Security Overview

Security in Mattermost software is continually reviewed by developers, IT administrators and security researchers accountable for deploying the software in their organizations.

Multiple rounds of penetration testing and security analysis, in addition to internal reviews, have produced a long list of safeguards, processes and policies. Please see:

To expand on each:

Security Features

Mattermost offers a host of features to help keep your private cloud communications secure.

Private Cloud Deployment with Secure Mobile Apps

Centralized Security and Administration

Transmission Security

  • Mattermost supports TLS encryption using AES-256 with 2048-bit RSA on all data transmissions across both LAN and internet.
  • Connections to Active Directory/LDAP can be optionally secured with TLS or stunnel (E10).
  • Encryption-at-rest is available through hardware and software disk encryption solutions applied to the Mattermost database, which can reside on its own server within your infrastructure.
  • Option to exclude message contents from push notifications to comply with strict compliance policies, such as US HIPAA standards.
  • Ability to exclude or include the contents of messages in push notifications to avoid disclosure on locked mobile screens, and via relay servers from Apple and Google when sending notifications to iOS or Android mobile apps (relevant to compliance standards such as HIPAA)

Integrity & Audit Controls

  • By default, Mattermost stores a complete history of messages, including edits and deletes, along with all files uploaded. User interface actions for “deleting” messages, channels and private groups only remove the data from the user interface, the data is retained within your database.
  • The output and archives of server logs can be saved to a directory of your choice. Mattermost server logs plus logs from your web proxy can provide an end-to-end history of system usage.
  • Ad hoc compliance reports of messaging by user, date range, and keyword, including edited and deleted messages are available (E20). To protect against unauthorized use, all ad hoc report requests are logged.
  • Daily compliance reports compatible with 3rd compliance solutions such as Global Relay are also available (E20).

Authentication Safeguards

Access Control Policy

Security Updates

Security updates address newly discovered attacks reported to Mattermost, Inc. by the security research community. Disclosures are made confidentially, under the Mattermost responsible disclosure policy, allowing for Mattermost, Inc. to provide security updates to the community prior to public disclosure.

For more information, please see:

Security Policies

For information on internal security policies, development guidelines, business continuity plans and common security-related questions from enterprises, please see our Security Policies documentation.

HIPAA compliance

Deploying Mattermost as part of a HIPAA-compliant IT infrastructure requires a deployment team trained on HIPAA-compliance requirements and standards.

  • Mattermost offers HIPAA-relevant Technincal Safeguards including:

  • HIPAA-compliant deployments commonly consider the following:

    • Omitting the contents of messages from mobile push notifications:

      • If your Push Notifications Contents option is set to Send full message snippet there is a chance Personal Health Information (PHI) contained in messages could be displayed on a user’s locked phone as a notification. To avoid this, set the option to Send generic description with user and channel names.

  • Beyond Technical Safeguards, HIPAA compliance deployments also require:

    • Administrative Safeguards
    • Physical Safeguards
    • Organizational requirements and other standards.

To learn more, please review HIPAA requirements from the US Department of Health and Human Services.