Slite

GDPR overview

GDPR compliance is claimed explicitly, not merely implied: the security page states that Slite complies with the Regulation and lists the measures behind that claim. Concrete mentions include a published Data Processing Agreement, support for access, rectification, deletion and export rights, Standard Contractual Clauses for international transfers, documented retention and deletion procedures, a public sub-processor list, and periodic reviews. Production data sits entirely in the EU, at St. Ghislain in Belgium. A dedicated EEA contact is offered at gdpr@slite.com and at 128 Rue La Boetie in Paris, and the right to complain to a supervisory authority is acknowledged. One gap stands out: no Article 27 representative is named anywhere. The French affiliate is presented as an employment and support entity, expressly not as the contracting party.

Who owns the data?

Slite, Inc. is named in the privacy policy as the entity responsible for personal information it handles as a controller. The picture splits in two, and the split matters. Content that customers put into their workspaces is processed on their behalf: there Slite acts as a processor, governed by the customer agreement and the published Data Processing Addendum, not by the privacy policy. Personal information Slite collects in its own right covers account details, payment data, usage, communications and marketing preferences. Users may request access, a portable copy, correction, deletion, restriction, or object to certain uses, and admins can delete documents or an entire workspace at any time.

Reuse rights

The customer keeps control of workspace content: it can be read, edited, exported, published publicly, restricted to named users or groups, and deleted at will, without asking Slite for permission. Slite states its own uses of personal information: operating the service, customer communication, improving and securing the product, research and development, direct marketing, and legal compliance. It relies on contractual necessity, legitimate interests, and consent where required. Aggregated or anonymised data may be shared with third parties. Personal information may reach the user's own organisation, other workspace members, service providers, professional advisers, authorities and any acquirer of the business. On AI specifically, Slite states customer data is processed inside its own infrastructure and is not used to train external models; semantic embeddings are computed internally.

Data retention & training

Hosting summary

Slite runs on Google Cloud Platform, with all production data hosted in the EU at St. Ghislain in Belgium. The legal notice names Google Cloud Platform, operated by Google LLC, as the hosting provider. Structural data, meaning organisation metadata, user records and document hierarchy, sits in a relational database with daily backups replicated across several Google data centres inside the EU. Document content is held in MongoDB, and textual content is indexed in Elasticsearch for search. Media files are stored in EU Google Cloud Storage buckets, replicated across European data centres, with a daily copy in a secondary EU bucket. Data at rest is encrypted using Google Cloud's built-in mechanisms, with keys managed in GCP. Traffic in transit is protected by TLS rated A+ on SSL Labs, and internal traffic runs on a restricted private network with logged, limited employee access. End-to-end encryption is not offered. The corporate entity, however, is US-based, and the privacy policy notes that personal information is provided directly to Slite in the United States.