are retained by Slack but hidden until a paid upgrade). Encrypted in transit and at rest. Salesforce participates in the EU-U.S. Data Privacy Framework (+ UK extension, Swiss-U.S.).

### 2.3 Is any Highly Confidential data (Tier 4) involved?

- [ ] Yes
- [x] **No** — Tier-4 material is prohibited by the pinned policy. Slack is a Tier-2 surface by design.

> **Standing control:** the data-classification policy is the load-bearing control. It is documented, pinned, and manually enforced (no automated DLP at this plan tier).

---

## 3. Vendor Security Posture (Software vendors only)

### 3.1 Compliance and certifications

| Standard | Certified? | Notes |
|---|---|---|
| SOC 2 Type II | Yes | Slack SOC 2 (+ SOC 3); report via Salesforce Compliance Site |
| ISO 27001 | Yes | ISO/IEC 27001:2022 (as of Feb 2026); also ISO 27017, ISO 27018 |
| GDPR compliant | Yes | GDPR/CCPA; EU-U.S. DPF participation via Salesforce |
| CCPA compliant | Yes | Addressed via Salesforce privacy program |

> Reviewer to pull the current Slack-scoped SOC 2 Type II from compliance.salesforce.com at approval and confirm scope covers the services CBB uses.

### 3.2 Data processing agreement

- [x] DPA available via Salesforce/Slack legal terms
- [ ] Not available

### 3.3 Breach history

No publicly disclosed material breach of Slack customer message data in the past 3 years known at drafting (a Dec 2022 GitHub-hosted Slack *source-code* repo access incident did not affect customer data/Slack production per Slack's disclosure). Reviewer to re-check at approval.

### 3.4 Security documentation

- [x] Trust/compliance pages published (slack.com/trust, Salesforce Compliance Site)
- [x] SOC 2 / ISO reports available
- [x] Responsible disclosure / bug bounty (Salesforce)

### 3.5 Authentication and access control

- [x] MFA supported (enforce on all members) — in-tier
- [—] SAML SSO — **deferred (tier-gated, §7)** — not available on the **Free** plan; needs Business+ (SSO) / Enterprise Grid. Not material at headcount = 1.
- [x] App/bot OAuth scoping
- [x] Token-based API access (scoped)

---

## 4. Hardware Security Assessment

**N/A** — software/SaaS vendor.

---

## 5. Integration Security

### 5.1 Credential management

- [x] Slack app/bot tokens scoped to required OAuth scopes; stored in the CBB credential store / Key Vault as applicable *(reviewer to confirm token storage location)*.
- [x] GitHub→Slack integration uses the official GitHub app (per-repo notifications).
- [x] No CBB credentials/secrets are posted in Slack channels (prohibited by policy).

### 5.2 Network exposure

Cloud SaaS; outbound webhooks (GitHub → Slack). No inbound firewall rule or public IP on CBB infrastructure.

### 5.3 Offboarding plan

Revoke app tokens, remove the GitHub integration, export workspace data, transfer ownership (Admin console → Members → Change role to Owner) or deactivate. **Note: on the Free plan only the most recent 90 days of message history is accessible/exportable** — full-history export and compliance export are tier-gated (§7).

---

## 6. Risk Summary

Risks are assessed **at the current tier (Slack Free)**. Controls requiring a paid tier (SSO, automated DLP, full-history/compliance export, longer retention) are **not** open conditions here — they are recorded in §7 (Deferred) and activate only on the relevant tier move.

| Risk | Likelihood | Impact | Mitigation (in-tier) |
|---|---|---|---|
| Tier-3/4 content posted to Slack against policy | L | H | Pinned classification policy; manual enforcement; periodic channel audit. (Automated DLP would add a second layer — deferred, §7.) |
| Vendor breach of message data | L | M | SOC 2/ISO vendor; Tier-2 data only; no secrets/customer data present |
| Single-owner account compromise | L | M | MFA enforced; SSO would harden this — deferred, §7 |

**Overall risk rating:** **Low** — at the current tier, the pinned data-classification policy is the load-bearing control and Slack holds only Tier-2 data. The tier-gated absences (SSO, DLP) are accepted tier decisions, not open risks.

**Recommendation:** **Approve with conditions** — pending Founder sign-off.

**Conditions (in-tier — actionable now):**
1. Confirm current Slack-scoped SOC 2 Type II covers used services (Salesforce Compliance Site).
2. Confirm MFA enforced for all members.
3. Confirm where Slack app/bot tokens are stored (Key Vault preferred).
4. Add Slack to the "CBB Risk Register" SharePoint List (note the deferred-control acceptances from §7).

---

## 7. Deferred — Pending Tier Move

The following require a **paid Slack tier above the current Free plan** and are **deliberately deferred** until CBB moves to that tier. Documented for acquisition visibility; **not** open conditions at the current tier.

| Deferred control | Requires | Why it's wanted | Trigger to activate |
|---|---|---|---|
| **SAML SSO / SCIM** | Business+ (SSO) / Enterprise Grid | Centralized identity, single-sign-out on offboarding | First external hire (security-hygiene threshold) |
| **Automated DLP scanning** | Enterprise Grid | Machine backstop behind the manual classification policy | If an acquirer's security posture or compliance requires it |
| **Full message history + compliance/eDiscovery export** | Any paid plan (history); Enterprise Grid (compliance export/DLP API) | Free plan exposes only the most recent 90 days; full retention/export needed for records | On first paid-plan upgrade |
| **Longer/unlimited retention** | Paid plan | Free = 90-day history cap | On first paid-plan upgrade |

> Each item, when triggered, requires its own **cost-impact analysis + Founder approval** before the plan upgrade (CLAUDE.md). At headcount = 1, pre-1.0, none of these is material today.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (`03_-_Confidential/`) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/Slack/Slack_Security_Review.md` |
| **Cross-references** | `Slack_Architecture_Reference.md`; `Slack_Acquisition_Brief.md`; "CBB Risk Register" SharePoint List |
| **Created** | 2026-06-09 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-09 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| DRAFT | 2026-06-09 | Claude Code | — | — | Initial draft. Posture verified via Salesforce Compliance Site (SOC 2 Type II, ISO 27001:2022 as of Feb 2026, EU-U.S. DPF). Documents Tier-2 classification, pinned data-policy control, and plan-tier SSO/DLP gaps. Recommends Approve with conditions. Version number to be assigned by Founder. |
| DRAFT | 2026-06-09 | Claude Code | — | — | **Current plan confirmed = Slack Free** (Founder). Corrected the earlier "unlimited retention" claim (that was a Business Standard fact) to Free's **90-day** history cap (§2.2, §5.3). Reclassified SSO, automated DLP, full-history/compliance export, and longer retention from conditions to new **§7 Deferred — Pending Tier Move** (per Founder rule). Risk summary recomputed in-tier. |
