Sally Security Concerns - PSA
Although I don’t agree that this should be an “Idea”, I was told to come over here by Support. I expect to hear from Gainsight security team about this.
Given Gainsight Sally can be added to any Slack channel, we did some testing with our Slack Connect channel with Myranda, our Enterprise Support Analyst at Gainsight. We added Gainsight Sally to our channel, triggered a simple C360 Summary query, and asked whether Myranda can see the information - she can.
All of it.
In fact, she can see the other prompts but upon attempting to interact with it, she is thrown with an error as she is not a provisioned user. It even cleared out the original output when she interacted with a query with no threaded further information.
It seems that no matter what I query, Myranda as an external user to Slack, can see the information.
We need to be able to secure who can add Sally to which channel, as we have plenty of customer channels that users (CSMs) could easily provide extremely sensitive information to.
Should this be a reason for us to back out on Sally altogether, when we are planning to launch this to all employees in a month? The hype that we have created for Gainsight with Sally could easily kill our ability to use Gainsight altogether because of this massive security issue.