🩺 Vitals
- 🟢 Last active: 2026-10-08
- 📦 Latest release: 12.3 (2026-09-21)
- 🐞 Open issues: 2039
- 🌟 Stars: 26k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: zulip.com
- Source: github.com/zulip/zulip
- License: Apache 2.0
- Deployment: Docker | SaaS (Zulip Cloud)
- Data Model: PostgreSQL / Redis / RabbitMQ / Memcached
- Jurisdiction: USA 🇺🇸 (Kandra Labs, Inc., San Francisco CA)
- Compliance (SaaS): GDPR Ready
- Compliance (Self-Hosted): HIPAA Eligible | FERPA
- Complexity: High (4/5) - App plus four required backing services (PostgreSQL, Redis, RabbitMQ, Memcached); a five-service footprint
- Maintenance: Moderate (3/5) - PostgreSQL backups, auto-applied schema migrations on upgrade, and a running RabbitMQ queue plus Redis/Memcached to operate
- User Management: High (4/5) - Free SAML/OIDC SSO, granular RBAC, and a turnkey admin audit log in the open-source build; SCIM provisioning is free but beta
1. The Executive Summary
What is it? Zulip is an open-source team chat platform developed and maintained by Kandra Labs, Inc. (San Francisco, CA). Its defining architectural choice is topic-based threading: every message belongs to a stream (channel) and a topic, creating a structured conversation model that allows asynchronous participants to follow and contribute to specific discussions without reading everything. SAML, LDAP, Active Directory federation, and granular RBAC are all included in the open-source edition at no cost, with SCIM provisioning available in beta. There is no crippled Community Edition. The enterprise tax is limited to Zulip Cloud scale (message history search is capped on the free SaaS tier) and optional commercial support contracts for self-hosted deployments requiring vendor-backed SLAs.
The Strategic Verdict:
- 🔴 For Regulated Organisations Using Zulip Cloud: Caution. Kandra Labs does not publicly hold SOC 2 Type II or ISO 27001 for the SaaS tier. Healthcare, education, and regulated finance organisations should treat Zulip Cloud as non-compliant infrastructure until Kandra Labs publishes verified audit reports.
- 🟢 For Enterprises Self-Hosting on Compliant Infrastructure: Strong Buy. Apache 2.0 imposes zero licence obligations; SAML and LDAP are included free; and a self-hosted deployment on hardened VPC infrastructure can satisfy HIPAA and FERPA requirements, making Zulip one of the few permissively licensed team chat platforms with a credible regulated-sector deployment path.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Slack (SaaS) | Zulip (Self-Hosted) |
|---|---|---|
| SSO / SAML | Pro tier ($12.50+/user/mo) | $0 (Included) |
| Full Message History | Business+ tier | $0 (Unlimited) |
| Data Residency | Salesforce US-managed cloud | Operator-controlled (VPC) |
| Compliance Posture | Enterprise tier premium | Inherited from your infrastructure |
| Vendor Support SLA | Bundled | Business tier ($6.67/user/mo, optional) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Zulip provides a one-script installer targeting Ubuntu and Debian LTS, the recommended path for single-server deployments. Docker Compose is available for containerised environments. The stack requires four services: PostgreSQL (primary datastore), Redis (caching and rate limiting), RabbitMQ (message queue for background workers), and Memcached (session caching). This is a heavier service footprint than single-binary alternatives, but each component is standard and independently manageable.
- Mobile Push Notifications: The free self-hosted tier limits mobile push notifications to a small number of users via Zulip's hosted push notification relay. Organisations requiring push for larger teams must either pay for the Business support tier or compile a custom mobile app pointing at their own push infrastructure, a non-trivial engineering investment.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Data Sovereignty (USA 🇺🇸): Kandra Labs, Inc. is incorporated in San Francisco, CA: full US CLOUD Act jurisdiction applies to Zulip Cloud. For regulated sectors (healthcare, education, defence), Zulip Cloud should be treated as a non-sovereign infrastructure option. Self-hosted Zulip entirely neutralises this risk: the operator's hosting jurisdiction governs, Kandra Labs holds zero access to message data, and HIPAA Business Associate Agreement and FERPA data governance become feasible depending on infrastructure hardening choices.
- The Compliance Shift: Kandra Labs does not publicly advertise SOC 2 Type II or ISO 27001 certification for Zulip Cloud. The compliance narrative is explicitly oriented toward self-hosting as the enterprise compliance path. Self-hosted deployments on compliant infrastructure can satisfy HIPAA and FERPA requirements; Zulip's audit logging, granular RBAC, LDAP/SAML access controls, and per-topic data retention and deletion tooling provide the operational primitives required by these frameworks. Organisations requiring formal vendor certifications on the SaaS tier should evaluate alternatives until Kandra Labs publishes verified audit reports.
- License Risk (Apache 2.0: Permissive): Apache 2.0 is the most enterprise-friendly major open-source licence: no copyleft obligations, unrestricted commercial use, modification, and integration, with only basic attribution and patent grant requirements. There is no licence trap for internal deployment, SaaS wrapping, or commercial redistribution. The practical operational risk is not licence-related but infrastructure complexity: the four-service stack (PostgreSQL, Redis, RabbitMQ, Memcached) requires DevOps capacity to operate reliably at scale, particularly for high-availability configurations.
4. Market Landscape
🏢 Proprietary Incumbents
- Slack: The category incumbent, with a mature third-party app catalog, Slack AI features, and broad integrations, but SAML/SSO is gated behind the Pro tier, full message history requires the Business+ tier, and all message data resides in Salesforce's US-managed cloud infrastructure.
- Microsoft Teams: The lowest incremental cost option for existing M365 shops: bundled licensing removes the per-user fee, but the flat-channel threading model produces the same context-switching overhead that Zulip's topic structure is designed to solve, and Teams data defaults to Microsoft's US-primary data residency.
🤝 Open Source Ecosystem
- Mattermost: The direct open-source team messaging alternative: broader enterprise integration catalog and a more traditional channel-based UX, but operates an open-core model where several enterprise features (compliance exports, advanced access controls) are paywalled versus Zulip's fully open approach.