DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-04
- 📦 Latest release: v12.0.1 (2026-10-22)
- 🐞 Open issues: 1100
- 🌟 Stars: 39.5k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: mattermost.com
- Source: github.com/mattermost/mattermost
- License: AGPL-3.0-only (core; paid edition under its own terms)
- Deployment: Docker Container | Kubernetes (K8s) | Native System (Binary/Linux)
- Jurisdiction: United States 🇺🇸 (Mattermost, Inc.)
- Compliance (SaaS): Mattermost Cloud Enterprise security and compliance page
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (2/5) - One server binary and a PostgreSQL database; an NGINX proxy is optional
- Maintenance: Moderate (3/5) - A release every month, with security fixes backported to the last three; major releases bring database migrations and raise the minimum PostgreSQL version
- User Management: Moderate (3/5) - Email and password accounts, system, team and channel admin roles with editable permissions, and TLS in the server in the free build; single sign-on and the audit log come with a paid edition
What the scores mean: Reading the Scores
1. The Executive Summary
What is it? Mattermost is a team chat server for messaging in channels and threads, running as one Linux binary with PostgreSQL. The vendor intends the free build for small teams that need no single sign-on, does not recommend it for government or sensitive commercial workloads, and stops it adding users past a fixed limit. It does not encrypt data inside the database: encryption at rest is the operator's own disk or database encryption. A paid edition adds high-availability clustering, enterprise search and compliance export.
The Strategic Verdict:
- 🔴 For organisations that need single sign-on or will grow beyond a small team: Caution. Single sign-on comes only with a paid edition, and the free build stops adding users past a fixed limit (User Management, What is it?).
- 🟢 For small technical teams leaving Slack: Strong Buy. An importer brings over users, channels and message history, and the server is one binary with PostgreSQL (Cost of Ownership, Complexity).
2. Cost of Ownership
| Cost Component | Mattermost (Self-Hosted) |
|---|---|
| Pricing Model | No license fee under AGPL-3.0-only; paid license for other terms; paid edition for some features |
| Adoption | Importer for Slack (users, channels, message history, threads) |
| Operations | Single small VM, grows with active users; plus your team's time to run it (Maintenance, in the Profile) |
| Support | From the vendor: Mattermost Cloud Enterprise, a managed service, and paid support for self-hosted installs (enterprise support); elsewhere, a paid service provider |
| Exit | Bulk export (JSONL, mmctl); leaves out deleted messages, and archived channels unless asked |
What each row covers: Total Cost of Ownership
3. Risk Assessment
- Jurisdiction: Mattermost, Inc., the project's vendor, is registered in the United States, under US law. The vendor runs Mattermost Cloud Enterprise, a hosted service where your data can live; its hosts include a party domiciled in or controlled from the US. Data in Mattermost Cloud Enterprise is within reach of the US CLOUD Act wherever it is stored, since its operator is based in the US. A self-hosted install sends usage data to the vendor unless the operator switches it off. US law can compel the recipient to hand over that usage data.
- The Compliance Shift: A new install sends mobile push notifications, message text included, through the vendor's test push service until the operator changes that setting. Self-hosting moves the security and compliance duties of running the software to the operator (the operator's compliance checklist). Any audit of Mattermost Cloud Enterprise (such as SOC 2 or ISO 27001) covers the vendor's own systems, never your install.
- License Risk: Mattermost is under AGPL-3.0-only, an OSI-approved network copyleft license (what it allows and requires). The vendor holds the rights to relicense contributed code through a contributor agreement, so future versions can move to other terms without contributors' consent. Mattermost's own compiled builds are licensed under MIT; the AGPL binds builds made from the source.
4. Market Landscape
🏢 Proprietary Incumbents
- Slack: Slack is a cloud service for team messaging in channels.
Data held by: Slack Technologies, LLC, United States 🇺🇸 (controlled by Salesforce, Inc.), subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: By default it trains global predictive models on customers' messages and files; opting out takes an email.
Exit: Workspace export (JSON in a ZIP), partial export (files as links, private conversations only on higher plans, on application) - Microsoft Teams: Microsoft Teams is a cloud service for chat, calls and online meetings at work.
Data held by: Microsoft Corporation, United States 🇺🇸, subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: Encryption with its customers' own keys needs a top Microsoft plan or a paid add-on.
Exit: Teams Export APIs (Microsoft Graph)
🤝 Open-Source Alternatives
- Rocket.Chat: Open-core team chat platform for conversations with colleagues, partners and customers, with end-to-end encryption for private rooms, under MIT.
- Element: Open-core team chat and calling server on the Matrix protocol, with encrypted private rooms and federation, under AGPL-3.0-or-later.