---
title: "Security & Data Privacy | Threadly Slack App"
description: "Threadly security: OAuth 2.0, minimal Slack scopes, AES-256 encryption at rest, TLS in transit, AWS hosting, and full data deletion on request."
url: "https://www.trythreadly.com/security"
---

Security & Trust

# Built to be trusted  
with your Slack workspace

Threadly is a Slack-approved app that uses OAuth 2.0, requests only what it needs, encrypts your data, and gives you full control.

Slack App Directory approved

OAuth 2.0 only

AES-256 + TLS encryption

## Security practices

### Data encryption in transit and at rest

All data transmitted between Threadly and Slack, and between your browser and Threadly, is encrypted via TLS 1.2+. Data at rest is encrypted using AES-256.

### OAuth 2.0 authentication only

Threadly never asks for your Slack password. Authentication is handled entirely via Slack's official OAuth 2.0 flow. You can revoke access at any time from your Slack workspace settings.

### Minimal data retention

Threadly stores only the data necessary to power broadcasts and analytics: channel lists, message metadata, click events, and form responses. We do not store full message content from your Slack workspace.

### Infrastructure on Heroku (AWS) and Google Cloud

Threadly's application runs on Heroku, which is itself built on AWS infrastructure. Workspace data is stored in Google Cloud Firestore, which encrypts data at rest by default.

## Slack permissions explained

Threadly requests only the Slack OAuth scopes it needs to operate. Here is exactly what each scope is for.

`chat:write`

Post messages to Slack channels on behalf of Threadly

`channels:read / groups:read`

Read the list of channels in your workspace to let you select broadcast targets

`channels:history / groups:history`

Read message history to power analytics and threading

`users:read / users:read.email`

Read user information to personalize messages and map channels to contacts

`reactions:read`

Track emoji reactions on Threadly messages for engagement analytics

`files:read`

Support file attachments in messages

`team:read`

Read basic workspace information (name, domain) for multi-workspace support

`commands`

Register Threadly slash commands in your Slack workspace

Threadly does not request `channels:write` — it cannot create, rename, or delete your Slack channels. It also does not request `admin` or workspace administration scopes.

## What data Threadly stores

### What Threadly stores

-   Your workspace ID and name
-   Slack channel IDs, names, and metadata
-   Message metadata (when sent, to which channels)
-   Click events on message CTAs (who clicked, when)
-   Form responses submitted via Threadly messages
-   Meeting booking confirmations
-   Broadcast analytics and engagement metrics
-   API tokens for connected integrations (e.g. HubSpot, Attio, Bonusly), used only to query your data at send time

### What Threadly does NOT store

-   –Full Slack message history from your workspace
-   –Slack passwords or authentication credentials
-   –Private channel content not related to Threadly
-   –Direct messages not sent via Threadly
-   –Slack user passwords or 2FA codes
-   –Payment card numbers (handled by Stripe)

## Questions or data requests?

To revoke Threadly's access: Slack workspace settings → Manage Apps → Threadly → Remove app. For data deletion requests or security questions, contact us.

[Contact us about security](https://www.trythreadly.com/contact)

## Trusted by hundreds of teams in Slack

Add Threadly to your Slack workspace — Slack-approved, minimal permissions, full control.

[Get started free](https://slack.com/oauth/v2/authorize?client_id=2573203509911.7020858675504&scope=channels:history,channels:join,chat:write,chat:write.customize,commands,files:read,groups:history,reactions:read,team.billing:read,team:read,users:read,users:read.email&user_scope=channels:read,channels:write.invites,chat:write,groups:read,groups:write.invites,im:write,mpim:read,mpim:write)