Anonymize Slack export: who does it in a data deal
The short answer
micro1, Troveo and Mercor each say they anonymize the Slack export themselves, not you. A Slack export holds names in the user list and message text, so masking one leaves the other exposed. Ask each program in writing about its standard and certification.
The short version: hand over what the company you license to asks for. Then ask who changes it, with what standard, and who certifies the result.
What is inside a Slack export?
Slack's help page on reading exports says each channel or direct message gets its own folder, with JSON files by date. Each message carries a user ID, the text and a timestamp. A users.json file maps the IDs to people.
The page says mentions appear in the message text itself. Files come through as links back to your workspace. The files themselves stay behind.
Why does masking the user list not anonymize it?
The sender field is one place a person shows up. The text field is free-form. A message can name a customer, a colleague or a project in any form someone typed.
My reading is that a mask on users.json leaves those untouched. Slack's page doesn't discuss anonymization, so that's my inference from the structure it describes.
Names swapped for stand-ins can still count as personal data. The UK ICO says pseudonymised data is personal data in the hands of someone who holds the additional information. See our pseudonymization page.
Who anonymizes the data in practice?
Each of these is the company describing itself.
-
micro1. micro1's David Revland, who works on human data, said in an undated recorded forum talk that micro1 swaps each name for a consistent stand-in across tools.
The role and the trail survive. micro1 staff said in the same talk that companies cannot pre-scrub. See micro1 PII transformation.
-
Troveo. Its business data page says it handles the anonymization, packaging and buyer talks. It says anonymization follows its standard, documented in a manifest. The page gives no technical detail of the standard.
-
Mercor. Its data page says extraction and anonymization are fully automated. It says no AI lab buyer or third-party vendor sees raw data.
In the Spirit Airlines sale, the court ombudsman's report says Tonic.ai de-identifies unstructured data under a certification. The certification is filed before each transfer. See data de-identification.
What does your company do, then?
I'd gather the facts a buyer will ask for:
- Which channels exist.
- The date range.
- Who can run an export on your Slack plan.
- Which channels hold customers' or partners' messages.
- Which channels you want left out.
Counsel's checklist from Frankfurt Kurnit Klein & Selz makes two points. Leave out categories such as HR files, union communications and customer confidential data entirely, and do not rely on de-identification. Also limit who sees raw data before it is de-identified.
My readiness checklist covers the inventory. The managed readiness service lays out the de-identification options and the published methods for your counsel. It never touches the data. Talk to a privacy or commercial lawyer in your state before you sign.
micro1 may pay us a referral fee if a company we introduce goes ahead with it. How we are paid
Apply to micro1's data partnership (paid link)micro1's own data-partnerships pagePaid link. How we are paid
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
