DOCUMENT OPS
Quarantine Slack file uploads that contain secrets or PII
Inspects every file uploaded to monitored Slack channels for credentials and personal data, deletes and quarantines anything that fails, and warns the uploader privately.
How it runs
The automated pipeline, trigger to output.
- TriggerFile uploaded to monitored Slack channelSlack
- ActionDownload file and extract textSlack
- ActionScan for secrets and PIIOpenAI
- LogicDecide if file violates policy
- ActionQuarantine file to restricted S3 bucketAWS S3
- OutputDelete message and DM uploader privatelySlack
What it does
Listens for file uploads in monitored Slack channels and scans each one for leaked secrets (API keys, tokens, passwords) and PII. Files that fail the policy are removed from the channel and copied to a secure quarantine bucket, while the uploader gets a private heads-up.
When to use it
Use it when engineers or support agents paste logs, screenshots, or config files into Slack and you need to stop credentials and customer data from sitting in channel history. Great for security-conscious teams that treat Slack as a real exposure surface.
How it works
- 1A file_shared event in a watched Slack channel fires the trigger.
- 2The file is downloaded and its text (or OCR-extractable content) is pulled out.
- 3An OpenAI scan flags secrets and PII with categories and confidence.
- 4A logic gate decides whether the file violates policy.
- 5On a violation the original message is deleted and the file copied to an S3 quarantine bucket with restricted access.
- 6The uploader receives an ephemeral Slack DM explaining what was caught and how to rotate or redact.
Set it up
What you configure once, before turning it on.
- 1Connect SlackChannels, DMs, threads, mentions.
- 2Connect OpenAIModels, embeddings, files.
- 3Connect AWS S3Buckets, objects, signed URLs.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Document Ops workflows
Narrate new Dropbox PDFs into MP3 audio versions
When a PDF lands in a watched Dropbox folder, extract its text and generate an ElevenLabs voice narration.
On-demand PDF narration via webhook with emailed audio link
Accepts a PDF URL through a webhook, generates an ElevenLabs narration with the requested voice, stores the MP3, and emails the requester a download link.
Triage emailed contract redlines and route by risk
When a counterparty emails a redlined contract, extracts the attachment, diffs clauses against approved templates.
Batch-narrate a Google Drive PDF folder in multiple languages
On a schedule, finds PDFs in a Google Drive folder that lack audio, then generates ElevenLabs narrations in each configured language and files them into per-language subfolders…
Executed Contract Exhibit & Initials Completeness Gate
When a signed contract lands in a Dropbox intake folder, verify every required exhibit, schedule, and initialed page is present.
Draft a negotiation brief from contract clause deviations
An agent reviews a contract against approved templates, researches each deviation.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.