Contentful Optimization Agent
Mention @ContentfulOptimizationAgent in a channel to ask how your content is performing, where your biggest optimization opportunities are, and how your experiences compare, then get concrete, data-backed recommendations without leaving Slack.Connect your Contentful account once through a private, secure sign-in. Optimization uses your read-only connection and a content scope you choose (space and environment), and it keeps context across a conversation so you can ask natural follow-up questions in a thread.Colleagues can also ask questions on your behalf. Your Contentful credentials are always encrypted and are never shared with other participants.
Contentful Optimization Agent will be able to view:
Contentful Optimization Agent will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Developer
Contentful GmbH
Company headquarters location
Germany
Privacy & data governance
Data retention policy
Contentful retains data from the Optimization Agent Slack app in accordance with the retention periods below, which differ by store:
- Connection records (Slack workspace and user identifiers, the Contentful user's name and email, encrypted access token, and selected space/environment): retained until the user disconnects the integration or the token is revoked.
- Conversation state (thread identifiers, participants, access grants, per-question progress): retained for 30 days from last activity, then deleted. The text of a question is held only while that question is being answered and is discarded on completion.
- Agent conversation transcripts (the full question and answer for each exchange, retained so the assistant can answer follow-up questions in the same thread): currently retained indefinitely. No automatic expiry is applied, and transcripts are not deleted when the associated Slack conversation expires. A deletion capability exists and can be invoked per session; automatic expiry is planned but not yet implemented.
- Slack message content: questions and answers also remain in the customer's own Slack workspace, governed by that workspace's retention policy. Contentful does not control this copy.
- OpenAI: API data may be retained by OpenAI for abuse monitoring for up to 30 days. Contentful configures its request metadata handling to remain within that window.
Data archiving and removal policy
Contentful removes data from the Optimization Agent Slack app as follows:
- On user disconnect: the connection record, including the encrypted access token and the stored name and email, is deleted immediately.
- On conversation expiry (30 days idle): conversation state is deleted automatically. Note: the agent transcript for that conversation is not currently removed by this process.
- On request: individual agent transcripts can be deleted per session via an existing administrative capability.
- Sign-in handshake records: currently marked consumed and excluded from use, but not deleted; no automated cleanup is in place. These contain workspace and user identifiers and an encrypted callback URL, and no customer content.
- Slack-resident content: Contentful cannot delete messages from the customer's Slack workspace. - Deletion of questions and answers held in Slack must be performed by the customer under their own Slack retention controls.
Data storage policy
Data is stored on Cloudflare's platform, encrypted in transit and at rest by the platform. Contentful OAuth access tokens receive an additional layer of application-level encryption and are cryptographically bound to the specific Slack workspace and user they belong to, so a token record cannot be decrypted under a different identity. Tokens are decrypted in memory only for the duration of a single request and are never written back in plaintext, never logged, and never transmitted to Slack.
Each request is scoped to a single Contentful space and environment. The delegated access token issued for a request carries no organization-level claim and therefore cannot assert access beyond the space it was issued for. Every answer is produced using the requesting user's own Contentful permissions; the app holds no standing data access of its own.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
gpt-5.4, gpt-5-mini
LLM retention settings
Contentful’s OpenAI processing agreement provides 30-day retention with automatic deletion.
LLM data tenancy policy
Data is organization-scoped and not shared with other Contentful customers. Prompts and outputs remain private to the customer environment.
LLM data residency policy
For the Contentful-managed OpenAI integration, OpenAI LLC is listed as a subprocessor with a United States hosting location. Therefore, Contentful EU data residency does not imply that prompts sent to OpenAI remain in the EU.
Certifications & compliance
Data deletion request procedure
HIPAA compliant
no
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Supports Single Sign On (SSO) with the following providers
Commonly integrated IdPs: Okta, Microsoft Entra ID, OneLogin, Ping Identity, Auth0, and Google Workspace (G Suite); and ny standards-compliant SAML 2.0 provider.
Supports Security Assertion Markup Language (SAML)
yes
Has a dedicated security team
yes
Contact for security issues
security@contentful.com
Has a vulnerability disclosure program
yes
Vulnerability disclosure program URL
Vulnerability disclosure program covers Slack app
yes
Has a bug bounty program
yes
Bug bounty program URL
Requires third party authorization/connections
yes
Uses token rotation
yes