Pick Up the Slack! How to Collect Slack Data for Holds & Discovery

Slack, a messaging and collaboration platform, is increasingly ubiquitous in the world of business. This has made Slack a primary data source for electronically stored information (ESI) in internal investigations and discovery – and a potential headache for legal teams.

‍

In 2022, we released an integration to simplify the process of identifying and collecting Slack data. We then expanded DISCO Hold capabilities to seamlessly identify, collect, and preserve not only Slack data, but also Box and Google Vault data directly from the source. (It’s a great solution! You can request a demo here). 

‍

To help you with the Slack data ingest process, I, with the extensive help of the DISCO product team, created this guide. 

Why would you need to collect Slack data?

Here are some key reasons for a business to collect Slack data:

• Litigation or investigation: Slack’s widespread adoption in the corporate world has made it a major data source for ESI in investigations and disputes.
• Compliance: Certain industries (think finance) have regulations requiring companies to retain all communication data for a certain period. 
• Backup and archiving: Regularly saving your data is a best practice to proactively prepare for accidental deletion or a malicious attack. 
• Data analysis: Companies can analyze Slack data for insights into employee productivity, communication patterns, or identify improvement areas.

‍

Read: Failure to properly preserve Slack data has serious consequences. 📚

How is Slack data different from other ESI?

Electronically stored information, or ESI, is information that is created or stored electronically. As technology continues to evolve, so does the ESI legal teams handle – from digital documents and data on hard drives in the 2000s to cloud data and mobile metadata (and beyond) today.

‍

Enter Slack.

Slack is a platform bringing together channels and direct messages where you can send messages, attach files, and collaborate on your work. This mode of working poses challenges for corporate legal teams as they think about data sources where potential litigious materials are stored and may need to be collected/preserved for litigation or investigation. 

‍

With this in mind, legal departments and firms should educate themselves on the proper preservation of Slack data and create a reliable process for handling it. (Pro tip: One of the best ways to do so is with a partner like DISCO for ediscovery and hold needs.)

‍

Learn more about Slack: Building the Case for Slack 📚

How to extract and upload Slack data

To take data from Slack, a workspace owner or admin (read: get friendly with your IT team) can export data from public channels. 

‍

At the time of this writing (December 2023), the steps are as follows:

1. First, click the workspace name (located in the sidebar) to open the menu.
2. Mouse over Tools & Settings, then click Workspace Settings. This will open a new tab.
3. Click the Import/Export Data button on the upper right.
4. Select the Export tab. (It’s below the paragraph of text.)
5. Click the drop-down menu below Export date range and select your desired time period.
6. Click Start Export. Slack will email you once your export file is ready.
7. Open the email and choose Visit your workspace's export page.
8. Click Ready for Download to access the zip file.

‍

Don’t want to do it the manual way? With Slack’s DISCO Hold integration, DISCO exports those files for you, and makes it easy to manage your hold compliance workload. 

‍

Benefits include: 

• Streamlined legal hold compliance 
• Instant in-place preservation (IPP) of data
• Preview and cloud collection capabilities
• Audit trails and automated reporting 
• Simplified custodian termination

‍

💡Learn more: Manual Hold vs. In-Place Preservation 

How to collect Slack data with DISCO Hold

First, integrate your Slack workspace with DISCO Hold. 

How to set up DISCO Hold’s Slack integration

Complete the following steps in the DISCO Hold interface. (Note: You must be your company’s Slack “Primary Org Owner.”)

1. On the Matters page, click the Admin Panel in the upper right corner.
2. Next, click Integrate on the Slack integration file.
3. On the next page, click Connect to Slack.
4. Enter your workspace URL, then click Continue.
5. Click Sign in here where it is for Primary Org Owners. 
6. Enter the credentials of the Primary Org Owner and then sign in.
7. Click Allow.
8. You will be redirected to the DISCO Hold Admin Panel, showing a confirmed “Integrated” message.

‍

Once the integration is established, you can begin preserving Slack data in place and notifying relevant custodians they are on hold.

‍

Read: Legal Hold Guide: How to Manage Custodians 📚 

‍

Once the data is preserved, you can preview, filter, and export the relevant dataset from DISCO Hold. 

‍

You can also directly collect and ingest Slack data into a DISCO Ediscovery database through self-service tools like the native high-speed uploader – or send via high-speed uploader or SFTP to DISCO Professional Services. 

How to ingest Slack data into DISCO Ediscovery

Here are the steps for a Workspace Owner/Admin, Org Owner/Admin, or a member with Export Admin to export independently.

1. Within Slack Settings and Permissions, utilize the Export feature to select an export date range or schedule an export frequency.
2. Download the Slack export. 
3. In DISCO Ediscovery, navigate to Ingest > New ingest > Slack > Exported ZIP file to open the ingest wizard.
4. Complete the relevant fields to name your ingest, then browse to the file location of your Slack ZIP file (not an unzipped loose file folder) and select it. 
5. Because Slack does not automatically include file attachments in its export, you will be given the option to also download files that are attached in Slack messages, or to simply ingest the Slack messages alone. 

1. Note: Downloading attachments will increase the billing size of the ingest. 💵

‍

DISCO’s Slack data capabilities make the entire process – preserving Slack data in place, collecting data on hold, and ingesting the collected data into a review platform – simpler, faster, and more effective. 

‍

DISCO Hold automatically downloads attachments to messages, de-duplicates already-ingested messages, sends exceptions to our Professional Services team for remediation, and more. (You can also opt out of any or all of these features.)

Best practices: Collecting Slack data for ediscovery

Here are our top tips to ensure your Slack data collection is compliant and efficient.

Establish a data retention policy

Make sure to set your data retention policy for Slack as soon as possible to ensure it meets your overall data retention policy needs and goals. 

‍

And establish internal guidelines for use – before a hapless employee shares confidential information there.

Understand key Slack terminology

Terms you might regularly encounter include:

‍

Discovery API (Application Programming Interface)

When you hear “API,” you can mentally translate it to, “A way for computer programs to talk to each other.” 

Slack’s Discovery API allows ediscovery and data loss prevention (DLP) providers to connect to Slack and use approved apps to export or act on messages and files from Slack. 

‍

Direct message (DM)

Private conversations between two (or more) Slack users.

Channels

Chat rooms, which are private or public:

• Private channels require an invite to join. If you are not a member of a private channel, you cannot view or interact with it.
• Public channels are open, and all members of the workplace can join.

‍

Workspace Admin

Workspace Admins are the people who can oversee members, channels, and other administrative functions in your workspace.

‍

Workspace Owner 

Workspace Owners do everything admins do, but also control the highest-level security and administrative settings (e.g., payments, authentication methods, security policies, etc).

‍

Workspace Primary Owner 

They can do everything Workspace Owners can do – plus delete the workspace.

Simplify Slack data processing with DISCO

I hope that this guide makes the process of collecting and processing Slack data less intimidating for you. 

‍

Getting your Slack data into compliance for legal hold, or making it simple for your ediscovery team to examine and produce that data, doesn’t have to be complicated or consuming. If this article has piqued your interest in using DISCO, schedule a one-on-one demo. I think you’ll love it!

‍

This article was written by DISCO Product Marketing Associate Jamie Feder, and edited by Senior Product Manager Eric Bell, Content Marketing Manager Kendra Fortmeyer, Product Marketing Associate Carter Martindale, Customer Success Specialist Aleck Russon, Senior Product Marketing Manager Christina Turner.