OpenTag
OpenTag is an AI coworker that lives in your team's Slack and runs on whichever model you choose. It has full context on your company, so it answers questions, suggest new automations, and takes real work off your team's plate.OpenTag can make mistakes. Please double-check responses.
OpenTag will be able to view:
OpenTag will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Developer
Open Curiosity, Inc.
Company headquarters location
United States
Terms of service
Privacy & data governance
Data retention policy
OpenTag retains Customer Data in accordance with our Privacy Policy (https://opentag.bot/privacy). Customer Data is retained only while the customer's account is active, so OpenTag can keep its working context and continue the tasks the team has set up. Service records such as billing records and operational logs are retained only as long as needed to operate the service, meet legal and accounting obligations, and enforce agreements.
Data archiving and removal policy
OpenTag removes Customer Data in accordance with our Privacy Policy (https://opentag.bot/privacy). When a customer closes their account or makes a verified deletion request, their environment and its data are deleted from active systems, typically within 30 days, with any residual copies removed on their normal rotation thereafter. When OpenTag is uninstalled from a workspace or its tokens are revoked, the stored bot token and that workspace's routing records are deleted immediately and the connection stops. OpenTag does not maintain long-term archives of Customer Data.
Data storage policy
Customer Data is stored in OpenTag's access-controlled service datastore, hosted on cloud infrastructure in the United States. Each customer's environment is logically isolated so that no other customer can access it, data is encrypted in transit and at rest, and operational access is restricted to what is needed to run and support the service. Slack data is used only to provide and operate OpenTag: it is never sold, never used for advertising, never used to develop, improve, or train generalized AI or machine-learning models, and no Slack message content, tokens, or user identifiers are sent to analytics.
Data hosting details
OpenTag runs on managed cloud infrastructure in Microsoft Azure regions in the United States. Application services and the service datastore run in OpenTag's own Azure subscription, with per-customer logical isolation, encryption in transit and at rest, and access restricted to the operations needed to run and support the service.
Data hosting company
Microsoft Azure
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
Customer-selected LLMs. OpenTag is model agnostic: workspaces choose Anthropic Claude, OpenAI GPT, or Google Gemini. By default, inference runs on GPT-5-series deployments in OpenTag's own Microsoft Azure OpenAI Service subscription.
LLM retention settings
OpenTag's LLM deployments are configured not to retain Customer Data beyond transient processing and never to use it for training, whichever model a workspace selects.
LLM data tenancy policy
OpenTag's default LLM runs in dedicated Azure OpenAI resources in our own subscription. Prompts and completions are not shared with OpenAI, not visible to other Azure customers, and never used for training. Other providers carry the same terms.
LLM data residency policy
OpenTag's default LLM deployments keep data in the United States: our Azure OpenAI resources use US Data Zone deployments. If a workspace selects another model provider, residency follows that provider's configured region, disclosed before it is enabled.
Certifications & compliance
Data deletion request procedure
Deletion requests are handled in accordance with our Privacy Policy (https://opentag.bot/privacy). A customer or their workspace admin can request deletion at any time by emailing privacy@opentag.bot. We verify the request comes from an authorized representative of the workspace, then delete the workspace's environment and its data — including Slack-derived data — from active systems, typically within 30 days, with residual copies removed on normal backup rotation, and confirm completion to the requester.
HIPAA compliant
no
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Supports Single Sign On (SSO) with the following providers
Google OAuth
Supports Security Assertion Markup Language (SAML)
no
Has a dedicated security team
yes
Contact for security issues
security@opentag.bot
Has a vulnerability disclosure program
yes
Vulnerability disclosure program URL
Vulnerability disclosure program covers Slack app
yes
Has a bug bounty program
no
Requires third party authorization/connections
yes
Third party services used by this app
Microsoft Azure (hosting and data storage); Azure OpenAI Service and other customer-selected model providers for LLM inference; Slack APIs. Customers may connect their own tools (e.g. Google Workspace), used only to carry out that customer's requests.
Uses token rotation
no