Does Slack keep data in Australia?
Some data can be kept in Australia. Core Slack content can be stored in Sydney on Business+ and Enterprise; Slack says it has been IRAP-assessed. Profiles, some metadata, AI model providers and support can be outside Australia.
Slack (Salesforce) · Team chat · Plans covered: Business+, Enterprise · Last checked
What Slack (Salesforce) says
| Claim | Status | Vendor's words | Source | Last checked |
|---|---|---|---|---|
| Storage at rest | Partly | Data residency for Slack allows global teams to choose the region where certain types of data at rest are stored. Note: The region table lists "Sydney, Australia" with "Melbourne, Australia" as the backup region. Stored in the region: messages, canvases and snippets; uploaded files; the search index; app- or bot-generated messages and files; data of apps deployed on Slack's managed infrastructure. Without data residency, the page says data is stored in the US. For existing workspaces only newly generated data goes to the region; older data stays in the US unless a migration is requested through sales. | slack.com | |
| Processing (incl. AI inference) | Partly | Please note that the other categories of data, ‘Other Information’, as defined in Slack’s privacy policy are processed in the US. Note: The data residency page says the feature "does not change any aspects of Slack other than the data storage location for certain types of data". Salesforce's sub-processor list (published 20 Oct 2026) names AWS as host for "Slack services, including Slack AI" in the customer's selected region (Australia is listed), but lists its generative AI providers (OpenAI, Microsoft Azure, Google LLC) in the United States, and edge servers in many countries. Slack's AI help page says its LLMs are "hosted within our secure cloud infrastructure" without naming a location. Where Slack AI inference runs for a Sydney-region workspace is not published. | slack.com | |
| Support access | Not in Australia | Support services, including technical operations support Note: From the "Support For All Services" table in Salesforce's sub-processor list (slack.com/slack-subprocessors redirects to it). Support is provided by Salesforce entities in about 20 countries, including the United States, India, Ireland and Australia (SFDC Australia Pty. Ltd.). The Slack table also lists Zendesk (United States) as a customer support tool. No option to keep support in Australia is published. | www.salesforce.com | |
| Plan required | Paid option | Available on Business+ and Enterprise subscriptions Note: Free and Pro workspaces must upgrade to Business+ first; setup is arranged through Slack's sales team, and only the primary owner can enable it. | slack.com | |
| Exclusions | Partly | The following categories of data may be stored in regions outside of the customer’s data region: Note: Listed: member profiles; workspace and channel membership; seat count, usage and revenue data; analytics and quality-of-service data; Slack-generated IDs; deal celebration data. Flagged or reported data may also be stored in the United States. In Slack Connect channels with organisations in other regions, each organisation's messages stay in its own region. | slack.com | |
| IRAP status | Yes, in Australia | Slack has been assessed by an independent IRAP assessor against the requirements of the Australian Information Security Manual (ISM). Note: Slack's compliance page also says customers can contact their Slack account team to request a copy of the IRAP report. The classification level, assessment date and scope are not quoted here: the IRAP report and letter were not used as sources. Salesforce's compliance portal lists an IRAP report for Slack (2026-06-04); it needs a login and was not read. An IRAP assessment is not an authorisation; each agency still decides whether to use the service. | slack.com |
Why it matters
General information, not a compliance ruling.
- APP 8
- APP 8: sending personal information overseas, including remote access, can be a cross-border disclosure → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
- ISM-1572
- ISM-1572: contract must record processing and storage regions → see storage + processing. Relies on: Storage at rest, Processing (incl. AI inference)
- APRA CPS 230
- CPS 230: offshoring with a material service provider must be assessed and notified to APRA → see storage, processing, support access, exclusions. Relies on: Storage at rest, Processing (incl. AI inference), Support access, Exclusions
- OVIC IPP 9
- IPP 9 (Victoria): personal information may leave Victoria only in set circumstances → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
Changelog
No changes recorded yet.