Threema Work vs Wire (Messaging)

Threema Work

This is a messenger wearing a work badge, not a workplace chat: flat group chats, file sharing, reactions and polls, with no threads, no channel model and — telling — search is never mentioned anywhere in the evidence. Eighteen-month-old decisions live in scrollback, not in a queryable archive. I give it the 3 because reactions, editing and broadcast feeds beat a plain attachment list, but the search silence is information.

Wire (Messaging)

The evidence gives me group conversations up to 500 (2000 with MLS), file sharing, self-deleting messages and custom folders, but not one word on threading, mentions, reactions, or search — and search that finds an eighteen-month-old decision is architecturally doubtful when servers delete message payloads on delivery. Threading absent and search unevidenced puts this at the basic-chats anchor, nothing higher.

Threema Work

End-to-end encryption is the default, not an option, backed by a plain zero-knowledge statement ('not even Threema has access'), Perfect Forward Secrecy, open source and regular independent audits. Device/session control is there operationally via 2FA, PIN-protected confidential chats and MDM-centralised access. It misses a 10 only because identity verification and cross-device key handling aren't evidenced in the evidence.

Wire (Messaging)

This is the full ten: end-to-end encryption as the default mode for text, voice, video and files, MLS as the underlying open protocol co-developed publicly, open-source code on GitHub, certificate-based identity verification via ID Shield, encrypted history backup for multi-device key survival, and a plain vendor statement that Wire has no access to keys and no backdoors. SSO/SAML, SCIM and password-gated guest roles round out access control.

Threema Work

The only retention numbers in the evidence are for Threema's own website forms and logs — nothing on message retention policy, admin export, audit trail or legal hold for the customer's tenancy. The off-hours policy is a genuine works-council olive branch, and zero-knowledge means there's little metadata to subpoena, but eDiscovery here means 'ask every user for their phone'.

Wire (Messaging)

The archive as a legal object barely exists here: retention means self-deleting messages and a purpose-based deletion rule, with no per-channel retention, no audit log, no legal hold, and no export-for-discovery capability evidenced anywhere in the evidence. Credit where due on the works-council side — analytics is self-hosted, consent-based Countly with no vendor data sharing and no productivity scoring — but eDiscovery and audit are simply silent, and that caps it at the bottom anchor that matches.

Threema Work

This is what I want to see: an OnPrem plan with self-hosting, white-labeling of all apps and air-gapped operation, plus open source and vendor-owned Swiss servers for the cloud. It holds at 8 rather than 9–10 because the evidence evidences no open protocol or federation, no documented upgrade path for a self-hosted instance, and no migration/export path in or out — 'custom' on the pricing page is not documentation.

Wire (Messaging)

This is the part I came for: 100% open-source code on GitHub, an on-premises deployment offered with 'comprehensive' support, real federation over MLS, and a deployment-options page — custody can plausibly be the customer's. What keeps it off the top anchor is that on-prem and data sovereignty sit behind a custom-priced Enterprise tier rather than a documented self-hosting path, and the evidence is silent on any export or migration route in and out.

Threema Work

There is a real API with gateway credits metered per license, bots, feeds, a broadcast API and an admin API for automated user management, which is more than a webhook toybox. But there's no webhook/event framework, no slash commands, no app-directory permissions model, no rate-limit documentation, and directory sync (AAD) is a surcharged bolt-on. AIBridge for AI integration is still 'coming soon'.

Wire (Messaging)

There is a bot capability the admin console can deploy and one named native integration (GitHub), plus SSO and SCIM — but no documented REST API, no webhooks, no slash commands, no rate limits, and nothing resembling an app framework with auditable permissions. That lands between the webhook-only anchor and the documented-API anchor: real bot accounts and provisioning, but the extensibility surface is unevidenced and probably a partner conversation.

Threema Work

Swiss is not EU, so the literal anchor caps this below 8 — Threema AG is the contracting entity under Swiss FADP — but the custody story is unusually strong: own servers in two named ISO 27001 data centres in Zurich, an Art. 27 GDPR representative in Bonn, a DPO, a DPA, GDPR compliance claims. I dock it because the pipeline found no published full subprocessor list (only Livestorm, for webinars) and ownership is unknown; the OnPrem option is what keeps me comfortable despite that.

Wire (Messaging)

Hosting is EU as standard (servers in Germany and Ireland, AWS EU) and the subprocessor list is genuinely published down to Stripe in the USA with DPF certification named — better than most. But the contracting entity is Wire Swiss GmbH, with Wire Germany GmbH existing only as an Article 27 representative, so the EU-entity condition fails, and the sovereignty pipeline could not confirm data residency on the vendor's own pages; the on-prem option that would moot all this is gated behind Enterprise sales.

Threema Work

Core at EUR 3.00/user/month and Professional at EUR 5.00/user/month are public with the billing period stated, which is decent. But the OnPrem tier — the one I care about — is 'CUSTOM', AAD sync is 'additional charge' with no number, and VAT treatment and guest/external pricing (EasyConnect) are unstated. I can price the SaaS invoice, not the deployment I'd actually buy.

Wire (Messaging)

Free (5 users), SMB at €7.45/person/month annually or €8.94 monthly with billing period stated and SSO/SCIM included — but everything a compliance-driven buyer actually wants priced (federation, ID-Shield, data sovereignty, on-prem deployment support) sits in an unpriced Enterprise tier above 100 people. VAT treatment, storage limits, guest pricing and minimum term are all unstated, so the annual invoice is not computable from public pages alone.