Security and data

ShakaFlow reads your team's work in Slack, GitHub and your tracker to find what is stuck. This page lists what it reads, what it can change, where the data lives and how to remove it.

What ShakaFlow reads

Slack: names, email addresses and time zones of workspace members, to match people across tools. Up to 10 channels you link to a team, once ShakaFlow is a member: the last three days, at most 150 messages, read for the analysis and not stored. It skips Slack Connect channels and private channels the person receiving the message is not in. Messages people send to ShakaFlow, and replies in the follow-up conversations it starts (it keeps the last few to know what was handled). It does not read direct messages between people.
GitHub: pull requests, reviews, comments and commit details in the repositories you choose when you install the ShakaFlow GitHub app.
Your tracker (Linear, Jira or Shortcut): issues or stories, their status, assignees and comments in the projects you choose.

What ShakaFlow can change

Slack: it sends Team Anomalies messages to the people they are for. It posts as a manager only when that manager presses Ask and then Send Message on a follow-up; otherwise its own bot sends.
Your tracker: Team Anomalies changes your tracker only after a person approves the change in Slack. A person can choose to skip their own confirmations for 30 days.
GitHub: nothing changes; ShakaFlow's access is read-only.

Where your data lives

Hosted service: a PostgreSQL database run by ShakaCode on Control Plane. Every token, key and secret ShakaFlow stores is encrypted at rest; passwords and API tokens are stored as hashes. All traffic uses TLS 1.2 or higher. Infrastructure access is limited to authorized ShakaCode staff with multi-factor authentication, and it is logged.
Self-hosted: everything stays in your own database. For Team Anomalies, ShakaFlow talks only to the services you connect: Slack, GitHub, your tracker and your AI provider. Error reports go nowhere unless you add your own Honeybadger key.

AI

ShakaFlow uses your own OpenAI or Anthropic key; setup does not finish without one. Prompts are sent and billed under your account and your provider's terms.

Prompts can include the work data above: pull request titles and descriptions, tracker items and messages from linked channels.

We do not train any model on your data.

Retention and deletion

When you uninstall ShakaFlow from Slack, it loses access right away and your workspace's data is deleted seven days later. Reinstalling within those seven days keeps your history.

To delete everything sooner, email support@shakaflow.com from a workspace admin address; we delete within seven business days and confirm in writing.

Server logs are kept up to 30 days and error reports up to 30 days. Encrypted backups expire on their own rotation.

The hosted dashboard uses Sign in with Slack or Google; self-hosted uses a password with rate limits. There is no SAML single sign-on or multi-factor sign-in yet.

Slack permissions

Every Slack permission ShakaFlow asks for when you add it to your workspace, and why.

Requested at install

Permission	Why ShakaFlow needs it
`app_mentions:read`	Answer when someone mentions @ShakaFlow.
`channels:history`	Read a thread when someone asks ShakaFlow to summarize it, and the last three days of public channels you link to a team, read for the analysis and not stored.
`channels:manage`	Create, rename and archive the channels an admin sets up for beta features such as check-ins.
`channels:read`	List public channels and their members, for the channel pickers in setup and settings.
`channels:write.invites`	Invite team members to a channel ShakaFlow created for a beta feature.
`chat:write`	Send Team Anomalies messages and replies as the ShakaFlow bot.
`chat:write.customize`	Show a team member's name and avatar on a summary posted for them. Slack still labels it as an app message.
`chat:write.public`	Post a notification to a public channel without joining it, so ShakaFlow gets no access to that channel's messages.
`commands`	Run the `/sf-days-off` command.
`files:read`	Read the GitHub metrics spreadsheet ShakaFlow keeps in a check-in thread, to update it.
`files:write`	Upload that spreadsheet, and the ShakaFlow emoji pack when someone asks for it.
`groups:history`	The same as `channels:history` for private channels. Only a member of a private channel can link it, and what ShakaFlow finds there reaches only people in that channel.
`groups:read`	List the private channels ShakaFlow is in, and their members.
`groups:write`	Create, rename and archive the private channels an admin sets up for beta features.
`groups:write.invites`	Invite team members to a private channel ShakaFlow created for a beta feature.
`im:history`	Read the messages people send to ShakaFlow in a direct message.
`im:write`	Send Team Anomalies messages and other notifications by direct message.
`mpim:history`	Read replies in the group conversations ShakaFlow opens for a follow-up, so the next message shows what was handled.
`mpim:read`	List the group conversations ShakaFlow is in.
`mpim:write`	Open the group conversation for a follow-up between a manager, a developer and ShakaFlow.
`users:read`	Read members' names and time zones, to match people across tools.
`users:read.email`	Read members' email addresses, to match people across tools.
`assistant:write`	Run the ShakaFlow assistant in Slack's split view, which needs a paid Slack plan.

Optional, for each manager

A manager can also connect their own Slack account so follow-ups go out under their name. Declining changes nothing else; the bot sends instead.

Permission	Why ShakaFlow needs it
`chat:write`	Send a follow-up under the manager's own name, only after they review it and press Send Message.
`im:write` and `mpim:write`	Open the direct message or group conversation for that follow-up as the manager.

Report a security issue

Email support@shakaflow.com with Security in the subject; we reply within two business days, usually the same day.