VendorScore · Comparison · Data-access posture
Evidence dated 2026-10-06 to 2026-10-07, public docs only, not legal advice.
Short answer
Both can read your chats by design: neither encrypts chat messages end-to-end. In the scored configurations, Microsoft Teams (70/100) has less inherent vendor read access than Slack (62/100), helped by Customer Key, Customer Lockbox and E2EE for one-to-one call and E2EE meeting media; Slack EKM gives you key custody and revoke, not zero-knowledge.
Higher score = less inherent vendor read access in the scored configuration, not a more secure product. Each score comes from that vendor's VendorScore page.
| Slack | Microsoft Teams | |
|---|---|---|
| Overall score | 62/100 | 70/100 |
| Scored configuration | Enterprise Grid/Enterprise+ with Slack Enterprise Key Management (EKM, customer AWS KMS). | Teams in a Microsoft 365 enterprise tenant with Purview Customer Key (multi-workload DEP), Customer Lockbox, and E2EE enabled for one-to-one VoIP calls and (Teams Premium) meetings that require it. |
| Key custody option | Enterprise Key Management (EKM): keys for messages, files, search index and canvases sit in your AWS KMS. Some metadata (channel names, profiles, filenames) may stay on Slack-controlled keys. | Purview Customer Key: Teams chat, media messages and recordings in Teams storage use your Azure Key Vault root keys; Microsoft keeps an availability key. Customer Lockbox gates engineer access. |
| E2EE / CSE scope | None. Slack isn't end-to-end encrypted, and EKM is not zero-knowledge: Slack decrypts with authorized key use to run search, notifications and apps. | Only audio, video and screen sharing in one-to-one VoIP calls and meetings set to require E2EE (Teams Premium); call E2EE is off by default. Never chat, files, recordings or transcripts. |
| AI training default (scored config) | Off by default (opt-in). Applies to generative AI models. Non-generative global ML models are different: an Owner can opt out by contacting Slack. | Not used for training by default. Microsoft says prompts, responses and Microsoft Graph data, which includes Teams chats and meetings, aren't used to train foundation LLMs. |
| EU residency | Yes, for certain data at rest (e.g. Frankfurt, Paris). Free and Pro must upgrade to Business+ first; some data categories may be stored outside the region. | Yes: Teams stores data in your tenant's geography (including France, Germany and the EMEA region), and Microsoft 365 is an EU Data Boundary service. |
| DPA link | Slack DPA | Microsoft DPA |
Dimension scores (key custody, plaintext access, encryption claims, subprocessors, auditability) stay in the full PDFs.
Get the full 5-dimension PDFs — join the waitlist
PDFs aren't for sale yet. Join the waitlist and we'll email yours when it's ready. No calls.
Slack isn't end-to-end encrypted, and EKM is not zero-knowledge. Teams E2EE covers only audio, video and screen sharing in one-to-one VoIP calls and in meetings set to require E2EE (the organizer needs Teams Premium). It never covers chat messages, files, recordings or transcripts, and call E2EE is off by default.
In the scored configurations, Microsoft Teams scores 70/100 and Slack 62/100, so Teams has less inherent vendor read access. Both scores assume enterprise options: Slack EKM, and Teams Customer Key, Customer Lockbox and E2EE where enabled. A higher score means more customer control, not a guarantee that the vendor can't access content.
Slack doesn't publicly claim that staff cannot access Customer Data for support or operations; access is policy-controlled. Microsoft says engineers have no default access to cloud customer data, and Customer Lockbox lets you approve such requests for Teams chats, files posted to chats, meeting recordings and transcripts.
Slack says it won't use Customer Data to train generative AI models without affirmative opt-in consent; for non-generative global ML models, an Owner can opt out by contacting Slack. Microsoft says prompts, responses and Microsoft Graph data, which includes Teams chats and meetings, aren't used to train foundation LLMs.
Slack: yes for certain data at rest, including Frankfurt and Paris; Free and Pro workspaces must upgrade to Business+ first, and some categories may be stored outside the region. Teams: yes, in your tenant's geography (including France, Germany and the EMEA region), and Microsoft 365 is an EU Data Boundary service.
Every URL cited on this page. Scores, configurations and facts come from the linked VendorScore vendor pages and their reports; nothing here goes beyond them.
This comparison restates the vendor pages for the scored configurations only; default setups usually score lower. A higher score means less inherent vendor read access in that configuration, not a safety rating. VendorScore doesn't certify compliance. Public-docs review only. Not a pen test, not legal advice, not a SOC 2 substitute.