Security
What Ezra can see, what it does with it, and how to turn it off.
What can Ezra read in Slack?
Only conversations it’s been added to: channels someone invites it to, public or private, group DMs that include it, and direct messages with Ezra. Once it’s in a channel, it can read that channel’s earlier messages too. It can’t join channels on its own or search your workspace. It works only through its own bot account and never acts as a person.
These are the permissions Slack shows when you install it:
| Slack permission | Why Ezra needs it |
|---|---|
app_mentions:read | See when someone tags @Ezra |
channels:history, groups:history | Read messages in public and private channels it’s been added to |
channels:read, groups:read | See channel names and who’s in them |
im:history, im:read, im:write | Read and reply to direct messages with Ezra |
mpim:history, mpim:read, mpim:write | Read and reply in group DMs that include Ezra |
chat:write | Post its replies |
files:read, files:write | Read files shared where it works, and upload the reports and charts it makes |
reactions:read, reactions:write | See reactions, and react to show it’s on a request |
pins:read, pins:write | See pinned messages, and pin or unpin its own posts |
emoji:read | Use your workspace’s custom emoji |
users:read, users:read.email | See who’s asking, including their work email |
Company and personal connections
Ezra reaches only the tools your team connects. Every connection uses OAuth, so we never see or store a password. In Ezra’s settings they appear as Company tools and Just for you.
Company connections. Anyone in the workspace can ask Ezra to use these, so connect only what your team should share. The person who installed Ezra and the admins they name manage them. We recommend connecting them through an account made for Ezra, like ezra@yourcompany.com, shared with only what Ezra should see, the way you’d share with a new hire. We can set it up with you as part of a guided setup. Write to hello@tryezra.ai.
Personal connections. Used only for the person who connected them. Connect your own Gmail or calendar and Ezra can draft your replies or prep your next meeting when you ask. If a colleague asks Ezra to read your email, in a shared channel or a direct message, the request is refused. When you ask in a shared channel, the answer is posted there for everyone in it, so ask in a direct message for anything private.
How it’s enforced. The AI model Ezra runs on never sees your tokens and can’t call your tools directly. Every tool request passes through a gateway that runs outside the model. Slack tells Ezra who sent each message, and that identity is attached to the request outside the model, so no prompt can change it. Before any call goes through, the gateway checks that the connection belongs to the company or to the person who asked. A colleague’s request carries the colleague’s identity, and your Gmail connection is registered to you, so the call is refused before it reaches Gmail. Ezra can’t even list your connections for someone else.
Where does Ezra run?
Each company gets its own Ezra on its own deployment, and its memory stays there. Data is encrypted in transit and at rest.
What does Ezra remember?
Two kinds of memory: one memory the whole team shares, built from the work, and a separate memory for each person. The memory is yours, and you can export it anytime.
What Ezra learns in a private channel or a direct message stays there. It doesn’t come back in an answer for someone outside that conversation.
What needs a human click?
Reads aren’t gated. Anything Ezra sends or publishes outside your workspace waits for a person to click approve. Ezra posts an approval card in Slack and waits for the click.
Is our data used to train models?
No. Your workspace’s content is not used to train or fine-tune any model, ours or a provider’s. Model providers are engaged under terms that exclude API content from training, and content sent to a model serves that one request. Each workspace picks which model Ezra runs on.
Who at Ezra can see our content?
Access to workspace content is limited to the people who need it, and only to support you, fix problems, keep Ezra secure, or meet legal obligations.
Is there an audit log?
Yes. Ezra records what it read, when, for whom, and which model ran. Workspace admins can request the log at any time.
How do we turn it off?
- Remove Ezra from a channel and it stops reading that channel.
- Disconnect a tool and Ezra’s access to it ends immediately.
- Uninstall Ezra and workspace content is scheduled for deletion within 7 days. Billing records are kept as long as the law requires.
Who else processes our data?
Service providers for workspace communications and connected applications, authorization and integrations, model inference, public web search, workflow scheduling, payments and usage metering, and hosting, compute and storage. For the current list of providers and their roles, write to hello@tryezra.ai.
Certifications
SOC 2 Type II is in progress and not yet complete.
Reporting a security issue
Write to hello@tryezra.ai.
More detail is in the Privacy Policy and the Terms of Service.