Privacy Policy

Last updated: August 2026

What this covers

This policy explains what information GridKeeper collects when you connect a Slack workspace or Enterprise Grid organization, how it's stored, and who can see it. It applies to the GridKeeper application and the data it accesses through Slack's API.

What we collect

When you connect GridKeeper to your Slack workspace, we access the following through Slack's official API, scoped to exactly what's listed on our Trust & Scopes page:

Workspace and organization metadata (name, domain, plan-relevant settings)
Member, guest, and app directory information (names, emails, roles, admin status)
Channel inventory and sharing configuration (names, membership counts, external sharing status)
Installed app information (names, scopes granted, who installed them)
Workflow inventory and ownership
Where applicable, relevant audit log events used to derive settings Slack exposes no direct reading for (such as SSO enforcement)

We never request or read message content. No scope GridKeeper holds grants access to channel or direct message history, and none ever will, see the Trust & Scopes page for the complete, current list of what's requested.

How your Slack credentials are stored

The OAuth tokens Slack issues when you connect are encrypted (AES-256-GCM) before being stored, and are never logged or stored in plaintext anywhere. They are decrypted only in memory, at the moment a request to Slack's API is made, and only by GridKeeper's own server-side infrastructure.

What we use it for

Data collected from your connection is used exclusively to generate your organization's own security posture reports, detect changes over time, and display them back to your organization. It is not used to train any model, not aggregated into benchmarks shared with other customers, and not used for any purpose beyond operating GridKeeper for the organization that connected it.

Who can see it

Access to your connection's data is restricted to authenticated sessions belonging to your own organization's connection, enforced at the application level, and to GridKeeper's operators where necessary to provide support or maintain the service. We do not sell, rent, or share your data with third parties for marketing or any other purpose.

GridKeeper's infrastructure runs on third-party hosting and database providers (currently Vercel and Supabase) who process data on our behalf under their own security and privacy commitments, solely to operate the service.

How long we keep it

Data is retained for as long as your connection remains active, so that change history and trend detection continue to work. If you disconnect GridKeeper or ask us to delete your data, we will remove your stored connection, its tokens, and its captured history.

Your controls

You can revoke GridKeeper's access at any time from your Slack workspace's app management settings, which immediately invalidates the tokens GridKeeper holds for your organization. You can also contact us directly to request deletion of your data.

Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page. Since GridKeeper is currently in a private pilot phase, we'll also tell pilot participants directly rather than relying on this page alone.

Contact

Questions about this policy or your data can be sent to privacy@gridkeeper.app.