Knowledge Base & Wiki
Slab
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Fallacy Labs, Inc. · slab.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Slab at a glance
- Vendor
- Fallacy Labs, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Slab 3/5, the mean of 6 judges. Slab, a hosted team wiki from Fallacy Labs, Inc., is scored strongest at internal knowledge work: authoring and search, knowledge governance and access control. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Slab, a hosted team wiki from Fallacy Labs, Inc., is scored strongest at internal knowledge work: authoring and search, knowledge governance and access control. Search is the documented strength — relevance ranked by reads, views, links and mentions, facets for verified and expired posts, unified search across tools such as Google Drive, Confluence, Jira and Slack — and verification is a real loop, with the post owner as default primary verifier, configurable review frequency and reminders in-app, by email and on Slack. The weakest mark is sovereignty: the privacy policy states data is transferred to and processed in the United States on Google Cloud Platform with no region stated, and we found no published subprocessor list beyond Stripe for billing. Publishing and integrations and portability and hosting trail on API plan-gating and export gaps; pricing transparency is enough to ballpark, not to compute a contract. The flagged splits report none; score spreads stay within two points.
Speaks for it
- Search ranks results by reads, views, links and mentions, with facets for verified, expired and archived posts and unified search across named tools such as Google Drive, Confluence, Jira and Slack
- Verification is documented end to end: the post owner is the default primary verifier, review frequency is configurable, reminders arrive in-app with optional email and Slack, and a banner names the verifier and expiry
- Access control is documented at both post and topic levels — editor and viewer permissions, additive topic access, guests limited to their topics, SAML-based single sign-on, SCIM provisioning, admin-enforced two-factor and IP restriction
- Published prices are concrete — Free at $0 user / month for up to 10 users, Startup at $6.67 user / month billed annually, Business at $12.50 user / month billed annually — with per-tier limits on attachment size, version history, analytics retention and support level
- Admins can bulk-export all published posts and topics to Markdown or Docx, and the terms confirm customers keep ownership of their content
Held against it
- Sovereignty scored lowest: the contracting entity is Fallacy Labs, Inc. under California law, data is transferred to and processed in the United States on Google Cloud Platform, and we found no public information on an EU hosting option
- The bulk export excludes drafts and secret topics the exporting admin does not belong to, and we found no public information on attachments or version history being included
- The API and webhooks are reserved for the Business and Enterprise plans, and the documented outward publishing is public post links plus a custom-domains module, with no public information on a branded help center, ticket deflection or a connector for AI assistants
- The audit log defaults to 30 days of retention, and its published action types cover authentication, user, admin and content actions such as deletions rather than content edits and approvals
- Billing counts every user who can log in — the vendor states there is no account type that cannot edit — and the AI modules carry an "Advanced" label with no published price while Enterprise is "Custom, contact sales@slab.com"
Best for
- You run an internal team wiki whose pages must stay current — the verification loop, expiry banners and admin insights into stale posts and unanswered questions scored 6-7 for knowledge governance
- You want one search surface across tools your team already uses, including Google Drive, Confluence, Jira and Slack, with Slab content searchable from inside Slack
- You need documented enterprise access controls — SAML-based single sign-on, SCIM provisioning, admin-enforced two-factor and IP restriction — for a security-led rollout, where access control scores run 6-8
- You are starting small or in education or non-profit use: the Free tier covers up to 10 users and the Startup plan is free for non-profits and educational use
Avoid if
- Your compliance regime requires EU data residency, self-hosting or a named subprocessor chain — ask the vendor: the public pages we read do not show it
- Your user base is heavy on people who only need to read: billing counts every user who can log in and the vendor states there is no account type that cannot edit
- You must be able to leave with everything intact: the bulk export covers published posts and topics, excludes drafts and secret topics the exporting admin is not a member of, and the terms make export before termination the customer's responsibility
- You need audit-grade change history for controlled documents: the audit log defaults to 30 days of retention and its published action types list deletions rather than content edits and approvals
The scores
| Criterion | Panel median |
|---|---|
| Editor, structure & search | 3.5 of 5 |
| Verification, ownership & freshness | 3.5 of 5 |
| Permissions, SSO & administration | 3.5 of 5 |
| Help-center publishing & integrations | 3 of 5 |
| Import, export & self-hosting | 2 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 3 of 5 |
Verification, ownership & freshness
Show reasoningHide reasoning
How this is scored
Whether the content stays true: page owners or experts named per page, verification with a review date and a reminder when it lapses, approval or publishing workflows with drafts and reviewers, read confirmations for mandatory pages, analytics on views, searches without a result and stale pages, duplicate detection, archiving rules, and an audit trail of who changed and approved what.
0 — No way to see who owns a page or when it was last checked beyond the edit date.
3 — Page history and last-edited dates; owners, verification, approvals and content analytics are basic or not described.
5 — An owner or verifier per page, a review interval with reminders, a draft and publish step, page view statistics, and archived pages kept out of search.
8 — Approval workflows with several reviewers, read confirmations for mandatory pages, analytics on failed searches and stale content, duplicate or outdated content flagged automatically, and an exportable audit trail of changes and approvals.
10 — Governance that a regulated organisation runs on: controlled documents with versioned approvals that meet a named standard (ISO 9001, GxP), expiry and review enforced per space, knowledge gaps reported from searches and AI questions, and every published statement traceable to an approved version.
The Operations Lead
This is close to what our hotline needs: every post takes a primary verifier (the owner by default), a configurable review frequency, and reminders in-app plus opt-in email and Slack; a green banner names who verified and when it expires, and edits since the last check are highlighted on reverification. Admin insights report which posts get stale and which team questions go unanswered, and archiving plus mass archiving are documented. We found no public information on read confirmations for mandatory pages, duplicate detection, or an exportable audit trail of approvals. 2 4 11 12
The IT Administrator
Verification is genuinely documented: a primary verifier defaults to the post owner, review frequency is configurable, reminders arrive in-app and by email or Slack, expired posts show a yellow banner, and admin insights flag stale posts and unanswered questions. The audit log records logins, user account changes and deletions rather than edits and approvals, and defaults to 30 days of retention — too short to hand an auditor as it stands. We found no public information on read confirmations or duplicate detection. 2 4 11 12 13 14
The Support Knowledge Manager
Verification is the nagging I need: the post owner is the default primary verifier with a configurable review frequency, in-app reminders with optional email and Slack nudges, a green banner naming who verified and when it expires, change highlighting on re-verification, and team-wide search facets for verified and expired posts. Admin insights report which posts are going stale and which questions go unanswered. We found no public information on read confirmations for mandatory pages, duplicate detection, or an exportable trail of changes and approvals; the audit log's published action types cover authentication, user, admin and content actions such as deletions on a 30-day default retention, and archived posts remain accessible and searchable. 2 4 11 12 13
The Engineering Lead
Verification is a real loop: a primary verifier defaults to the post owner, review frequency is configurable, reminders arrive in-app plus email and Slack, expired posts show a yellow banner and can be found by search facets, and edits since the last check are highlighted at reverification. Admin insights report which posts are getting stale and which team questions go unanswered, which is exactly the gap signal I want for runbooks. We found no public information on read confirmations for mandatory pages, duplicate detection, or an exportable trail of edits and approvals; the audit log covers logins, user changes and deletions on a 30-day default. 2 11 13 14
The Quality Manager
Verification is documented in detail: a required primary verifier defaulting to the post owner, a configurable review frequency, banners naming the verifier and the expiry date, reminders in-app and by email or Slack, and change highlighting on re-verification; drafts start private, publishing is a separate step, and admin insights surface stale posts and questions that go unanswered. The audit log records logins, account and permission changes, integration installs and deletions with 30 days of default retention. We found no public information on approval workflows with named reviewers, read confirmations for mandatory pages, or an exportable audit trail of changes and approvals — exactly what a controlled-document environment under ISO 9001 or 13485 would demand. 2 4 11 13 14
The Skeptic
Verification is real, not marketing: a required primary verifier defaulting to the post owner, configurable review frequency, reminders in-app and via email or Slack, a banner naming the verifier and expiry date, and change highlighting on reverification, plus insights into stale posts and unanswered questions. We found no public information on read confirmations for mandatory pages, duplicate detection, or export of the audit trail. 2 11 12 13 14
Permissions, SSO & administration
Show reasoningHide reasoning
How this is scored
Who may see and edit what, and how the administrator keeps control: roles and permissions per space and per page, restricted or private pages, guest and external access, groups synced from Azure AD/Entra ID, Google Workspace or LDAP, single sign-on (SAML, OIDC), SCIM provisioning, two-factor authentication enforced, an audit log of access and permission changes, and admin controls over sharing and public links. Where the data is hosted and certifications are scored under sovereignty.
0 — Everyone in a workspace sees and edits everything; no permissions of any kind.
3 — Admins, members and guests, or private and shared pages; per-space or per-page rights, SSO and an audit log are basic or not described.
5 — Permissions per space and per page, guest access with limits, single sign-on through Google or Microsoft, two-factor authentication, groups, and admin control over public sharing.
8 — SAML or OIDC single sign-on with any identity provider, SCIM provisioning or LDAP and directory group sync, enforced 2FA, an audit log of views, edits and permission changes, IP or domain restrictions, and permissions honoured by search and AI answers.
10 — Access control an enterprise auditor accepts as documented: granular roles with inheritance explained, just-in-time and external access with expiry, every access and permission change logged and exportable to a SIEM, and the permission model published with its limits.
The Operations Lead
Permissions run per topic and per post with editor and viewer levels, drafts are private by default, a published link grants nothing by itself, and guests are confined to topics they belong to; Okta and Google single sign-on are listed. Team administrators can require single sign-on and two-factor, SAML SSO and SCIM provisioning are on the pricing page, IP restriction exists, and an audit log with filters covers logins, user changes and deletions (30 days by default). We found no public information on directory group sync or whether search and AI answers honour these permissions. 4 5 7 13 14
The IT Administrator
Permissions per post and per topic with editor and viewer levels, guest access confined to their topics, SAML-based SSO, SCIM provisioning, admin-enforced two-factor and an IP restriction feature are all evidenced — most of what my Entra ID rollout needs. But the audit log covers authentication, user lifecycle and integration events while the captured pages do not show it recording permission changes or content edits, and 30 days of default retention is thin. We found no public information on directory group sync from Entra ID or on search honouring permissions. 4 5 7 13 14
The Support Knowledge Manager
Permissions are documented at both levels — drafts private to the creator, editor or viewer per post, additive topic access, guests limited to their topics, private topics — alongside SAML-based single sign-on, SCIM provisioning, administrators able to require single sign-on and two-factor authentication, IP restriction, and an admin audit log of authentication, user, admin and content actions with filters and IP detail. The audit log defaults to 30 days of retention, and we found no public information on a log of individual views or edits, directory group sync beyond SCIM, or search and AI answers honouring permissions. 4 5 7 13 14
The Engineering Lead
Permissions are granular and documented: per-post editor and viewer levels, additive topic access, private topics, guests limited to topics they belong to, and link behaviour spelled out with internal by default and public opt-in. The pricing page lists SAML-based SSO and SCIM provisioning, admins can require single sign-on and two-factor authentication, IP restriction exists, and the audit log records logins, user permission changes and integration installs with filters and IP detail. The API honours the bot user's permissions and mention previews respect access, though we found no public information on whether search and AI answers are permission-filtered or on exporting the log to a SIEM. 4 5 7 13 14 15
The Quality Manager
Post-level editor and viewer permissions, additive topic access, private topics, guests restricted to the topics they belong to, and drafts visible only to their creator are documented. SAML single sign-on, SCIM provisioning, administrator-enforced SSO and two-factor authentication, an IP restriction feature, and an admin audit log with action, user and date filters plus IP detail are also stated. We found no public information on directory group sync or on search and AI answers honouring permissions. 4 5 7 13 14
The Skeptic
Post and topic permissions with editor and viewer levels, additive topic access, links that grant nothing once published, guests confined to their topics, SAML-based SSO, SCIM provisioning, admin-enforced 2FA and IP restriction — most of the enterprise checklist is evidenced. The audit log's listed categories cover authentication, user, admin and content events such as deletions with a 30-day default retention, and we found no public information on view or edit logging or on permissions being honoured by search and AI answers. 4 5 7 13 14
Help-center publishing & integrations
Show reasoningHide reasoning
How this is scored
How knowledge reaches people outside the editor: public or password-protected sites and help centers with a custom domain, branding and SEO controls, an in-app widget or contextual help, ticket deflection in a help desk, multilingual publishing, integrations with Slack, Microsoft Teams, Jira, Google Drive, help desks and CRMs, a browser extension, a documented REST or GraphQL API, webhooks, and an MCP server or connector for AI assistants.
0 — Content cannot be shared beyond the editor and nothing connects to it.
3 — Sharing a page by public link and a few integrations such as Slack; a branded help center, an API and webhooks are basic or not described.
5 — A published site or help center with custom domain and branding, integrations with Slack or Teams and Google Drive or Microsoft 365, a documented API, and embeds of common tools.
8 — A help center with SEO controls, multilingual publishing, access for logged-in customers and analytics, a widget or contextual help inside the customer's product, help desk integration with ticket deflection, webhooks, and a connector or MCP server for AI assistants.
10 — Knowledge delivered wherever it is needed from one source: internal and public audiences served from the same pages with per-audience rules, a complete API with SDKs and rate limits stated, a marketplace of integrations, and every channel measured in one report.
The Operations Lead
There is plenty to connect to — dozens of integrations including Slack, Google Workspace, GitHub and Okta, a GraphQL API with webhooks, a Chrome extension and a desktop app — and published posts can be opened to anyone on the internet via link, with custom domains listed among advanced features. But the API and webhooks are reserved for Business and Enterprise plans, and we found no public information on a branded help center, SEO controls, a widget inside our own product, or an MCP connector for AI assistants. 2 3 4 13 15 16
The IT Administrator
Custom domains, public internet links on individual posts, Slack and Google Workspace integrations, a documented GraphQL API with webhooks and dozens of integrations are all documented. The API and webhooks are available only on the Business and Enterprise plans, and we found no public information on a branded help center with SEO controls, multilingual publishing, ticket deflection, a customer-facing widget or an MCP connector for AI assistants. External reach sits at shared public post links rather than a managed customer site. 2 4 13 15 16
The Support Knowledge Manager
Integration depth is real: two-way search with Slack plus post creation and notifications there, Google Drive sync and embeds, a documented GraphQL API, webhooks, a Chrome extension and desktop apps. Publishing beyond the editor is thinner — published posts can be opened to anyone with the link and custom domains are named as an advanced option on the pricing page, but we found no public information on a branded help center with SEO controls, multilingual publishing, an in-product widget, help-desk ticket deflection, or a connector for AI assistants; Zendesk appears only as a source that unified search can read. 2 4 10 13 15 16
The Engineering Lead
Slab connects well to an engineering workflow: a documented GraphQL API and webhooks to create content programmatically and notify on publish (Business and Enterprise plans), a deep Slack integration with notifications, cross-search and post creation from Slack, GitHub live markdown sync, Google Drive embeds, a Chrome extension and dozens of integrations. Outward publishing is public links plus custom domains as an advanced module; we found no public information on a branded help center, SEO controls, multilingual publishing, a customer-facing widget, ticket deflection or an MCP server for AI assistants. 2 4 13 15 16
The Quality Manager
Dozens of integrations are documented — Slack with two-way search, notifications and post creation from a slash command, Google Workspace, GitHub markdown sync, Jira, Confluence, Zendesk and more — plus a GraphQL API with webhooks on the Business and Enterprise plans, a Chrome extension, public link sharing and a Custom Domains module. We found no public information on help-center publishing with SEO controls, multilingual publishing, an in-app widget, ticket deflection or a connector for AI assistants. 2 3 4 13 15 16
The Skeptic
Public links, a custom-domain add-on, a documented GraphQL API with webhooks and a wide catalogue — dozens of apps, bidirectional Slack search, GitHub markdown sync, a browser extension — are all evidenced. Beyond that, the pages show no branded help-center site with SEO controls, no multilingual publishing, no in-product widget, no help-desk ticket deflection and no connector for AI assistants, and the API is limited to Business and Enterprise plans. 3 4 13 15 16
Import, export & self-hosting
Show reasoningHide reasoning
How this is scored
What arriving and leaving would cost: import from Confluence, Notion, Google Docs, Word and Markdown with structure, attachments and links kept, a full export of every space in an open format (Markdown, HTML, XML, PDF) with attachments and history, an API that reaches all content, a stated migration path from Confluence Server or Data Center, open-source code under a named licence, and a self-hosted or on-premise edition with its own documentation.
0 — Content cannot be imported or exported; it can only be read in the vendor's interface.
3 — Single pages export to PDF or Word and some files can be imported; a full export, a Confluence import and self-hosting are basic or not described.
5 — Import from Confluence or Notion and from Word or Markdown, a full workspace export to Markdown or HTML with attachments, a documented API covering pages, and a stated retention of data after cancellation.
8 — A Confluence migration tool or service that keeps hierarchy, permissions and attachments, a full export with history in an open format, a self-hosted or on-premise edition with installation and update documentation, and data returned or deleted on termination under stated terms.
10 — The customer owns the content end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export another tool can import without loss, and the deletion of every copy on termination documented.
The Operations Lead
Admins can bulk-export all published posts and topics as Markdown or Word, individual posts export from the post menu, a migration service is offered ("We'll take care of that for you"), and the terms confirm users keep ownership of their content. However the bulk export excludes drafts and secret topics the admin cannot see, and we found no public information on exporting attachments or version history, a documented Confluence import, or any self-hosted edition. 1 6 8 18
The IT Administrator
A vendor-assisted migration is offered and admins can bulk-export all published posts and topics to Markdown or Word, with a ten-article import-and-export help section behind it; the bulk export cannot reach drafts or secret topics the admin does not belong to, and we found no public information on whether attachments or page history are included. The terms put the burden of exporting content before termination on the customer. We found no public information on a Confluence import that keeps hierarchy, permissions and attachments, or on any self-hosted or on-premise edition — which rules it out for my data-centre requirement regardless of anything else. 1 6 8 15 18
The Support Knowledge Manager
Admins can bulk-export all published posts and topics to Markdown or Docx, individual posts export from the in-post menu, the help center carries a ten-article import and export section covering content, structure and users, a GraphQL API reaches content, and the vendor offers assisted switching while the terms confirm customers keep ownership and must export before termination. The bulk export excludes drafts and secret topics the exporting admin does not belong to, and we found no public information on attachments or history being included in exports, on import from named sources such as Confluence or Notion, or on any self-hosted or open-source edition. 6 8 15 17 18
The Engineering Lead
Leaving is possible but not painless: admins can bulk-export all published posts and topics as Markdown or Docx delivered by email link, individual posts export from the post menu, the GraphQL API reaches content, a vendor-assisted migration service is offered, and the terms make export before termination the customer's responsibility. The bulk export explicitly excludes drafts and secret topics the admin is not a member of, history is not part of the export, and we found no public information on a detailed Confluence import path, attachments in export, or any self-hosted edition. 1 6 8 15 18
The Quality Manager
Admins can bulk-export all published posts and topics as Markdown or Word, individual posts export from the post menu, a GraphQL API exposes content, and a help collection covers importing content, structure and users into Slab; the bulk export cannot include secret topics the admin is not part of or drafts, and history and attachments are not mentioned. We found no public information on import from Confluence, Notion, Word or Markdown, any self-hosted or open-source edition, or data handling after cancellation beyond the terms making the customer solely responsible for exporting before termination. 6 8 15 18
The Skeptic
Admins can download all published posts and topics in Markdown or Docx via an emailed link — better than one PDF per page — and a vendor-assisted migration is offered. But drafts and secret topics the admin does not belong to are excluded from bulk export, attachments and history are never mentioned as included, import sources are unnamed, no self-hosted edition appears in the captured pages, and the terms put the burden of exporting on the user before termination. 6 8 15 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where pages, attachments and search indexes are stored and processed, and who the subprocessors are (hosting, CDN, search, email, support, payment, and the AI model provider that reads pages for answers and summaries, with whether content is used for training). Independently sourced by the sovereignty pipeline; a wiki holds internal processes, customer data and trade secrets, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU data residency available and an EU contracting entity or EU representative, but parts of the chain (CDN, search, email, support, AI model) run through non-EU providers without a stated safeguard, or EU residency is limited to the higher tiers.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations including the AI model provider, no training on customer content stated, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every page on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Operations Lead
The contracting entity is Fallacy Labs, Inc. of Covina, California, with hosting on Google Cloud Platform and personal data processed in the United States; the privacy policy relies on standard contractual clauses for EEA transfers and states data processing agreements with all recipients, but no subprocessor list beyond Stripe and Google Cloud is published and we found no public information on an EU hosting option. SOC 2 Type 2, SOC 3 and GDPR compliance are stated, but for a wiki holding our processes and trade secrets a US-only chain under California law is one I could not sign off lightly. 5 7 8
The IT Administrator
The contracting entity is Fallacy Labs, Inc. in Covina, California under California law, data is processed in the United States, and the security page names Google Cloud Platform as host without stating a region. Standard contractual clauses for EEA transfers, data protection agreements with recipients, and SOC 2 Type 2 plus SOC 3 certification are stated, which earns a small credit. We found no public information on a subprocessor list, an EU data residency option, or a self-hosted edition to fall back on — nothing here the works council would accept for a utility. 5 7 8
The Support Knowledge Manager
The contracting entity is Fallacy Labs, Inc. doing business as Slab under California law from Covina, California; the privacy policy states that data is transferred to and processed in the United States, hosting is on Google Cloud Platform with no region stated, and we found no public information on an EU hosting option. GDPR compliance is claimed with Slab as controller for European legislation, standard contractual clauses and data protection agreements are described, and SOC 2 Type 2 and SOC 3 are cited, but we found no public subprocessor list beyond Stripe for billing and no commitments covering the AI model provider. 5 7 8
The Engineering Lead
The contracting entity is Fallacy Labs, Inc. doing business as Slab in Covina, California, the privacy policy states data is transferred to and processed in the United States, and hosting is Google Cloud Platform. The policy commits to standard contractual clauses for EEA transfers and data protection agreements with recipients, and the vendor states SOC 2 Type 2 and SOC 3, but we found no public information on an EU residency option, a listed subprocessor chain, or a published data processing agreement. For a European buyer this reads as safeguards on paper around a United States operation. 5 7 8
The Quality Manager
The vendor is Fallacy Labs, Inc. of Covina, California, under California governing law, hosted on Google Cloud Platform, with the privacy policy stating data is transferred to and processed in the United States and no EU residency option appearing in any page we captured. Standard contractual clauses for EEA transfers, data protection agreements with all recipients, and SOC 2 Type 2 and SOC 3 claims are stated. Subprocessors are not listed anywhere — including any AI model provider behind the AI Ask feature — and we found no public information on an EU contracting entity or a self-hosted edition. 4 5 7 8
The Skeptic
A US entity under California law that transfers and processes data in the United States on Google Cloud, with no region choice offered anywhere in the captured pages. A privacy policy with standard contractual clauses and data processing agreement clauses exists and SOC 2 Type 2, SOC 3 and the host's certifications are published, but the subprocessors are not listed — including who provides the AI behind AI Ask — so the chain cannot be checked end to end. 5 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, readers or guests free or charged, minimum seats, which features (SSO, SCIM, audit log, verification, help-center publishing, custom domain, AI answers, EU data residency) cost extra, the free tier and its limits, storage limits, the self-hosted edition's licence and support price, minimum term and setup or migration fees.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, readers or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, AI, readers or guests, EU residency, the self-hosted edition) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (editors, readers, guests, storage), add-ons priced, the self-hosted edition's licence and support cost stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of editors and readers and a feature set, with every add-on, AI credit, setup, migration and support fee and the cancellation and data-return terms published.
The Operations Lead
Four tiers are public with annual per-user prices — Free at "$ 0 user / month" up to 10 users, Startup at "$ 6.67 user / month billed annually", Business at "$ 12.50 user / month billed annually", Enterprise "Custom, contact sales@slab.com" — and the page details attachment limits, version history, analytics retention, integration counts and support level per tier. But Enterprise is custom, the AI features are only labelled "Advanced" with no price, audit logs and the API sit on Business and Enterprise only, and billing counts every user who can log in — the help pages state there is no inherent read-only account, so sixty workshop readers would cost like sixty editors. 4 8 14 15
The IT Administrator
Four tiers are public with per-user annual prices — Free at $0 for up to 10 users, Startup at $6.67 user/month billed annually, Business at $12.50 user/month billed annually — and per-tier limits for attachments, version history, analytics retention and support level are stated. Enterprise is "Custom, contact sales@slab.com", the AI modules appear only as an "Advanced" label, and the audit log and API sit behind Business and Enterprise. We found no public information on monthly prices, minimum seats, guest charges, term or VAT treatment, so a buyer can estimate but not compute the annual cost for 900 staff from these pages alone. 4 8 14 15
The Support Knowledge Manager
The lower tiers are published with a clear scaling rule — Free at $0 user / month for up to 10 users, Startup at $6.67 user / month billed annually, Business at $12.50 user / month billed annually, billing every user who can log in — plus unusually concrete per-tier limits on users, attachment size, version history, analytics retention, integrations and support. Audit logs are stated for Business and Enterprise, and API and webhooks for Business and Enterprise, while the vendor states there is no account type that cannot edit, so there are no reader seats to price. Enterprise is custom through sales, and we found no public information on the price of the AI features sold as advanced, on which tier includes single sign-on, or on VAT treatment, minimum seats, term lengths and setup or migration fees. 4 8 14 15
The Engineering Lead
Tier prices are public per user billed annually — Free, Startup at $6.67 user / month, Business at $12.50 user / month — with per-tier user limits, attachment sizes, version history, integration counts, analytics retention and support levels, and billing counts every user who can log in, with no read-only accounts. Enterprise is quoted as custom with a contact address, and we found no public information on the plan gating of SSO and SCIM, pricing of the AI and custom-domain modules, minimum seats, VAT treatment or term length. Good enough to ballpark, not to compute a contract. 4 8 14 15
The Quality Manager
Free ($0, up to 10 users), Startup ($6.67 user / month billed annually, free for non-profits and education) and Business ($12.50 user / month billed annually) are published with per-plan limits on users, attachment size, version history, analytics retention and integrations, and the plan requirements for audit logs and the API are stated. Enterprise is "Custom, contact sales@slab.com". We found no public information on monthly billing rates, VAT treatment or minimum term, though a 30-day money-back guarantee and the no-refund-on-cancellation term are both stated. 4 8 14 15
The Skeptic
Free, Startup and Business per-user annual prices are public with unusually detailed tier limits on users, attachment size, version history, analytics retention, integration count and support level. But Enterprise is 'Custom', the captured pages give only annually billed prices, the Advanced add-ons including the AI modules carry no separate price, VAT and minimum seats are unstated, and there is no account type that cannot edit — billing counts every user who can log in, so a reader costs like an editor as far as the pages state. 4 14 15
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Slab
Is Slab European?
No. whats-best.ai classifies Slab as Rest of world.
Where does Slab store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Slab have a free plan?
Yes. Slab has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Slab?
As of 1 Nov 2026, the panel rates Document360 (3.5/5), BookStack (3/5) and XWiki (3/5) highest among the other 13 Knowledge Base & Wiki products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Document360 (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Slab alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage slab.com Checked 1 Nov 2026 Details →
- 2 Features page slab.com Checked 1 Nov 2026 Details →
- 3 Integrations page slab.com Checked 1 Nov 2026 Details →
- 4 Pricing page slab.com Checked 1 Nov 2026 Details →
- 5 Security page slab.com Checked 1 Nov 2026 Details →
- 6 Help center help.slab.com Checked 1 Nov 2026 Details →
- 7 Privacy policy slab.com Checked 1 Nov 2026 Details →
- 8 Terms of service slab.com Checked 1 Nov 2026 Details →
- 9 Editor, structure & search — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 10 Editor, structure & search — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 11 Verification, ownership & freshness — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 12 Verification, ownership & freshness — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 13 Permissions, SSO & administration — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 14 Permissions, SSO & administration — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 15 Help-center publishing & integrations — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 16 Help-center publishing & integrations — found from sitemap slab.com Checked 1 Nov 2026 Details →
- 17 Import, export & self-hosting — found from sitemap help.slab.com Checked 1 Nov 2026 Details →
- 18 Import, export & self-hosting — found from sitemap help.slab.com Checked 1 Nov 2026 Details →