SOC2 Type II, HIPAA, and GDPR compliance
Conclude is SOC2 Type II certified, HIPAA compliant, and GDPR compliant. All data is encrypted using TLS 1.2+ in transit and AES-256 at rest. Compliance information is available in our Vanta Trust Center.
This page is written for security, IT, procurement, and compliance teams evaluating Conclude for enterprise or regulated-industry use, including organizations subject to HIPAA.
At Conclude, security is integral to our mission of enabling seamless collaboration across platforms. We protect data through rigorous security measures and compliance with global data protection regulations.
Encryption, infrastructure and access control
Encryption and Data Protection: Conclude ensures all data transmitted and stored within our platforms is encrypted using HTTPS with TLS 1.2 or higher.
Data at Rest is protected using advanced encryption methods. Specifically, we use AES-256 encryption to secure stored data, ensuring it is safeguarded against unauthorized access and breaches.
Our data storage is secured on Google Cloud Platform with automated backups and point-in-time recovery options.
Minimal Permission Requirement: Conclude is committed to respecting user privacy by never asking for more permissions than are necessary to provide our services. This ensures that only essential data is accessed, aligning with our privacy-first approach and minimizing potential risks.
For a full list of Microsoft Teams RSC (Resource Specific Context) scopes requested by Conclude to connect platforms and Microsoft Teams delegated scopes requested by Conclude for User Sync, click here.
For the full list of Slack bot token scopes (which govern what Conclude can access) and Slack user token scopes (that can access user data on behalf of users that authorize them), click here.
Enterprise-grade Compliance: Conclude is SOC2 Type II certified, independently audited by Johanson Group, and HIPAA compliant, meeting the required safeguards to protect sensitive healthcare data. We are committed to maintaining the security and confidentiality of customer data, ensuring that our procedures and security measures are aligned with the required standards.
Our latest SOC2 Type II audit, covering September 1, 2025 – August 31, 2026, assessed Security, Availability, and Confidentiality and resulted in an unqualified opinion, with no exceptions identified. The report was issued on October 22, 2026. We use Vanta to continuously monitor our security and compliance controls. See all relevant controls and information in the Vanta Trust Center.
Independent Penetration Testing: Our production web application undergoes independent gray-box penetration testing by Workstreet, following industry standards including OWASP Top 10 and NIST SP 800-115. The latest report, dated June 15, 2026, identified no critical or high-severity vulnerabilities. Our SOC2 Type II and penetration testing reports are available to eligible customers and prospects on request.
Privacy First: We comply with major regulatory frameworks including GDPR, ensuring that personal data is handled with utmost care and only per legal and regulatory requirements.
Robust Infrastructure: Our platform architecture utilizes CloudSQL/PostgreSQL for relational data, Memorystore/Valkey for caching, and maintains high-availability configurations to ensure reliability and performance.
Data processing, sub-processors and incident response
Data Processing: We process data strictly to facilitate the functionality of Conclude without storing any personal data beyond what is necessary for transactional integrity and operational requirements. See Conclude’s Privacy Policy for more.
Sub-processors and Third-Party Interactions: We engage sub-processors including Google (hosting), our email and SMS providers, and — where Conclude Agents is enabled — OpenAI and/or Anthropic to enhance our service offerings, ensuring they adhere to our stringent security and privacy standards. A full list is in Section 10 of our Data Processor Agreement.
Regulatory Compliance and Rights of Data Subjects: Conclude assists in safeguarding the rights of data subjects under GDPR, including access, correction, and erasure of personal data. See more about how we handle and process this data here.
Incident Response and Breach Notification: In the unlikely event of a data breach, Conclude is committed to notifying affected parties without undue delay and taking immediate remedial actions to prevent future occurrences.
Commitment to transparency and trust
At Conclude, we believe in full transparency and are committed to upholding the highest standards of data protection and security. For more detailed information about our security practices or to request security documentation, please contact our support team.
Frequently asked questions
What data does Conclude store?
Conclude stores minimal data necessary for service operation. Primarily, we retain metadata associated with user interactions to ensure seamless functionality across platforms. This includes technical identifiers and logs of actions taken within Conclude.
All data is protected with robust security measures, including encryption, to maintain privacy and compliance with data protection regulations.
How long is data stored?
We keep your data while your agreement with Conclude is active. When you request deletion, or when your agreement ends, we erase it within the timeframe set out in our Data Processor Agreement. You can choose to have your data returned before it is erased.
Does Conclude Connect store user messages or files?
No, Conclude Connect does not store user messages or files. It only retains message metadata for future reconciliation across platforms, but the actual messages and files are not permanently stored.
If you add a Conclude Agent or a Conclude app to a connected channel, the content storage described in “How long are conversations stored?” applies to that channel.
How long are conversations stored?
Conclude stores conversation content only where a feature requires it:
Connected channels (Conclude Connect): message content and files are not stored. They pass through Conclude only while they are converted between Slack and Microsoft Teams. We keep message metadata, such as message IDs, so edits, replies, and deletions stay in sync.
Channels with a Conclude Agent: recent messages are stored briefly so the agent can build prompts for the AI model you selected. These messages are sent to the AI provider (Anthropic or OpenAI) to generate a response. Neither Conclude nor the provider uses your data to train AI models.
Channels with a Conclude app: ticket content, including ticket messages, is stored until the ticket is deleted, or until your data is erased on request or at the end of your agreement.
What data does Conclude collect?
We collect minimal data necessary from customer collaboration platforms like Slack, Microsoft Teams, Jira, and Zendesk to operate Conclude effectively. This includes workspace names, user contact information, channel data, actions within channels, and usage statistics.
All collected data is essential for providing our services and is obtained with explicit user consent. We prioritize security in handling this information, employing stringent data protection measures to ensure its confidentiality and integrity during collection and processing.
How does Conclude handle messaging access and data on Slack?
Conclude can only view messages in channels/direct messages where the app is a member. If the Conclude app is not in the conversation, it won’t be able to view any of its contents. Conclude needs the ability to view the messages in a synced channel in order to post the same message on Microsoft Teams.
How does Conclude handle messaging access and data on Microsoft Teams?
Conclude will only subscribe to the channels/chats that are required. If the Conclude Teams app is installed into a Team or Chat, Conclude will get notifications about new messages in that Team or Chat. Conclude will ignore and immediately discard any data not required to perform its services. For connected channels/chats, only conversation metadata as described above will be stored by Conclude.
How does Conclude handle the deletion of data?
Conclude is committed to ensuring that your data is handled securely and with respect to your privacy rights. When data is no longer needed for service provision or at the request of a user, it is deleted from our systems in line with our Data Processor Agreement. Deletion covers our production systems; backup copies are erased on our ordinary backup rotation cycle. Our processes are designed to protect against unauthorized access or inadvertent data retention.
How is data secured against potential breaches?
Alongside encryption, we employ continuous monitoring and have implemented stringent access controls to safeguard data.
What happens if there’s an interruption in service?
Our architecture is designed for resilience, with automatic failovers and redundancy to handle potential outages seamlessly.
How can I access security documentation?
Security documentation is available to customers upon request. For a full list of Microsoft Teams RSC scopes requested by Conclude to connect platforms and Microsoft Teams delegated scopes requested by Conclude for User Sync, click here. For the full list of Slack bot token scopes (which govern what Conclude can access) and Slack user token scopes (that can access user data on behalf of users that authorize them), click here.
Is Conclude suitable for healthcare organizations and other regulated industries?
Yes. Conclude is HIPAA compliant and SOC2 Type II certified, meeting the safeguards required by healthcare organizations and other regulated industries. Security and compliance documentation, including our Vanta Trust Center report, is available on request for procurement and vendor risk reviews.