Our Security Architecture & Practices Encryption in transit Encryption at rest Network and security hardening System monitoring Annual penetration testing Manual and automated source code reviews Regular security updates delivered to the community p rior to public disclosure Continual Commitment to the principles of GDPR and C CPA CVE Numbering Authority (CNA) Bug bounty program and Responsible Disclosure Po licy Meet the Strictest Security, Privacy, and Compliance Requirements Mattermost is the only solution that offers self-hosted and secure cloud deployment options. You always have complete control over your data, so you can meet the most demanding security, privacy, and compliance requirements — even the ability to deploy in an air-gapped environment. Mattermost is easily customized to meet your specific compliance requirements with fine-grained data retention, audit logs, and the ability to programmatically archive and export records. We provide full access controls and give teams the ability to set granular permissions to control access to sensitive data. Self-hosted Deployment & Database Ownership Retain full control over your company’s sensitive data with no third-party monitoring. Get a secure, on-premises installation in your data center with layered security options ( SSL, VPN and DMZ) You own the database (MySQL or PostgreSQL) and manage all internal controls Keep integration connections completely private for tools like Jenkins, Git, and Zoom Host on the secure cloud of your choice such as Azure or AWS – no need to send Active D irectory data over a public network Advanced Mobile Security Our mobile apps work with EMM solutions. Full source code is available for custom solutions. Built-in Identity & Access Controls Define granular controls for enterprise data archiving to keep data properly secured and accessed. Multi-factor authentication (MFA) Session duration configuration User and group provisioning via Active Directory and LDAP SAML-based single sign-on (SSO) Certificate-based authentication (CBA) Enterprise mobile management (EMM) Block message copy and file download Minimum app version Information Governance & Compliance Pull compliance reports on user conversations and behaviors. Audit logging enables oversight and protection of ethical boundaries. Global retention policies Compliance exports Role-based access control with custom permissions Custom terms of service (TOS) Block message contents from appearing in mobile application notifications