Process-and-drop: a privacy architecture for AI in Slack

The easiest way to build an AI that listens to Slack is to mirror Slack: sync every message into your own database, embed it, search it later. It works, and it is a liability with a product wrapped around it. Message history contains salary conversations, health mentions, venting, and half-formed takes people would phrase differently anywhere public. Copy all of that into a second system and you now own two attack surfaces, two retention problems, and one very uncomfortable page in your next security review.

Pagerox does not store Slack messages. Raw messages are processed in flight and dropped. What persists is what an attentive human employee would actually keep: distilled items. A situation ('the Acme renewal is blocked on legal review'). A memory ('the manager corrected the SSO pricing'). A decision ('we chose Resend for transactional email, superseding the earlier pick'). Each distilled item carries provenance: the author, the timestamp, and a Slack permalink pointing back to where it came from. A reference to the thread, never a copy of it.

This is not storing less because storing is hard. Not storing is the feature. Content we do not have cannot leak, cannot be scraped by a compromised dependency, cannot become a shadow archive of your company's private conversations, and cannot show up in a breach notification. The strongest data protection is absence, and absence is only credible when it is architectural. Ours is: the pipeline has nowhere to put a raw message, so 'we do not retain message content' is a description of the schema, not a policy we ask you to trust.

Provenance-by-pointer has a second property we did not fully appreciate until we built it: Slack's own permissions keep doing their job. An employee's answer cites the distilled item, and the citation links to the living thread. If you cannot see that channel, the permalink does not open for you. We never become a side door into conversations you were not part of, because the conversation only ever lives in Slack.

Listening is disclosed, not ambient in the creepy sense. Which channels each employee listens to is visible to the whole workspace, and any channel can opt out. The sensitive end of ambient analysis, like sentiment, ships disabled: opt-in, private to the manager, with no per-person profiles stored. And employees always disclose that they are AI, in their profile and on first contact.

Security reviews tend to ask the same three questions, and this architecture keeps the answers short. What do you store? Distilled work items with provenance, plus an immutable audit log of employee actions. Where does raw content go? Through the pipeline and gone; server logs carry ids and digests rather than content, and analytics receive event names and metadata through a scrubber enforced in the code path, not by convention. How do we leave? Distilled items are retained until superseded or deleted, and offboarding is a full export plus verified deletion within 30 days.

There is a real cost, and we would rather name it than hide it. Process-and-drop means an employee cannot go back and reread a thread from last month; if distillation missed something, it stays missed until the topic comes up again or someone teaches it directly. We take that trade with our eyes open. A correction fixes a stale distillate the same way it fixes anything else, and the alternative is being a vendor that quietly owns a copy of your team's every message. We would rather be worse at total recall than good at surveillance.