Trust

Security

Last updated: August 21, 2026

Three guarantees, then the details. This page is the human version of what we also publish for agents in llms.txt.

The trust model

Invited channels only

Open Tag reads a Slack channel only after a human invites it in. There is no workspace-wide ingestion. Removing it from a channel ends access with the membership.

Irreversible actions wait

Sending, spending, merging, or deleting stops at an approval button. The gate is in the runtime, not in the model's judgement. If a tool returns an error, Open Tag stops and says so — it does not retry sensitive actions on its own.

Your access, your key

Integrations are scoped to the person who connected them. The model is the one you configured with your own key. Open Tag does not hold a master key to your company, and it does not pick a model vendor for you.

Models and data

When a job runs, the content needed to complete it is sent to the model provider you chose, under that provider's terms. If you run an open-source model on your own hardware, that content stays inside your infrastructure.

We do not sell your personal information. We do not use your private content to train our own models. That is a policy, not a toggle.

What we do not claim

• This site does not claim SOC 2 or any other certification. If that changes, it will be stated here as complete — not "in progress" as if it were done.
• Slack is the chat surface described on this site. Do not assume Microsoft Teams or other products are generally available.
• Open Tag can be wrong. It shows a plan and cites sources so you can check the work.

Deletion

You can ask us to delete what Open Tag kept — one artifact, everything for a workspace, or the hosted account. Email privacy@opentag.bot. Self-hosted deployments keep retention under your control.

Subprocessors

Infrastructure we use to run the hosted service is listed on Subprocessors. Your model provider is a subprocessor you chose; we do not add one on your behalf.

Report a vulnerability