🩺 Vitals
- ⚪ Last active: 2026-01-05
- 📦 Latest release: No tagged releases yet
- 🐞 Open issues: 173
- 🌟 Stars: 2.5k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: wire.com
- Source: github.com/wireapp/wire
- License: AGPL-3.0 (Server) | GPL-3.0 (Clients)
- Deployment: Docker | Kubernetes | SaaS
- Data Model: PostgreSQL / Redis / Cassandra
- Jurisdiction: Switzerland 🇨🇭 (Wire Swiss GmbH, Zug) / Germany 🇩🇪 (Wire Group Holding GmbH, Berlin)
- Compliance (SaaS): ISO 27001 | GDPR Ready
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - Microservices architecture (Cassandra, PostgreSQL, Redis); Kubernetes required for production scale
- Maintenance: Medium (3/5) - Complex backend; active corporate development cadence
- Enterprise Ready: High (4/5) - MLS end-to-end encryption, SAML SSO and SCIM provisioning ship in the self-hostable AGPL server via the spar service; ID-Shield and federation with Wire Cloud are commercial services, and the managed cloud tiers gate SSO and SCIM behind their paid plans
1. The Executive Summary
What is it? Wire is a secure collaboration platform combining end-to-end encrypted chat, voice, video, and file sharing, developed by Wire Swiss GmbH (Zug, Switzerland). It is built on the Messaging Layer Security (MLS) protocol, providing forward secrecy and post-quantum resistance, and operates on a zero-knowledge architecture where the platform operator cannot access message content. Wire Swiss GmbH and its German parent holding entity are ISO 27001 and ISO 27701 certified. Two things are easy to confuse here. Wire's hosted service is tiered: a free plan up to 5 users, then paid SMB and Enterprise plans that unlock SSO, SCIM, larger video conferences, ID-Shield and federation with Wire Cloud. The server itself is a different matter. wire-server is published under AGPL-3.0 with public Kubernetes and Ansible deployment tooling, and the spar service that provides SAML SSO and SCIM provisioning ships inside it. An organisation running its own instance is not buying those features back.
The Strategic Verdict:
- 🔴 For Teams Without Dedicated DevOps Resources: Caution. The self-hosted Wire stack is a Kubernetes-orchestrated microservices deployment (Cassandra, PostgreSQL, Redis). Teams without infrastructure engineering capacity should use the hosted service. The licence is not the barrier to self-hosting Wire; the operational floor is.
- 🟢 For Government, Defence, and Critical Infrastructure: Strong Buy. Wire's Swiss/German dual jurisdiction, ISO 27001 + ISO 27701 certification, and MLS-based encryption make it the leading European-sovereign alternative to US-domiciled communication platforms. Swiss nFADP and German GDPR enforcement sit entirely outside US CLOUD Act reach.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Microsoft Teams (SaaS) | Wire (Self-Hosted) |
|---|---|---|
| Jurisdiction Risk | US CLOUD Act | Swiss/EU protected |
| Message Access | Vendor-readable | Zero-knowledge (encrypted) |
| Licensing | Per-user monthly fee across M365 tiers | No licence fee for the self-hosted AGPL server; the hosted service is priced per user |
| On-Premises | Not available | Self-hostable from public deployment tooling; a supported on-premises contract is sold separately |
| SSO / SAML | Included (AAD) | Included in the self-hosted server via spar; gated to paid plans on the hosted service |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Architecture: A distributed microservices backend requiring Kubernetes orchestration across Cassandra (message storage), PostgreSQL (metadata), Redis (session management), and the Wire Server application layer. Designed for high availability and horizontal scaling in government-grade deployments. The hosted service abstracts this complexity entirely. Self-hosting is open to anyone under the AGPL, using the published
wire-server-deploytooling, but it demands mature DevOps capability; a supported on-premises engagement with Wire is a separate commercial arrangement, not a precondition for running the software. - Protocol: Wire implements the MLS (Messaging Layer Security) protocol, an IETF standard providing group messaging with forward secrecy, post-compromise security, and a post-quantum resistant key exchange path. Encryption is enforced for all message types including group calls; the platform operator cannot access plaintext communication.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (Switzerland 🇨🇭 / Germany 🇩🇪): Wire Swiss GmbH is incorporated in Zug, Switzerland, with the group holding entity in Berlin, Germany: dual Swiss/EU jurisdiction with no US CLOUD Act exposure. Swiss nFADP and German/EU GDPR create a layered regulatory framework providing substantially stronger data subject protections than US extraterritorial frameworks. For European government and defence organisations, Wire's Swiss/German jurisdiction is a primary procurement differentiator. Communication metadata and message routing are structurally outside US federal access reach.
- The Compliance Shift: ISO 27001 and ISO 27701 (privacy information management system) are verified for Wire's SaaS organisation. GDPR compliance is documented. Self-hosted deployments inherit none of these certifications; physical server security, network perimeter controls, and database encryption are the operator's full responsibility. Wire's MLS encryption ensures infrastructure administrators cannot read message contents, significantly reducing the self-hosted compliance surface. Because the AGPL server can be deployed without a commercial agreement, the compliance burden of a self-hosted instance falls entirely on the operator from day one, with no vendor attestation to lean on unless a support contract is bought alongside it.
- License Risk (Strong Copyleft; Commercial Line Drawn at the Service, Not the Software): The server is AGPL-3.0 and the clients are GPL-3.0, so strong copyleft applies throughout. Standard internal deployment as a communication platform triggers no obligation; modifying the server and offering it over a network does. The commercial line sits at Wire's hosted service and its support contracts rather than inside the codebase: the platform, MLS encryption, SAML SSO and SCIM provisioning are all in the open source server. ID-Shield and federation with Wire Cloud are services Wire sells, and the hosted plans gate SSO and SCIM behind their paid tiers, which is a constraint on Wire's cloud rather than on software you run yourself.
4. Market Landscape
🏢 Proprietary Incumbents
- Microsoft Teams: The dominant enterprise communication platform, deeply integrated with the M365 ecosystem. US CLOUD Act jurisdiction and Microsoft's ability to access message metadata are the primary drivers for European government and regulated organisations migrating to Wire.
- Slack: The leading team messaging SaaS: high usability and an extensive integration ecosystem. US-domiciled, no end-to-end encryption for messages at rest, and no self-hosted path make it structurally incompatible with zero-knowledge communication or EU data residency requirements.
🤝 Open Source Ecosystem
- Mattermost: The leading self-hosted team chat alternative: familiar messaging UX with deep on-premises controls and a strong enterprise governance model. Preferred when the use case is team productivity and DevOps integration rather than Wire's government-grade encryption and Swiss jurisdiction posture.
- Rocket.Chat: Highly configurable open-source messaging platform with a broad feature set including omnichannel customer engagement. The choice when breadth of integration and customisation depth matter more than Wire's security-first, encryption-by-default architecture.