Chat is where work coordinates. It is a terrible place for the company’s most sensitive files to live. Yet every incident and diligence cycle still starts with someone uploading a CSV “just for the channel.”
This article draws a hard line: Slack and Teams are not document vaults—and how to keep them from becoming accidental ones.
Why chat fails as a vault
- Retention ≠ control — files persist in search, devices, and exports
- Forwarding is the product — threads exist to spread context
- Weak packet evidence — “who downloaded this?” is an admin archaeology project
- No client-held key story — the operator trust model is collaboration SaaS, not zero-knowledge
What chat is still perfect for
Status, decisions, links, and low-sensitivity screenshots. The fix is not “no files ever”—it is no high-sensitivity classes as chat attachments.
Replace the upload with a sealed link habit
- Define banned classes: board packs, impact lists, credentials, signed MSAs
- Give people a sealed vault that is faster than arguing in #security
- Paste the link in chat; keep discussion there
- Set expiry by default—see expiry policy
- Revoke when the thread dies or the contractor leaves
Compliance Locker is the sealed half of that habit: encrypt in the browser, share with controls, export activity when someone asks who saw the packet.
Channel rules that stick
- Pinned one-liner: “No impact lists or board packs as uploads”
- Bot or human nudge when banned file types appear
- IR channels get a sealed packet template on day one of an incident
- Pair with email attachment rules so files do not just move to mail
FAQ
Are Slack Enterprise Grid controls enough?
They improve admin visibility and retention policy. They do not give you client-held encryption, clean external revoke for a single packet, or vault-style access evidence for sealed documents.
What about private channels?
Private is not sealed. Membership changes, screenshots, device sync, and exports still expand the blast radius.
Can we ban all file uploads in chat?
Usually no—teams need frictionless coordination. Ban high-sensitivity classes (impact lists, board packs, credentials) and provide a sealed alternative that is almost as fast.
Is Teams better than Slack for this?
Same class of problem: collaboration-first storage with admin controls, not a zero-knowledge document vault.
Where should chat point people instead?
Paste a sealed link with expiry. Keep the conversation in chat; keep the bytes in the vault.
Related: IR evidence sharing, zero-knowledge for documents.