Employees keep pasting secrets and customer data into Slack, how are you handling this from a compliance angle?
Small company, limited security resources. People still paste API keys, customer emails, and passwords straight into Slack channels. We have basic acceptable-use language, but it is clearly not enough.
I do not want to start reading DMs or turn this into heavy surveillance. At the same time, this is a real data-handling and access-control problem, especially if we ever need to show that sensitive information is not sitting unprotected in chat.
For those in compliance or risk roles: how are you addressing secrets and PII in collaboration tools without creating a process nobody follows? What controls or workflows have actually reduced this in practice?