What data does Chronicle store?

Here's an overview of the data Chronicle stores and how each type is used.

Team and User Data

When you authenticate the app through Slack, we fetch and store your Team and User data. This includes the authentication tokens used to query Slack's API, along with the team name, logo, and URL. User data is stored to calculate the number of users for billing purposes and to populate event data (more on that below).

Channel Data

To properly scan channels for inactivity, we store the channel ID and the information returned by Slack's channels.list endpoint. This does not include message content.

File Data

To power file monitoring, we store the following fields for files shared within Slack:

• fileId
• name
• title
• user
• isExternal
• isPublic

Message and Event Data

Whenever a match is detected for any event you've configured for monitoring, we store a record of the event — but we do not store the full matched message. Message-level events use this template:

• "Found <LINK_TO_MESSAGE> containing 'TARGET_TEXT' with the '<LINK_TO_RULE>' rule."

For example, if you created a monitor to alert you when the text "coffee mug" is shared, we would store something like:

• "Found <https://your-slack-subdomain.slack.com/archives/CHANNEL_ID/MESSAGE_ID|message> containing 'coffee mug' with the '<https://www.chronicle-app.com/dashboard/messages|Coffee> rule."

The template varies slightly for other monitor types, such as file, emoji, user, and guest monitors. In these cases, the only additional data saved is the username and ID of the Slack user performing the action:

• "<LINK_TO_SLACK_CHANNEL> was archived by <LINK_TO_SLACK_USER>."