Security page — Slite

Cited by

Facts read from this source

• SOC 2 type2 Report an error

  “Slite maintains a SOC 2 Type II certification, demonstrating that our security controls are designed and operating effectively in accordance with the AICPA Trust Services Criteria. Our audit is performed annually by an independent, accredited third-party auditor.”

• GDPR Report an error

  “Slite complies with the General Data Protection Regulation (GDPR) and implements the technical and organizational measures required to protect the personal data of individuals in the European Union.”

• GDPR program Report an error

  “a comprehensive Data Processing Agreement (DPA) support for all data subject rights (access, rectification, deletion, and export) Standard Contractual Clauses (SCCs) for international data transfers”

• HIPAA Report an error

  “Slite provides HIPAA support, including execution of a Business Associate Agreement (BAA), for enterprise-tier customers. To inquire about HIPAA availability or request a BAA, please contact support@slite.com .”

• Trust center Report an error

  “Slite maintains a dedicated Trust Center , hosted by Vanta, which provides customers and prospects with up-to-date security and compliance information.”

• Provider Report an error

  “Slite’s infrastructure runs on Google Cloud Platform (GCP), with all production data hosted in the EU (St. Ghislain, Belgium).”

• Tls rating Report an error

  “Our TLS configuration consistently achieves an A+ rating on SSL Labs, ensuring strong protection against common attack vectors.”

• Structural backup Report an error

  “Daily backups replicated across multiple Google Cloud data centers within the EU 7-day backup retention, enabling daily point-in-time recovery Monthly restoration tests to verify backup integrity and reliability”

• Document content backup Report an error

  “Every 6 hours, retained for 7 days Weekly snapshots every Saturday, retained for 4 weeks Monthly snapshots, retained for 12 months”

• Search indexing Report an error

  “To provide fast and relevant search capabilities, Slite uses Elasticsearch to index textual document content.”

• AI data usage Report an error

  “Customer data used for AI-powered features is processed securely within our infrastructure and is not used to train external models.”

• Encryption at rest Report an error

  “All customer data stored on our infrastructure is encrypted at rest using Google Cloud’s built-in encryption mechanisms.”

• E2e encryption Report an error

  “Slite does not currently offer end-to-end encryption.”

• SSO Report an error

  “Slite supports multiple secure authentication methods, including traditional email/password login and Single Sign-On (SSO) through Google, Slack, and Apple”

• Authorization controls Report an error

  “Set documents as accessible to everyone within the workspace Restrict documents to specific users or user groups Publish documents publicly on the internet Control read-only or read/write permissions at the document level”

• Penetration testing Report an error

  “Slite conducts annual penetration tests and code audits performed by independent security firms.”

• Vulnerability disclosure Report an error

  “We maintain a vulnerability disclosure program and encourage responsible reporting from external researchers.”

• Dependency scanning Report an error

  “We use automated tools to detect outdated or vulnerable dependencies, including: Google Cloud Container Scanning GitHub Dependabot alerts”

• Retention policy Report an error

  “Slite does not retain customer data beyond what is necessary to deliver the service or comply with legal obligations.”

• Audit logging Report an error

  “Logged events include: Authentication and SSO events Administrative and privileged actions Application and infrastructure activity System performance and anomaly alerts”

• Monitoring tool Report an error

  “Monitoring and alerting are integrated with Datadog to enable rapid detection and response to unusual behavior.”

• Employee access controls Report an error

  “Employee authentication is centralized through Google SSO with enforced 2FA across all internal systems. Permissions are reviewed quarterly and follow the principle of least privilege”

• Employee training Report an error

  “All employees undergo regular security awareness training covering topics such as phishing, social engineering, and best practices for handling sensitive data, as well as training specific to GDPR and HIPAA requirements.”

• Device security Report an error

  “Slite uses 1Password for secure credential management and ensures that access to sensitive credentials is limited to authorized employees. All company-issued devices have full-disk encryption”

• Stripe Report an error

  “Slite uses Stripe, a leading PCI-DSS–certified payment processor, to handle all billing and payment information. Slite does not store, process, or have access to your full payment card details at any point”

• Deployment infrastructure Report an error

  “Slite’s application is deployed using ArgoCD and Kubernetes, allowing us to roll out changes safely, consistently, and with automated validation.”

• Status page Report an error

  “The Slite status page is available at status.slite.com .”

• Incident response Report an error

  “Slite maintains a documented Incident Response Plan designed to ensure rapid detection, containment, and remediation of security events.”

• Disaster recovery Report an error

  “Slite maintains Business Continuity (BCP) and Disaster Recovery (DR) plans to ensure service resilience in the event of major disruptions.”

• Media storage Report an error

  “Media assets (images, attachments, and uploaded files) are stored in Google Cloud Storage buckets within the EU.”

• Search embedding Report an error

  “For our Ask feature and for Slite Agent enterprise search, we compute semantic vector embeddings internally using GPU resources to enhance retrieval relevance.”

• Code review Report an error

  “Every code change undergoes mandatory peer review to ensure quality, correctness, and security.”

• Workspace deletion Report an error

  “When a workspace is deleted, associated customer data is removed from active systems and scheduled for deletion from backups according to our backup retention periods.”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Engineering Lead Permissions, SSO & administration
• The Engineering Lead European sovereignty
• The IT Administrator Permissions, SSO & administration
• The IT Administrator European sovereignty
• The Operations Lead Permissions, SSO & administration
• The Operations Lead European sovereignty
• The Quality Manager Editor, structure & search
• The Quality Manager Verification, ownership & freshness
• The Quality Manager Permissions, SSO & administration
• The Quality Manager Import, export & self-hosting
• The Quality Manager European sovereignty
• The Skeptic Permissions, SSO & administration
• The Skeptic Import, export & self-hosting
• The Skeptic European sovereignty
• The Skeptic Pricing transparency
• The Support Knowledge Manager Permissions, SSO & administration
• The Support Knowledge Manager European sovereignty