> ## Documentation Index > Fetch the complete documentation index at: https://docs.getthread.com/llms.txt > Use this file to discover all available pages before exploring further. # How Thread handles your data > For the security owner: Thread's data-handling facts — encryption, Magic AI privacy, sub-processors, IP allowlisting, and Teams and Slack app permissions. export const MarkComplete = ({id, signalDone = false}) => { const KEY = "thread-onboarding-completed"; const read = () => { try { return JSON.parse(localStorage.getItem(KEY) || "[]"); } catch (e) { return []; } }; const [localDone, setLocalDone] = useState(false); const done = signalDone || localDone; useEffect(() => { const sync = () => setLocalDone(read().includes(id)); sync(); window.addEventListener("thread-onboarding-updated", sync); return () => window.removeEventListener("thread-onboarding-updated", sync); }, [id]); const toggle = () => { if (signalDone) return; const list = read(); const next = list.includes(id) ? list.filter(x => x !== id) : [...list, id]; try { localStorage.setItem(KEY, JSON.stringify(next)); } catch (e) {} setLocalDone(next.includes(id)); window.dispatchEvent(new Event("thread-onboarding-updated")); }; return ; }; export const ByRoleProgress = () => { useEffect(() => { const KEY = "thread-onboarding-completed"; const TEAL = "#00B398"; const BASE = "/start-here/roles/"; const DONE_ICON = ''; const COURSES = [{ slug: "technician", steps: ["why-thread", "get-around-inbox", "day-one-setup", "daily-workflows", "ai-toolkit", "notifications-and-customers"] }, { slug: "dispatcher", steps: ["why-dispatch-in-thread", "read-the-board", "assign-and-schedule", "ai-for-dispatch"] }, { slug: "service-ops-manager", steps: ["set-up-the-desk", "sla-and-dispatch", "analytics-and-qa", "roll-out-and-adopt"] }, { slug: "csm-account-manager", steps: ["client-intelligence-and-health", "qbrs-and-reporting", "retention-and-expansion"] }, { slug: "security-compliance-owner", steps: ["security-work-in-thread", "data-and-compliance", "security-runbooks"] }, { slug: "sales-business-development", steps: ["the-ai-service-pitch", "quote-and-handoff"] }, { slug: "msp-owner-leadership", steps: ["the-rollout", "outcomes-and-analytics", "scale-ai-service"] }, { slug: "automation-engineer", steps: ["flows-and-intents", "thread-mcp-and-api", "build-with-super-magic"] }]; const COURSE_SLUGS = new Set(COURSES.map(c => c.slug)); const readLocal = () => { try { return JSON.parse(localStorage.getItem(KEY) || "[]"); } catch (e) { return []; } }; const isDone = (done, id) => done.includes(id); const decorate = () => { const done = readLocal(); const scope = document.getElementById("sidebar-content") || document; const links = [...scope.querySelectorAll('a[href*="' + BASE + '"]')].filter(a => !a.closest("main")); links.forEach(a => { const m = (a.getAttribute("href") || "").match(/\/start-here\/roles\/([^/?#]+)\/([^/?#]+)/); if (!m) return; if (!COURSE_SLUGS.has(m[1])) return; const id = m[1] + "/" + m[2]; const d = isDone(done, id); const has = a.querySelector(".thread-rc-check"); if (d && !has) { const s = document.createElement("span"); s.className = "thread-rc-check"; s.textContent = "✓ "; s.style.color = TEAL; s.style.fontWeight = "700"; a.insertBefore(s, a.firstChild); } else if (!d && has) { has.remove(); } }); COURSES.forEach(course => { const li = scope.querySelector('li[id="' + BASE + course.slug + '"]'); if (!li) return; const row = li.querySelector(":scope > button") || li.querySelector(":scope > a") || li.firstElementChild; if (!row) return; const nameSpan = [...row.querySelectorAll("span")].find(s => s.textContent.trim() && !s.classList.contains("thread-rc-coursecheck")); if (!nameSpan) return; const allDone = course.steps.length > 0 && course.steps.every(s => isDone(done, course.slug + "/" + s)); const has = nameSpan.querySelector(".thread-rc-coursecheck"); if (allDone && !has) { const s = document.createElement("span"); s.className = "thread-rc-coursecheck"; s.setAttribute("aria-hidden", "true"); s.style.display = "inline-flex"; s.style.alignItems = "center"; s.style.verticalAlign = "-0.2em"; s.style.marginRight = "0.35em"; s.innerHTML = DONE_ICON; nameSpan.insertBefore(s, nameSpan.firstChild); } else if (!allDone && has) { has.remove(); } }); }; decorate(); const iv = setInterval(decorate, 600); window.addEventListener("thread-onboarding-updated", decorate); window.addEventListener("storage", decorate); return () => { clearInterval(iv); window.removeEventListener("thread-onboarding-updated", decorate); window.removeEventListener("storage", decorate); }; }, []); return null; }; When a client's security team or an auditor asks how Thread handles data, you need specifics, not reassurance. This lesson is the map to the pages that answer those questions precisely — what's stored, how it's encrypted, what Magic AI sends and where, who the sub-processors are, and exactly what the Teams and Slack apps can touch. Cite these directly; don't paraphrase from memory. Keep claims tight. Reference the facts on these pages as written, and confirm anything about Thread's own certifications or attestations with your Thread account team before you put it in a questionnaire. The pages below cover data handling and permissions — they are not a certification list. ## Encryption and what's stored [Data & encryption](/security-billing/data-encryption) is the baseline answer to "how is our data protected?" * **At rest:** Thread is hosted on AWS; instances, databases, and their storage volumes are encrypted. * **In transit:** Thread talks to your PSA, Slack, and Microsoft APIs over HTTPS only. * **Data minimization:** Thread stores only what it needs to keep the PSA and chat connected — API keys, boards and statuses, companies and contacts, tickets, and channel/user identifiers. The page spells out what is deliberately *not* stored, including financial information. That last point is the one clients probe hardest, so send them the page rather than summarizing it — the "what we do not store" list is the reassuring part, and it's more credible in Thread's own words. ## Magic AI privacy and security AI is where security reviews now spend most of their time, so know this cold. [Magic AI privacy & security](/security-billing/magic-ai-privacy-security) documents how the AI features handle data: * Magic AI runs on an **isolated Azure OpenAI Service instance** — separated from every other customer, with content filtering on inputs and outputs. * **No partner or customer data is stored in Azure, and none of it is used to train or improve the models** — not by Microsoft, not by Thread. Prompt data exists only in memory for the duration of the call. * The data sent for a prompt is a **short, fixed list**: contact first/last name, contact type, the date the action ran, and the issue's summary, initial description, and conversation transcript. When a security questionnaire asks "what data leaves our environment for AI processing?", the fixed field list on that page *is* your answer. Quote it — a specific, bounded list lands far better than "only what's necessary." ## Sub-processors For a DDQ or vendor review, [Thread sub-processors list](/security-billing/list-of-sub-processors) is the page to point to. It names each sub-processor and its purpose — AWS and Microsoft Azure for hosting and AI, plus the payment, CRM, analytics, and operations providers. Link it directly so the client is always reading the current list rather than a copy that goes stale. ## Network allowlisting Clients with locked-down networks need Thread's addresses before anything will connect. [Thread IP addresses and domains to allowlist](/security-billing/what-if-my-organization-has-ip-restrictions) has both halves: * **Outgoing IPs** — the addresses Thread connects *from* when it calls a client's PSA. Allowlist these on their side. * **Incoming domains** — the domains Inbox and Messenger (including websocket connections) need reachable for clients running the apps. Hand this page to the network team verbatim; the websocket note in particular is easy to miss and a common cause of "Messenger won't connect." ## App permissions — Teams and Slack When a client asks "what can the Thread app actually see and do?", the permission references answer scope by scope. | Platform | Reference | What it covers | | ------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Microsoft Teams** | [Microsoft Teams app permissions](/security-billing/microsoft-teams-app-permissions) | The single Entra ID enterprise app, one-time admin consent, and the delegated vs. application Graph permissions behind the Service and Companion apps. | | **Slack** | [Slack app permissions guide](/security-billing/slack-permissions-guide) | The Slack OAuth scopes Thread requests, why each user and bot scope is needed, and the data Thread deliberately does *not* access or retain. | Both pages frame permissions as least-privilege and scoped to ticket work — Thread doesn't use them for workspace-wide monitoring or analytics. That's usually the exact concern a security reviewer is trying to rule out, so lead with it. ## Next You know the data story. Now put the operational bench to work — the runbooks that turn all of this into daily response and audit prep. The Skill Library security and audit bench — incident response, identity, alerts, and evidence. ## Related topics - [How security work flows through Thread](/start-here/roles/security-compliance-owner/security-work-in-thread.md) - [Security & Compliance Owner](/start-here/roles/security-compliance-owner.md) - [Claude on AWS Bedrock](/security-billing/claude-on-aws-bedrock.md)