Gate one
Nothing to forget
Every query runs through a client that already knows which company is asking. Ordinary code cannot leave the filter out, because it never writes one.
Channels, direct messages, calls and search — with every company’s data held apart at the database itself, not just in the code that queries it.
Free to start · No card required · Live in about a minute
Built for teams who keep things to themselves
Most multi-tenant products keep companies apart with a WHERE clause and good intentions. One forgotten filter is all it takes. Here the boundary is enforced twice — once in the data layer, and again by the database itself.
Gate one
Every query runs through a client that already knows which company is asking. Ordinary code cannot leave the filter out, because it never writes one.
Gate two
Row-level security applies to every statement, including the ad-hoc query written at 2am that never went near the data layer. It holds whatever the code does.
Proven, not promised
A dedicated suite tries to read across the boundary from every angle — raw SQL, search, sockets — and blocks the build if any of it succeeds.
Familiar where it should be, and careful where it counts.
Public rooms anyone can join, private ones that never appear to people outside them, and threads that keep the main view readable.
Private to the people in them. No role opens a conversation it is not part of — not Admin, not even the workspace Owner.
Calls start from any channel or conversation, and a call in a private channel is exactly as private as the channel. Media is carried in the EU and never recorded.
Results only ever come from rooms you can already read, because search runs inside the same boundary as everything else.
Typing indicators, unread counts and mention badges. DMs show when they have been read; channels do not publish who read what.
Role changes, deletions and oversight reads are appended to a log the application cannot rewrite.
Recaps, file summaries and a personal assistant that only ever use what you can already open. They write text for you; they cannot post or change anything.
Invite a client or partner into the channels you choose. They see those channels and nothing else: no member list, no public rooms, no direct messages.
Single sign-on and automatic user provisioning, rules that stop card numbers and secret keys from being shared, sign-in and device controls, and set retention periods.
Ready-made apps for GitHub, GitLab, Jira, Sentry and Linear, and a connector for any tool that can send a webhook.
Work with a client or partner in a channel both companies can see. Each keeps its own copy and its own control of who can read it, and either side can stop at any time.
Free is for a small team getting going. Paid plans add unlimited history, AI features, guests, workflows and, higher up, single sign-on and data-loss prevention.
| Feature | Free | Pro | Business+ | Enterprise+ |
|---|---|---|---|---|
| Price | €0 | €7.84 per user a month | €17.10 per user a month | €42.75 per user a month |
| Message history | 90 days | Unlimited | Unlimited | Unlimited |
| Channels, threads and direct messages | ✓ | ✓ | ✓ | ✓ |
| Search across messages and canvases | ✓ | ✓ | ✓ | ✓ |
| Canvases and lists | ✓ | ✓ | ✓ | ✓ |
| File uploads up to | 25 MB | 2 GB | 5 GB | 5 GB |
| File storage | 5 GB | 100 GB | 1024 GB | Unlimited |
| Guests from outside your company | — | ✓ | ✓ | ✓ |
| Apps (incoming webhooks) | Up to 10 | Unlimited | Unlimited | Unlimited |
| Workflows | — | ✓ | ✓ | ✓ |
| AI recaps, summaries and search | — | ✓ | ✓ | ✓ |
| Personal AI assistant | — | — | ✓ | ✓ |
| Single sign-on (SAML) | — | — | ✓ one provider | ✓ several providers |
| User provisioning (SCIM) | — | — | ✓ | ✓ |
| Data-loss prevention rules | — | — | — | ✓ |
| Enterprise search (files and lists) | — | — | — | ✓ |
Paid plans are charged per user per month, before tax. Guests are free. Free includes one-to-one calls; group calls and screen share are on every paid plan.