Legal Holds in Slack: Should You Collect Data to Preserve It or Preserve in Place?

| November 3 2021

A head-to-head match—and the winner is … 

Ediscovery can feel like a fight sometimes, with every choice feeling like a struggle: when do you initiate a legal hold? Which custodians are subject to that hold? What data do you need to preserve? Then there’s the question of how best to preserve relevant data. Should you preserve data in place or preserve it by collecting it and transferring it to an external storage repository? 

While the answer depends on your specific circumstances, here’s how the comparison might play out in a head-to-head match between collect to preserve (CTP) and preserve in place (PIP). 

Round 1: Availability

When it comes to Slack data, the question of how to preserve data had been a moot point as the only way to reliably and defensibly preserve data from Slack was to collect that data into an external repository. Recently, however, Slack enabled legal holds for Enterprise Grid customers that permit in-place preservation. When implemented, Slack Legal Hold suspends the retention policy for relevant Slack content, such that held data is exempted from that destruction schedule including subsequent edits and deletes.

But there’s a catch: Slack Legal Hold is only available to customers who pay for the top tier of Slack plans, Slack Enterprise Grid. For everyone else using Slack—from the free plan through the Business+ plan—the only way to defensibly preserve Slack data is to collect it. Depending on the license level, the organization can export message content in JSON format to collect-to-preserve.  

CTP:   10 , PIP:   9 .

Because PIP isn’t available to all Slack users, CTP wins this round. 

Round 2: Cost

As they say, more money, more problems—and in ediscovery, the more data you collect, the more money it’s going to cost you (which is a problem in itself). For every gigabyte of data entering the top of your ediscovery funnel due to overcollection, there is a cost associated with transferring that data to an external repository and safely storing it there over the life of the matter. You also have to incur the cost for each gigabyte of data you need to be processed, reviewed, analyzed, and ultimately produced. It adds up fast. 

With in-place preservation of Slack data, you don’t have to pay to transfer that data or store it anywhere—it’s securely locked down within the Slack infrastructure where it was created. If the matter resolves early, preserving data in place costs you zero dollars… once you’ve paid for an Enterprise Grid license, that is. 

CTP:   9 , PIP:   10 .

For reducing costs, this round goes to PIP, tying the match at 19–19. 


Listen to experts talk about Slack Legal Hold in this on-demand webinar. 

2021-10-webinar-Three-things-you-need-to-know-about-Slack’s-New-legal-hold-social (on-demand-1)


Watch the Webinar



Round 3: Risk of Data Spoliation

The very point of preservation is to ensure that data is safely held for later use including ediscovery. Data that isn’t adequately preserved is vulnerable to spoliation, the loss or damage of data so that it is no longer available to the parties. While in-place preservation is, for the most part, highly secure and reliable, there are a few asterisks on that statement. 

First, Slack’s in-place preservation doesn’t control data in shared channels. In a shared channel, Slack grants control over each message to the organization that created that message. Suppose that Organization A and Organization B share a channel where they discuss a project that is the subject of pending litigation. Organization B has set its Slack retention schedule for 30 days, while Organization A has—in recognition of its obligation to preserve data for litigation—implemented Slack Legal Hold to preserve its messages in that shared channel. After 30 days, Organization B’s messages disappear, leaving Organization A’s messages as a one-sided conversation. 

Nor does in-place preservation protect channels from outright deletion. If a Slack user who’s subject to a hold actively participates in a particular channel, that channel is exempt from the organization’s retention period so long as the hold is in effect. But should the channel itself be deleted by an administrator while the hold is pending, its message and file data will not be saved. 

By contrast, when you’ve collected data to preserve it, you know that data is locked down. It’s in a separate repository where no one can delete or modify it. 

CTP:   10 , PIP:   9 .

This round goes to CTP, which pulls ahead to 29–28. 

Round 4: Early Case Assessment Tools

When you preserve Slack data in place, it’s still in Slack. That’s the point, of course, but the result is that it's not easy to analyze, search or assess that data while it remains in Slack. Until you export—or collect—the data, you can’t begin early case assessment (ECA) to gain a deeper understanding of your potential litigation matter. 

On the other hand, once you collect data into a discovery repository, you create the opportunity for advanced searches and data analysis. In-depth ECA might give you the jump on pending litigation, providing valuable insight into whether you should settle or stick to your guns. 

CTP:   10 , PIP:   9 .

CTP wins another round, bringing the score to 39–37. So, is CTP going to win the day? Not so fast—the last round is a big one.

Round 5: Security Risks

When you preserve data directly in the program or app where it was created, as with Slack Legal Hold, you minimize the security risks inherent when transferring data to an external location. You also have fewer storage locations to secure and fewer opportunities for data breaches or security lapses. 

If you collect data to preserve it, there will always be a higher potential security risk. Every copy in every storage location can become a target for hackers meaning there is always an amplified risk of secure data being a target.  It goes without saying that every storage location needs to be secure, but with each, the risk of exposure can increase.

CTP:   8 , PIP:   10 .

This round goes to PIP by a 2-point margin, which means we end on a 47–47 tie.


There’s no clear winner when it comes to how you should preserve Slack data for ediscovery. Depending on your Slack license, you may not have the option of using Slack Legal Hold, in which case collecting to preserve wins by default as your only avenue to preserve data. You may be primarily interested in shared channels where you need to collect data to preserve both sides of the conversation. On the other hand, you may be concerned about limiting the cost of collection and data storage or avoiding the additional security risks associated with collecting data into a separate repository. The key is to understand and appreciate the pros and cons of both approaches so that you can make the right decision for your organization in each litigation matter.

Fortunately, our purpose-built Slack ediscovery tool, Hanzo Hold for Slack, makes Slack data preservation easy whichever way you decide to go. Hanzo Hold for Slack works seamlessly with Slack’s in-place preservation for Enterprise Grid customers, but it also allows companies with lower levels of Slack to collect data to preserve it. Hanzo Hold facilitates intelligent collection as well, allowing users to preserve broadly while narrowly focusing on the data necessary for collection. Hanzo Hold for Slack follows a “collect once, use many” protocol that only collects data once instead of creating multiple copies. And Hanzo ensures the highest standards for integrity and security of customer data, as demonstrated by its SOC 2 Type 2 certification, so you can rest easy that your data is secure. 

With Hanzo Hold for Slack, you can choose the best solution for data preservation, shielding information from loss, and minimizing potential security risks—not to mention the costs—associated with unnecessary collection. Hanzo Hold for Slack also enables sophisticated ECA techniques such as searches using keywords, custodians, channels, date ranges, or any combination of factors and gives users the option to view results in a list or individually in their surrounding context. Finally, Hanzo Hold for Slack creates targeted review-platform-ready exports that are clear and simple to read and review.

Ready To Learn More?

Contact Hanzo,  to learn more or see a demonstration.

Book a Demo


Related posts

Thanksgiving Ode to Spotlight AI

Thanksgiving Ode to Spotlight...

Recently, the team at Hanzo announced Spotlight AI, the first automated relevance assessment engine for eDiscovery. ...

Read More >
Navigating Out of the AI Pilot Purgatory: A Roadmap to Success

Navigating Out of the AI...

In the ever-evolving world of AI, many organizations find themselves trapped in what several affectionately term the ...

Read More >
Understanding California Senate Bill 235: A New Chapter in Civil Discovery

Understanding California...

When it comes to the legal landscape, every new law or amendment can have a significant impact on the processes and ...

Read More >

Get in Touch to Learn More

Hanzo’s purpose-built, best-in-class solutions can help your readiness to respond to the next discovery request, investigation, or audit. Contact us to learn more.

Contact Us