01
Install and scope the connection
Connect over OAuth or an app install and choose exactly what Slack shares — you can revoke it on your side at any time
Slack carries devguard's alerts into the channels your team already watches, and read-only checks review workspace access: token connectivity, workspace identity, and member posture on Enterprise Grid.
3 read-only checks, run on a schedule. Each failure becomes a finding linked to a control — every check is listed, none are “coming soon”.
Confirms the token authenticates and identifies the workspace. Slack returns HTTP 200 with `ok: false` on auth errors, so this check asserts `ok` is true, not just the HTTP status.
token-connectivity
Access-review evidence: confirms the connected workspace/enterprise resolves via team.info. Reads `team.enterprise_id` to distinguish Enterprise Grid. Asserts `ok` is true because Slack signals errors with HTTP 200 + `ok: false`.
workspace-identity
Access-review check (Enterprise Grid only): enumerates org members via admin.users.list and fails if the roster is empty. An empty roster also covers the HTTP-200-with-`ok: false` case (missing Enterprise Grid, wrong token type, or missing admin.users:read scope), which yields no `users` array and therefore fails closed.
enterprise-member-roster
Bring your current platform's test list — we'll map it against these checks, gap by gap
Send alerts to the channels your team already watches, so a review, deadline or finding shows up where people are, not in another inbox.
Setup is minutes, not a migration project — and every step stays on your side
Connect over OAuth or an app install and choose exactly what Slack shares — you can revoke it on your side at any time
The first run starts right after connecting, then repeats on a schedule. Results are timestamped, so your evidence has a history, not a snapshot.
Passing results attach as evidence to the controls they support; failures become findings you triage. When the audit comes, the proof is already connected.
Open any page for its full check register.
You create and scope every credential yourself, and you can revoke it at any time. Checks only read; results and evidence are stored in Switzerland and stay exportable.
Yes. The checks authenticate with a credential you create and scope yourself, and only ever read configuration. devguard holds no write access to Slack and remediates nothing silently.
A failed check becomes a finding linked to the control it supports, with the evidence attached. You decide the treatment — nothing pages your engineers and nothing is auto-remediated.
Checks run from Swiss infrastructure, and results and evidence are stored in Switzerland. Everything is exportable — your evidence stays yours.
20 minutes on how you run certification today. Bring your current test or control list and we'll map it against these checks — honestly, gap by gap.