Mattermost vs Slack

Mattermost

Channels, real threads and a documented thread API are evidenced, and at least the search cap is printed rather than hidden: core search up to three million posts on Professional, enterprise search beyond three million on Enterprise. I found no public information on pinned or saved items, mentions and reactions, or search filters by channel, person and date, and the thread-move endpoint is flagged as beta. Default behaviour retains every message including edits and deletes plus all files, so the history itself appears uncapped.

Slack

Channels, Slack Connect cross-organisation rooms with admin-controlled connection policy, AI search over stored knowledge, and — credit where due — a legible history cap: one year on Free, unlimited from Pro. But the words 'thread', 'edit history', 'pinned' and any human-readable export of a conversation appear nowhere in this registry, so I stop short of the 8 anchor.

Mattermost

The sentence I hunt for exists here: the database holds messages unencrypted specifically so search and compliance reporting of history work, which means TLS in transit and disk-level encryption at rest — no end-to-end encryption claim appears on the captured pages. Single sign-on and multifactor authentication sit on Professional, granular role-based and attribute-based controls on Enterprise, so the tier map is visible. I found no public information on device verification or session management an administrator can revoke.

Slack

Encryption at rest and in transit with the vendor holding the keys, plus SAML SSO down to Free, 2FA, information barriers and an Enterprise Key Management add-on — key custody you can rent, not E2EE. There is no end-to-end encryption and no sentence stating what the vendor itself can read anywhere in the evidence, and silence on that is the finding.

Mattermost

The discovery machinery is unusually concrete: compliance exports in CSV, Actiance XML, Global Relay EML and Proofpoint formats, edits and deletions tracked by message ID, channel member history included, past history exportable by command line, and every query and download logged in an audit history — with Playbooks and Boards explicitly excluded, which I respect being told. Legal hold and data retention policy appear as feature names on Enterprise without documented mechanism, and the audit trail I can see covers compliance queries rather than all administrative actions. I found no public information on activity analytics being switchable off organisation-wide.

Slack

Retention configurable at workspace and channel level (plan-dependent), legal hold, audit logs and native DLP on every plan — real governance bones. But no discovery or export format is documented in any form, and nothing says whether presence or activity analytics can be switched off — the archive as a legal object is half-built in this evidence.

Mattermost

Self-hosting is documented as a first-class path: Kubernetes, Linux and container methods install the same server, an air-gapped runbook with registry mirroring is published, FIPS-compliant STIG-hardened images exist, and the privacy policy states the customer controls processing of end-user data on self-hosted products. Federation via Matrix protocol interoperability is listed at Enterprise tier. The captured pages do not state a licence or source-availability model for the server, so I score the deployment paths rather than assume an open-source core.

Slack

Cloud-only SaaS: the entire registry is tier pricing, and the one 'private cloud' sentence is Slack's own AWS private cloud for their LLMs, not a customer deployment option. No self-hosting, no open-source core, and no export path documented at all — even the anchor-3 bar of a documented full export goes unevidenced, and Germany residency from Business+ changes where the vendor holds your archive, not who holds it.

Mattermost

A versioned REST API with bearer authentication, incoming and outgoing webhooks with Slack-compatible payloads, interactive dialogs and structured interactive blocks, plus single sign-on — a solid middle of this scale. I found no public information on slash commands, SCIM provisioning, documented rate limits, an app directory or a sandbox. Bot posts are acknowledged in compliance export contents, but no bot account model is documented on the captured pages.

Slack

Named integrations, 1.7 million weekly active apps, automation 'mit einem Klick oder per Code', SCIM provisioning, SSO, and per-workspace control over third-party services. What's missing for the next anchor: any documented API surface, rate limits, sandbox or deprecation policy — this sheet evidences an ecosystem, not a documented platform.

Mattermost

The contracting entity is Mattermost, Inc. in the United States, transfers to the USA are disclosed, and reliance is on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses; the captured pages give no hosting location and no published subprocessor list for the vendor-managed cloud, while Azure and AWS appear as cloud options for US-headquartered providers. What lifts this off the floor is documented self-hosting where the customer controls the data and telemetry can be opted out — custody can move to the customer, but the vendor chain remains American and its footprint remains unstated.

Slack

The vendor is Salesforce, Inc. of San Francisco, and the pipeline could confirm neither contracting entity, ownership, default residency nor a single subprocessor on the captured pages. The one European fact — 'Datenstandort Deutschland' — starts at Business+, making EU custody an upsell, and the LLMs sit in Slack's AWS private cloud of unstated region.

Mattermost

Every tier routes to sales — Professional says Contact Sales, Enterprise says Get Pricing, Enterprise Advanced says Request Quote — and no per-user figure appears anywhere on the captured pricing pages. Credit for labelled tier boundaries: single sign-on at Professional, compliance export and retention policy from Enterprise, Professional support capped at 250 users, plus a free limited-use evaluation edition. No annual invoice is computable from the public pages, whatever the headcount.

Slack

The tier boundaries are unusually legible — unlimited history from Pro, SAML SSO from Free, DLP on all plans, Germany residency from Business+, EKM as an add-on — but the registry contains not a single per-user price, billing period or VAT treatment. Without a number anywhere, the annual invoice is not computable from this evidence, so I score below the 'headline exists' anchor despite the good feature-to-tier mapping.