Direct messages (DMs) are smaller conversations in Slack that happen outside of channels. They can be one-to-one, or include up to nine people. DMs work well for one-off conversations that don’t require an entire channel of people to weigh in. Note: If your company uses Slack Connect, learn how to send DMs to people outside your organization.
When you convert a DM to a private channel, new people you add to the channel can view the original DM's message history and files. Members of the group DM will be notified about the move with a Slackbot message posted to the new channel. DMs with people outside your company cannot be converted to private channels. Updated March 24, 2021 at 2:35 pm ET: In response to concerns raised over potential for abuse, Slack has disabled the ability to customize the message inviting people to try the cross-org DM.
UPDATE: March 21, 2018, 10:59 a.m. PDT:Slack is changing its policies around this, and doing away with Compliance Exports altogether. However, that doesn't mean your DMs are necessarily safe. In fact, the situation could be even worse. Read our follow up story for more details.
Slack, like office gossip, is a part of modern day work life. And so it's only natural to wonder just who, exactly, is privy to all the juicy tidbits you and your coworkers share over direct message. Could your boss be reading those comments about his ugly tie — or, much more seriously, your plans to unionize?
Slack Instant Messaging
While some will argue that you should never send a message you wouldn't want a manager to see, that level of caution is extremely difficult for many who work remotely or with coworkers spread across the world. It's not like you can have a casual, off the record lunch with your team when your closest coworker is thousands of miles away. Thankfully, there is a way to find out what Slack privacy settings your company has in place.
SEE ALSO: Slack announces a new screen-sharing tool that lets coworkers control your computer
First, let's cover the basics. Obviously, public channels can be joined by anyone. Their contents are searchable, so even if your boss hasn't joined a channel, it doesn't mean he or she can't see its contents. Second, while Slack says both a private channel (identified with a little lock icon) 'and its contents are visible and searchable only to the channel members,' your messages there cease being private the second a boss gets wind of the channel and insists someone invite them in.
Where does that leave a corporate dissident? That would be the classic direct message. On Slack, DMs can be between two or more people, and the company explains that '[they're] visible and searchable only to you and the members you DM.'
Sounds pretty good, right? But there's a pretty massive catch, and it goes by the name of compliance export.
Companies on Slack's Plus plan have the option to enable the benign sounding compliance report. And just what is that, exactly? In a nutshell, it's a way for a Team Owner to export all Slack data.
Slack In Steering Wheel
'In a regulated industry or have legal obligations to archive messages?' asks Slack in an ad for the service. 'Team Owners can request access to their entire Slack message history, including private channel messages and direct messages.'
:max_bytes(150000):strip_icc()/dm2-9f2a72fa70f24a2cabb12135aa852a5f.JPG "Slack dm multiple people")
Additional reading makes it clear that 'Compliance Exports can be enabled so that messages and files from private channels and direct messages are included in Slack data exports.'
Essentially, if the head of your company has this feature enabled, he or she can export the contents of your DMs in a searchable form for reading at a leisurely pace — making your private chats suddenly very public. This is not an abstract concern. For example, Splinter reports that this feature was enabled at CNN earlier this year.
So, how can you tell if your company has Compliance Exports enabled? It's actually incredibly simple. While signed into Slack in your browser, mosey on over to https://[insert your team name here].slack.com/account/team. Scroll to the bottom of the page, and you'll see if that feature is turned on. Fingers crossed it's not.
Ig Dm
If it is enabled, than anything you've ever sent over DM — included now deleted messages — can potentially be searched by your company's higher ups. If it's not enabled, then you're good for now as the feature does not log 'messages from private channels and direct messages sent before the feature was enabled.'
Slack Investor Relations
In other words, say your CEO got suspicious and turned this feature on today. They would still not be able to read what you wrote in a DM last week.
That's not all you need to worry about, however. There's also a little thing called the Discovery API. According to Slack, this feature allows 'eligible Slack customers (and their Workspace Owners) to integrate their organization with third-party applications in order to export, retain, or archive some or all messages and files submitted to Slack, including all messages and files submitted to workspaces on Free, Standard and Plus plan that the applicable Customers and/or Workspace Owner(s) elect(s) to migrate into a Slack for Enterprise organization.'
Essentially, your company can plug third-party software into Slack's API, which then has the ability to archive messages sent over the platform. So, how do you check for that? Buckle up, because this part's a pain.
Head to https://[insert your team name here].slack.com/apps/manage to see all the apps integrated with your Slack's API. There may be none, a few, or a lot. Next, select 'Can access messages' from the 'Access type' drop-down menu. Scroll through every app's 'App Info' and 'Settings' sections. You may find that certain named individuals (coworkers or bosses), via integrated apps, have the listed permission to 'Access content in user’s direct messages.'
Slack confirmed that this does in fact mean that an administrator could theoretically read an entire teams DM's via a whitelisted app plugged into the Discovery API.
If, after diving through your company's Slack settings, you see that your DMs are being exported, consider exchanging cell numbers with your coworkers and using a messaging app like Signal — there's even a group messaging function. Because whether you're planning to unionize, discussing a creepy boss, or just wanting to talk about getting drunk — it's better to be safe than sorry.
Slack Dm Multiple People
This story has been updated with a confirmation from Slack regarding the Discovery API.