The Lawyer’s Guide to Discovery and Investigations in Slack

‍

Retaining all information is Slack’s default setting. This includes free accounts, where administrators have access to only 10,000 of the most recent messages—but, under this retention setting, Slack itself preserves them all.

If an administrator does not take action to change their retention policy, they could soon find themselves sitting upon a vast history of Slack conversations, reactions, integrations, and more—a potentially valuable resource, or a possibly costly liability, depending on your perspective.

Alternatively, if an administrator sets too liberal of a retention schedule, or does not adjust the retention schedule in light of a legal hold or reasonably foreseeable litigation, spoliation could follow. Further, where individual team members control the retention of data in private channels and direct messages, one user’s messages could be eradicated at the end of every day, while another’s are preserved for all time.

‍

For all but free accounts, retention settings can be chosen for the workspace as a whole as well as for private channels and direct messages, allowing retention policies to be tailored to specific channels as one might to traditional email inboxes and custodians. But, again, those retention policies must be actively monitored to ensure that Slack data is not edited, destroyed, or otherwise spoliated.

How Slack Account Type Impacts Retention Settings

The ability to customize retention policies, as with most workspace administration features, depends on the type of Slack account used. Slack currently has four account types available:

• Free
• Pro
• Business+
• Enterprise Grid

These plans differ primarily in cost, storage size, and admin features. Plus and Enterprise plans, for example, can limit who can post in specific channels—other accounts cannot. Paid plans can set retention policies around private channels and direct messages; free plans cannot. Enterprise accounts, which span multiple workspaces, can apply retention settings across all of their Slack workspaces, a feature not available to any other account type.

‍

Constantly Changing Data

Even when Slack data sizes are small, they can be hard to get one’s hands around. One reason for this is that conversations may take place in a muddle of formats—across public channels, private DMs, and comments on documents.

Another is that most Slack data is easily editable. An offensive photo can be deleted, a mistaken disclosure erased. A message that says one thing today can be edited to say another tomorrow.

Yet Slack creates a record of such alterations, often without users realizing it. If a Slack workspace retains editing and deletion information, those changes will be recorded in the metadata—and available in a review tool that knows how to process Slack data.

Exporting Data From Slack—or Collecting Directly from your eDiscovery Tool

For teams looking into Slack data, accessing everything Slack records can be difficult. Currently, Slack allows workspace owners and administrators in all plans to easily export data from public channels.

To export that available data, administrators can navigate to their workspace settings and select 'Import/Export Data.'

Administrators can export workspace data based on date ranges including:

• Data from the last 24 hours
• Data from the last 7 days
• Data from the last 30 days
• Data for the entire workspace history
• Data for specific date ranges

Once an export request is processed, the data can be downloaded in a .zip file with message history in JSON format and links to shared files. For single user’s channels and conversations, however, data can also be exported in TXT format.

‍