1. The request starts where the work does
Nobody opens a compliance tool to ask for a vendor. They ask a colleague, in a channel. The Slack app makes that message the intake: it captures the vendor, the data class and the requester, and opens the review without anyone leaving the conversation.
2. Approvals in the thread
Low-risk, standard-tier vendors can be approved from the thread by anyone holding the approval role, and the decision is written to the audit log with the approver, the timestamp and the tier rule that allowed it.
3. What stays out of Slack
Evidence never posts into a channel. The thread carries the state and the link; the artifacts stay in the vault where access is scoped and logged. A convenient intake is not a reason to widen who can read a penetration test.
4. Setting it up
Install the app, map one channel per business unit, and choose which tiers may be approved in-thread. Everything else escalates to the full review exactly as before.
About Marcus Vance
Marcus runs product at Urengi. He is responsible for the intake, approval and renewal surfaces, and spends most of his time watching security teams use them so the next release removes a step rather than adding one.
