Element vs Mattermost

Element

Real threads, reactions, polls, attachments and explicitly unlimited history are confirmed, and federation gives cross-organisation rooms — but the evidence is completely silent on search, message-edit history, pins and channel lifecycle. The anchor-5 requirement of full-text search across the whole history is unevidenced, and my team lives on finding last spring's decision, so I interpolate between 3 and 5.

Mattermost

Channels, real threaded discussions and link and file previews are on the plan page, and the API docs show threads you can pull and move between channels — the move is marked beta, but it's the tidying-without-losing-history capability I ask for. Search is described as core search up to three million posts on Professional and enterprise search above that. I found no public information on end-user search filters by person or date, pinned or saved items, or how guest-channel boundaries are drawn, which keeps it off the upper band.

Element

The entire platform is end-to-end encrypted by default with non-encrypted rooms as the configurable exception, device verification via QR code or emoji string that ordinary users survive, and open-source Matrix underpinnings. The vendor states plainly that E2EE content is never accessed by its teams or shared externally — this is the anchor-10 package, not a bolt-on.

Mattermost

Transport and at-rest encryption are documented down to the mechanics — TLS with named ciphers, disk-level encryption via LUKS, BitLocker or TDE, S3-managed keys — and access control runs from granular role-based permissions and AD/LDAP sync up to attribute-based zero-trust channel access. The deployment guide states plainly that it does not encrypt within the database so that search and compliance reporting keep working, which is the honest statement I want from a vendor. We found no public information on end-to-end encryption, device verification or admin-revocable sessions, so it sits mid-band.

Element

Rules-based retention for messages and media and in-room auditing capturing an official record for compliance are evidenced, and no user profiling plus opt-in internal Matomo analytics is genuinely good. But there's no legal hold, no eDiscovery export format, and the audit covers room discussion rather than administrative actions, so it sits between the 5 and 8 anchors.

Mattermost

The compliance export machinery is genuinely deep — CSV, Actiance XML, Global Relay EML and Proofpoint formats, daily scheduled jobs, filters by date, user and keyword, and messages tracked by identifier as they are edited or deleted across export batches — with legal hold and eDiscovery automation named on the Enterprise plans. Default retention keeps all messages including edits and deletes, with customisable retention depending on plan. Playbooks and Boards are excluded from compliance export, and we found no public information on a full administrative audit trail or an organisation-wide switch for activity analytics.

Element

AGPL community edition, official helm charts for Kubernetes, S3 media repository, custom push gateway, and air-gapped deployment with no internet needed, on an open federated protocol with export explicitly positioned against vendor lock-in — custody is effectively the customer's. Docked one point because the free community homeserver is explicitly 'not for use in production environments', making the production-grade self-host path the paid edition.

Mattermost

This is where they are strongest: the same server installs via Kubernetes, Linux or containers, a documented air-gap runbook with registry mirroring covers every edition down to Team Edition, and FIPS-compliant, STIG-hardened images are published. The privacy policy says the self-hosting customer controls the processing of end-user data, telemetry is opt-out, and Matrix-protocol federation is named on the Enterprise plan. I held back from the top only because the captured pages show compliance-format exports rather than a documented full workspace export and import for migration.

Element

Named widgets (NeoBoard, OpenProject, Jira), LDAP/SCIM provisioning and OIDC SSO are real, and SCIM is an anchor-8 item. But the evidence evidences no documented REST API, webhooks, bot framework, rate limits or sandbox — my team can't build on what isn't documented.

Mattermost

There's a documented REST API with bearer auth and per-endpoint permissions, incoming and outgoing webhooks on every plan including the free Entry level, Slack webhook format compatibility for migration, interactive dialogs and Blocks for structured posts, and administrators can enforce webhook channel locking. GitLab notifications land through the standard webhook path, which is the busy-Tuesday test. We found no public information on slash commands, SCIM provisioning, documented rate limits or a sandbox, so it stops short of a full platform story.

Element

Hosting is named EU infrastructure (AWS Amsterdam/Stockholm, with customer region choice) and the subprocessor list is published — but the contracting entity is Element Creations Ltd in London under the UK ICO, outside the EU, and named subprocessors like Cloudflare, Twilio and Salesforce come with no stated jurisdiction or legal basis. Self-hosting and air-gap options let me remove the question entirely, which keeps this at 5 rather than the UK-entity baseline of 3.

Mattermost

The contracting entity is Mattermost, Inc. in California, transfers to the United States are disclosed in the privacy policy, and the captured pages give no official subprocessor list for the vendor-managed cloud — Azure and AWS appear only as customer-chosen hosting. What rescues a European deployment is custody: self-hosting with a telemetry opt-out and customer control of end-user data, plus fully documented air-gap operation. We found no public information on EU data residency being offered, so this stays near the bottom for anyone buying the vendor's cloud.

Element

The only public number is zero: the AGPL Community edition is free, but Element Server Suite Pro is 'Priced per seat/month' with no figure and a 'Talk to an expert' prompt, and even the server-limit terms reference unspecified 'price minimums'. No annual invoice is computable from these pages, which lands just above the all-sales-conversation anchor.

Mattermost

Every named plan — Professional, Enterprise, Enterprise Advanced — routes through "Contact Sales", "Get Pricing" or "Request Quote", and no per-user figure appears anywhere in the captured pages. A free limited-use Enterprise Advanced edition exists for evaluation and FAQs cover how licences are sold and seat overage, but the compliance and eDiscovery capabilities a buyer needs sit in the sales-conversation tiers. I cannot compute an annual invoice for my headcount from anything published here.