Element vs Mattermost

Element

Threads, reactions, polls, attachments and 'Unlimited data history' are on the record with no stated exclusion — but search, the thing that finds a decision made eighteen months ago, appears nowhere on the captured pages, nor do mentions, edit history, pins or a human-readable export of a conversation. I score what is written, not what Matrix is rumoured to do, and search is not written.

Mattermost

Channels, real threads and a documented thread API are evidenced, and at least the search cap is printed rather than hidden: core search up to three million posts on Professional, enterprise search beyond three million on Enterprise. I found no public information on pinned or saved items, mentions and reactions, or search filters by channel, person and date, and the thread-move endpoint is flagged as beta. Default behaviour retains every message including edits and deletes plus all files, so the history itself appears uncapped.

Element

The sentence I hunt for exists in the open: 'The entire platform is end-to-end encrypted by default' with non-encrypted rooms as the named exception, not the rule, plus cross-signed device verification by QR or emoji and the vendor stating E2EE content 'is never accessed by our teams or shared externally'. Docked one because documented key handling and admin-revocable sessions are absent from the captured text, even with OIDC SSO present.

Mattermost

The sentence I hunt for exists here: the database holds messages unencrypted specifically so search and compliance reporting of history work, which means TLS in transit and disk-level encryption at rest — no end-to-end encryption claim appears on the captured pages. Single sign-on and multifactor authentication sit on Professional, granular role-based and attribute-based controls on Enterprise, so the tier map is visible. I found no public information on device verification or session management an administrator can revoke.

Element

Rules-based retention for messages and media, a documented 7-day window to permanent deletion including all media, in-room auditing framed for regulation and no profiling of homeserver users — but legal hold, eDiscovery export a lawyer could use, and an audit trail of administrative actions are all missing from the evidence. 'Easily migrate your data' is an exit story, not a discovery format.

Mattermost

The discovery machinery is unusually concrete: compliance exports in CSV, Actiance XML, Global Relay EML and Proofpoint formats, edits and deletions tracked by message ID, channel member history included, past history exportable by command line, and every query and download logged in an audit history — with Playbooks and Boards explicitly excluded, which I respect being told. Legal hold and data retention policy appear as feature names on Enterprise without documented mechanism, and the audit trail I can see covers compliance queries rather than all administrative actions. I found no public information on activity analytics being switchable off organisation-wide.

Element

Custody is genuinely the customer's: AGPL server, official helm charts on Kubernetes, air-gapped and mesh deployment, vendor-agnostic federation on an open standard, and export framed against lock-in. One asterisk in the vendor's own words — the free Community homeserver is 'not for use in production environments' — so first-class production self-hosting is the paid suite, which is why this is not a 10.

Mattermost

Self-hosting is documented as a first-class path: Kubernetes, Linux and container methods install the same server, an air-gapped runbook with registry mirroring is published, FIPS-compliant STIG-hardened images exist, and the privacy policy states the customer controls processing of end-user data on self-hosted products. Federation via Matrix protocol interoperability is listed at Enterprise tier. The captured pages do not state a licence or source-availability model for the server, so I score the deployment paths rather than assume an open-source core.

Element

Named widgets — NeoBoard, OpenProject, Jira — plus SCIM and LDAP identity integration and an Integrations section on the site, but the captured pages are entirely silent on any API, webhook, bot framework, rate limits or sandbox.

Mattermost

A versioned REST API with bearer authentication, incoming and outgoing webhooks with Slack-compatible payloads, interactive dialogs and structured interactive blocks, plus single sign-on — a solid middle of this scale. I found no public information on slash commands, SCIM provisioning, documented rate limits, an app directory or a sandbox. Bot posts are acknowledged in compliance export contents, but no bot account model is documented on the captured pages.

Element

EU hosting is evidenced — AWS Amsterdam and Stockholm with customer region choice — and the subprocessor list is published and specific (Cloudflare, Twilio, LiveKit, MapTiler, a US marketing stack), but the contracting entity is Element Creations Ltd of London with a US subsidiary, so the chain is UK/EU rather than European end to end. The air-gapped, self-hostable deployment is what actually removes the question, and it is the strongest thing keeping this above the midline.

Mattermost

The contracting entity is Mattermost, Inc. in the United States, transfers to the USA are disclosed, and reliance is on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses; the captured pages give no hosting location and no published subprocessor list for the vendor-managed cloud, while Azure and AWS appear as cloud options for US-headquartered providers. What lifts this off the floor is documented self-hosting where the customer controls the data and telemetry can be opted out — custody can move to the customer, but the vendor chain remains American and its footprint remains unstated.

Element

The community edition is honestly free under AGPL, but the production tier says 'Priced per seat/month' with no figure next to 'Talk to an expert', and even the server-limit disclosure defers to 'the same price minimums' without ever stating a minimum. A buyer cannot compute the annual invoice for any headcount from these pages; the sales conversation is the price list.

Mattermost

Every tier routes to sales — Professional says Contact Sales, Enterprise says Get Pricing, Enterprise Advanced says Request Quote — and no per-user figure appears anywhere on the captured pricing pages. Credit for labelled tier boundaries: single sign-on at Professional, compliance export and retention policy from Enterprise, Professional support capped at 250 users, plus a free limited-use evaluation edition. No annual invoice is computable from the public pages, whatever the headcount.