Mattermost vs Slack

Mattermost

Channels, real threaded discussions, file previews and search up to three million posts are documented on the plan pages, the API exposes threads with collapsed-thread views, and a beta call can move a thread to another channel. By default every deployment retains all messages, edits and deletions included, so the history itself is uncapped. We found no public information on pinned and saved items, on end-user search filters by channel, person or date, or on channel archiving and renaming that preserves history.

Slack

Channels, cross-organisation Slack Connect with boundaries, search over all stored company knowledge, and unlimited message history on paid plans with the free tier's 1-year cap documented clear the anchor-5 bar and half of anchor-8. But editing history, pinned/saved items, filtered search and human-readable conversation export are nowhere evidenced, so I stop short of 8.

Mattermost

Transport is TLS throughout, encryption at rest is infrastructure-level — LUKS, BitLocker, TDE, S3-managed keys — and granular roles, SSO, MFA and attribute-based channel access are all documented. The plain statement I prize is there, in an unwelcome direction: the deployment guide says encryption within the database is not offered, precisely so end-user search and compliance reporting can work, which tells me the server and whoever operates it reads everything. We found no public information on end-to-end encryption, device verification, or sessions an administrator can revoke.

Slack

Encryption at rest and in transit with vendor-held keys, plus SSO, 2FA, SCIM, information barriers and channel posting permissions — that is anchor-5 territory with an EKM add-on as partial key custody. No end-to-end encryption, no device verification, no session management an admin can revoke, and no statement of what Slack cannot decrypt: an archive anyone at the vendor with the keys can read is not the one I want.

Mattermost

Legal hold, eDiscovery automation and exports in CSV, Actiance XML, Global Relay EML and Proofpoint formats are documented, carrying edits, deletions, file uploads and channel member history, with messages trackable by identifier across batches and query and download actions logged in an audit history. Retention is retain-everything by default with plan-dependent customisation, jobs report success with counts, and past history can be exported by timestamp from the command line. Two honest gaps: Playbooks and Boards content sits outside the compliance export, and we found no public information on per-channel retention granularity, a full administrative audit trail, or switching off activity analytics organisation-wide.

Slack

Retention configurable at workspace, channel or other level, legal hold and audit logs named, DLP on every plan — good bones for a legal object. But the evidence never evidences a discovery export format, capture of edits and deletions, or any switch for activity analytics, so I cannot certify the subpoena half of anchor-8.

Mattermost

Custody is genuinely on the table: three deployment methods install the same server, high availability is self-managed, and an air-gap runbook with bill of materials and registry mirroring covers every edition from Team Edition upward, with FIPS-compliant, STIG-hardened images published. Export covers past history, files and member history into my own filestore, and Matrix protocol interoperability is named for federation. The door itself is the remaining question: we found no public information on the source licence terms behind the Team Edition or a documented migration path for bringing a legacy archive in.

Slack

Cloud-only and proprietary, from a San Francisco vendor; the evidence documents no self-hosting, no federation and no archive export format at all — the only data-getting-out rights are GDPR access requests. Custody of the archive never leaves the vendor, and an exit path is entirely unevidenced, which is close to the anchor-0 floor.

Mattermost

A documented REST API with bearer authentication and per-channel permission checks, incoming and outgoing webhooks on every plan, Slack-format compatibility, interactive Blocks with buttons and menus, interactive dialogs and administrator-enforced webhook channel locking make a real integration surface, and a Model Context Protocol connector is named at the Enterprise tier. The admin control over which channels a webhook may post to is exactly the kind of boundary I want to see. We found no public information on SCIM provisioning, event subscriptions with retries, documented rate limits, a sandbox, or an app directory with permissions a customer can audit.

Slack

A genuine platform: buildable solutions by click or code, 1.7 million weekly active apps with named native integrations, SCIM provisioning, SSO, and workspace-level control over third-party services. Rate limits, a sandbox, API versioning and auditable app permissions are unevidenced, which keeps it below anchor-8.

Mattermost

The contracting entity is Mattermost, Inc. of Palo Alto; we found no public information confirming EU data residency, and the captured security page names Azure and AWS as cloud options for US-headquartered providers without listing the subprocessors of the vendor-managed cloud. Transfers to the United States are disclosed with Data Privacy Framework certification, Standard Contractual Clauses and a TRUSTe referral path, and self-hosting with customer-controlled processing is the real mitigation — but even there, hosted push notifications can carry usernames, channel names and message preview snippets to the vendor unless the customer keeps that service off. For a European buyer this is a US chain with an escape hatch, not a sovereign one.

Slack

Germany data residency exists but only as an upsell from Business+, the contracting entity is US-based Salesforce, the LLM processing sits in a Slack AWS private cloud with no region named, and the subprocessor list is unpublished — that is precisely the anchor-3 shape: content residency offered while the rest of the chain stays opaque and non-EU.

Mattermost

The captured pricing pages route every named plan to a human — Professional says "Contact Sales", Enterprise says "Get Pricing", Enterprise Advanced says "Request Quote" — and no per-user figure, billing period or VAT treatment appears anywhere. A free limited-use edition of Enterprise Advanced exists for technical evaluation, while compliance monitoring sits in the quote-only tiers. I cannot compute an annual invoice for any headcount from these pages.

Slack

The tier map is documented — SSO on every plan including free, Germany residency from Business+, unlimited history from Pro — but not one per-user price, billing period, VAT treatment or Enterprise Key Management add-on price appears in the evidence. A buyer can see which tier they need but cannot compute the annual invoice, and retention controls are explicitly plan-dependent with Enterprise+ pricing absent.