I would assume that for any reasonably large business, with a competant legal team, there is a certain amount of this considered to be an acceptable risk.

Employees discussing shit on your systems? You’re (most likely) legally responsible for it if things come to a court room. Employees discussing shit through their own side channels? You’ve got plausible deniability of awareness and a strong legal argument for it being outside of your responsibilty due to having no control of it.

This is literally a strategy for some shady and unscrupulous companies to attempt to avoid liability. Conduct any questionable communication over official “unofficial” third party channels.