Data access controls how much of your organization’s data an app can read or modify. It is separate from app installation, so an app can be installed in a team but still be restricted from accessing data outside that team. Use the Data access tab under Apps in Company settings to view and configure access for each app. By default, apps are assigned the most restrictive configuration, with access limited to installed teams only and cross-organization access disabled. This feature is available to Enterprise plans.
Understand how access works
Data access defines the maximum scope an app is allowed to operate in.
Access depends on two factors:
- The app’s configured data scope.
- The permissions of the user authorizing the action.
This means:
- An app cannot access data outside its configured scope.
- An app cannot access data the user does not have permission to access.
When an app is installed in multiple teams, access is evaluated per installation. For example, if an app is installed in Team A and Team B, it can access data in each team independently based on where it is installed.
If the data scope is expanded to include all teams, the app can access data across all teams in the organization, regardless of where it is installed.
Cross-organization access is restricted by default. Apps installed in other organizations cannot access your data unless this setting is explicitly enabled. If enabled, apps from other organizations can access your data within the configured data scope and based on the user’s permissions.
Data access settings are enforced on every request made by an app, ensuring access control is consistent and auditable.
Organization-level data, such as users and groups, is controlled by the app’s API scopes and is not affected by data access settings.
Existing apps
To avoid disrupting existing workflows, data access settings are automatically applied to apps installed before this feature.
Apps that already have cross-team or cross-organization access retain their existing configuration. All other apps are assigned the default restricted setting.
This migration is applied automatically and does not interrupt existing integrations.
Configure data access
Go to Company settings > Apps > Data access.
Apps appear in this list when they are installed in your organization and are automatically added with the default restricted configuration. You can also add an app directly to configure its data access without installing it in any team. This allows the app to access your organization’s data based on its configuration, even if it is not installed, for example, when testing a development app from another organization.
Each app has two settings that define its access: data scope and cross-organization access. See the sections below for details.
Set data scope
The data scope determines which teams’ data the app can access.
- Only teams where the app is installed (default).
Limits access to data from teams where the app is installed. For example, an app installed in Team A can access data in Team A, while the same app installed in Team B can access data in Team B. - All teams in organization.
Allows access to data across all teams. For example, an app installed in Team A can also access data in other teams in the organization.
Data scope defines the maximum level of access and does not grant access to all data within that boundary. The app can only access data that the user authorizing the action has permission to use.
Allow cross-organization access
This setting controls whether apps from other organizations can access your data.
- Disabled (default).
Apps installed in other organizations cannot access your data, even if a user has access to both organizations. - Enabled.
Apps from other organizations can access your data within the configured data scope and based on the user’s permissions.