As far as usability and all that I really like Hipchat. I haven't gotten the chance to use Slack, but I've got no complaints on the Hipchat application itself. My current megacorp employer uses it as part of a big contract with Atlassian, but ours is hosted internally. I don't know the intimate details of self-hosting, but I assume that mitigates most of the security concerns.
Slack does the same thing... files are uploaded to S3 as well. Slack isn't a panacea when it comes to security.
Being uploaded to S3 isn't the problem; it's public access to the S3 URL that's the issue. You can't publicly access an uploaded Slack S3 file.
Hipchat offers a self-hosted option, which is a requirement for many companies that very specifically don't want their chat logs and files living in some s3 bucket.