How we built enterprise search to be secure and private

Summary

The article discusses the development of Slack's enterprise search feature, emphasizing its security and privacy principles that align with Slack AI's compliance standards. It details how the system utilizes Retrieval Augmented Generation (RAG) to ensure that customer data remains within Slack's trust boundary and is not used to train large language models. The architecture leverages OAuth for user permissions, ensuring that only authorized data is accessed and that external data is not stored in Slack's databases. This approach allows for real-time, permissioned search results from external applications like Google Drive and GitHub, enhancing the user experience while maintaining strict security protocols.

Key Learnings

• 1Slack's enterprise search uses Retrieval Augmented Generation to provide real-time, secure access to external data without storing it.
• 2The architecture ensures that customer data remains within Slack's trust boundary, adhering to enterprise-grade security standards.
• 3OAuth is utilized to manage user permissions effectively, ensuring that users control access to their external data.
• 4The principle of least privilege is applied by only requesting necessary permissions for external data access, enhancing security.

Who Should Read This

Senior Security Engineers implementing enterprise-grade security measures in AI-driven applications

Test Your Knowledge

Topics