How data management features apply to canvases and lists

Canvases and lists are secure ways to collaborate and share information in Slack. Read on to learn more about how security and data management features apply when working with these tools in Slack.

Data retention, editing and deletion

Canvases and lists share a retention policy. The policy that you select will apply to all canvases (including channel canvases) and lists. The available retention policies will depend on your subscription.

The following data will be retained for canvases and lists until they are deleted, either manually or by your retention policy:

• Content in canvases and lists
• Version history
• Comment threads

Note: If your retention policy is set to retain canvases and lists for a set number of days, the retention period will be reset each time someone edits the canvas or list.

Export tools

Canvases

When you export your workspace data, the current version of the canvas will be included in HTML format. Prior versions of a canvas will be included in the export if your workspace or Enterprise Grid organisation can export data from all conversations. Here's what to expect in an export that includes a canvas:

• The current text-based content of the canvas
• The version history of the canvas (if data exports from all conversations are enabled)
• Anchored comments
  If the canvas includes any comments, your export will include a reference to the appropriate file conversation message that contains the text of the comment.
• Embedded files
  If a file has been embedded in the canvas, your export will include a reference to the appropriate channel message that contains the download URL.

Lists

When you export your workspace data, the current version of the list will be included in JSON format. Here's what to expect in an export that includes a list:

• A snapshot of the latest version of the list
  The snapshot will include any saved views, records of the list being shared, fields and limited data for the items.
• Comments on items
  If the list includes any comments, your export will include a reference to the appropriate file conversation message that contains the text of the comment.
• Version history
  Version history for lists will be included for workspaces and organisations who have applied to export data from all public channels, private channels and direct messages (DMs). 

Tip: Learn more about how to read Slack data exports.

Discovery API and Audit Logs API

On the Enterprise Grid subscription, org owners can use e-discovery and data loss prevention (DLP) apps to review and regulate content in canvases and lists. The existing Discovery API endpoints can be used to download and scan canvases and lists, and to perform operations such as tombstoning or deleting content.

Discovery API

Audit logs API

Available operations for canvases:

• Delete a canvas using the API
• Fetch the direct link to a canvas
• Fetch recently created or edited canvases
• Find when a canvas has been edited

• Retrieve comments on a canvas
• Retrieve the version history of a canvas
• Tombstone and restore a canvas shared in a message

Available operations for lists:

• Get list metadata
• Fetch the direct link to a list and download the current and previous versions in JSON format
• Fetch list thread messages, deleted thread messages or message edits

• Fetch recently created or edited lists
• Tombstone and restore a list shared in a message

The following audit log events are captured for canvases:

• Canvas created, edited or deleted
• Canvas tombstoned or restored
• Canvas opened
• Canvas shared or un-shared
• Canvas downloaded

• Canvas access granted, revoked, upgraded or downgraded
• Canvas version history enabled or disabled
• Link sharing enabled or disabled

The following audit log events are captured for lists:

• List created
• List deleted
• List title updated
• List icon updated
• List converted to template
• List template reverted
• List cell updated
• List column created, updated, deleted or reverted
• List row created, updated or deleted

• List view created, updated or deleted
• List access revoked, added, upgraded or downgraded
• List downloaded
• List link sharing enabled or disabled
• List opened
• List tombstoned or restored
• List ownership transferred

Enterprise Key Management

Enterprise Key Management (EKM) allows customers to use their own encryption keys to control their data. Canvases and lists use the same key process for encryption as Slack messages and files, so if you've already configured EKM for your organisation, you won't need any additional configuration for canvases or lists.

• Key rotation
  When an encryption key is rotated, canvas data will be re-encrypted with the new key.
• Key revocation
  Access to canvases can be revoked using the same process as file revocation.

Data residency

Data residency for Slack allows you to choose the region where certain types of data are stored. Data from canvases and lists that you create after configuring data residency will be stored in your selected region. The data from any canvases or lists that you created prior to enabling data residency will remain stored in the US.

Legal holds

In an Enterprise Grid organisation, anyone with the legal holds admin system role can place a legal hold on specific members to preserve their messages and files in Slack. A legal hold placed on a member will override the canvas and list data retention policy. Canvases and lists will not be purged when deleted, nor will they be automatically purged due to age.

Channel or DM canvases

Standalone canvases

Lists

A channel or direct message (DM) canvas is subject to legal hold if it's in a conversation where a custodian is or was a member. There is no requirement that any activity occur within the channel or the canvas during the hold’s active period.

A canvas can be put on a legal hold if it meets both of the following criteria:

• It is associated with one of the hold’s custodians.
• It is active during the hold period.

Associated with the custodian
The following conditions determine whether a canvas is associated with the custodian:

• Created by the custodian before the end of the hold period.
• Shared to a held channel before the end of the hold period.
• Edited by the custodian before the end of the hold period.

The following are not considered when determining whether a canvas is associated with a custodian:

• The canvas was viewed by the custodian.
• The custodian is in the canvas’s file conversation.
• The custodian has starred the canvas or saved the canvas to Later.

Active during the hold period
For a canvas to be considered active during the hold period, it must meet the following conditions:

• Have been created or deleted during the hold period.
• Have been shared to a held channel during the hold period.
• Have had its contents edited, by anyone, during the hold period.
• Have had a comment created, edited or deleted, by anyone, during the hold period.

A list can be put on a legal hold if it meets both of the following criteria:

• It is associated with one of the hold’s custodians.
• It is active during the hold period.

Associated with the custodian
The following conditions determine whether a list is associated with the custodian:

• Created by the custodian before the end of the hold period.
• Shared to a held channel before the end of the hold period.
• Edited by the custodian before the end of the hold period.

The following are not considered when determining whether a list is associated with a custodian:

• The list or record was opened by the custodian.
• The custodian starred the list or saved the list to Later.
• The custodian is in the list's file conversation.
• The custodian subscribes/unsubscribes to list items.

Active during the hold period
For a list to be considered active during the hold period, it must meet the following conditions:

• Have been created or deleted during the hold period.
• Have been shared to a held channel during the hold period.
• Have had its content edited, by anyone, during the hold period.
• Have had a comment created, edited or deleted, by anyone, during the hold period.

Note: Reading a canvas or list during a hold period does not constitute the canvas or list as 'active during the hold period'.