Threema Work vs Wire (Messaging)

Threema Work

What's evidenced is flat group chats with reactions, polls, calls and edit/delete — no channels, no threads, no mentions, and no search documented anywhere, so I can't confirm my team could find last spring's decision at all. No export of a conversation into a human-readable form is evidenced either; this is a consumer messenger pattern, not a workspace, which is why it sits near the bottom rather than mid-scale.

Wire (Messaging)

Threads, channels and search are simply not evidenced anywhere — the messaging list is calls, screen sharing, sketch, file sharing and self-deleting messages, and self-deleting is the opposite of the archive I need. Custom folders, availability status and 500–2000-participant chats put it above a flat group chat, but nothing here says I can find last spring's decision in eighteen months.

Threema Work

E2EE is the default, the code is open source with regular independent audits and perfect forward secrecy, and the zero-knowledge statement says plainly that not even Threema can read message content — that's the 10-side of the crypto half. It holds at 8 rather than higher because the access-control half is unevidenced: no SSO, no per-channel roles, no guest scoping, and nothing showing an admin can revoke a session — central user management and MDM are device policy, not room-level control, and identity verification isn't mentioned.

Wire (Messaging)

End-to-end encryption on text, voice, video and files, MLS co-developed and open source on GitHub, ID Shield doing certificate-based identity checks so nobody fumbles fingerprints, guest links with passwords, and the vendor stating plainly it holds no keys and no backdoors. Docked one because admin-revocable session management and key handling for the encrypted history backup aren't spelled out, but this is the strongest crypto story in the category.

Threema Work

No message retention policy, no export format, no audit log and no eDiscovery appear anywhere in the evidence — the only retention facts are website cookies, forms and truncated 10-day logs, which say nothing about the message archive. The off-hours policy and the absence of any productivity analytics are works-council-friendly, but an archive I cannot produce for a lawyer is a liability in discovery, not just a privacy feature.

Wire (Messaging)

The privacy policy says encrypted messages are deleted from Wire's servers immediately on delivery, so the server-side archive a subpoena or works agreement would ask about barely exists; no per-channel retention, no admin export in a documented format, no audit log evidenced anywhere. Countly analytics are consent-based and self-hosted, which is the one thing keeping this off the floor.

Threema Work

OnPrem self-hosting with air-gapped operation and white-labeling, plus an open-source claim, is a real custody option rather than a checkbox. It stops short of 8 because no export or migration path in or out — complete export including files and metadata — is documented anywhere in the evidence; custody I can hold but not leave with is only half of sovereignty.

Wire (Messaging)

Open-source code on GitHub, comprehensive on-premises deployment support marketed at government customers, federation and multi-tenancy in the enterprise list — custody can genuinely be the customer's. The top anchor needs a documented migration path in and out, and the evidence never mentions export at all.

Threema Work

There is a genuine API surface: integration API, admin API, broadcast API with bots, scheduled messages and gateway credits, plus AAD sync at an extra charge. But no webhooks, no slash commands, no SSO, no app framework, no documented rate limits, and the AI bridge is 'coming soon' — this is a messaging pipe, not a platform, so it lands between the anchors.

Wire (Messaging)

Admins can deploy third-party bots, GitHub is listed as an integration, and SSO with SCIM provisioning is real — but there is no documented REST API, no webhooks, no slash commands, no app framework, no rate limits in the evidence. As an identity hookup it's fine; as a platform to build the day's work around, it's thin.

Threema Work

Swiss vendor running exclusively on its own servers in two named ISO 27001 datacenters in Zurich, with real GDPR engagement (Art. 27 representative in Bonn, a DPO) and a named subprocessor, plus an OnPrem option that largely removes the question. It misses the top because the contracting entity and primary law sit outside the EU (Swiss FADP), ownership is unknown, and the only disclosed subprocessor covers webinar tooling rather than a published full chain.

Wire (Messaging)

Servers in Germany and Ireland plus a fully published subprocessor list where the one US processor (Stripe) is named with its legal basis — that's anchor-8 hygiene — but the contracting entity is Swiss, not EU, ownership is unknown, and EU residency isn't confirmed as a standard commitment. Switzerland may be adequacy-recognised; for an EU procurement it still isn't an EU entity.

Threema Work

Core at EUR 3 and Professional at EUR 5 per user per month on annual billing are public, with tier limits spelled out (gateway credits, support response times). But OnPrem is 'CUSTOM', AAD sync is an unquantified 'additional charge', and VAT treatment is nowhere stated — I can compute the SaaS invoice for a headcount, but not the one for the self-hosted deployment this product is actually best at.

Wire (Messaging)

Free (5 people) and SMB (€7.45/person/month annual, €8.94 monthly, up to 100) are public with the billing period stated, and guests plus SSO/SCIM sit in the priced tier rather than behind an upsell. But everything my compliance team would ask about — data sovereignty, federation, ID-Shield, on-prem — is 'Custom' above 100 people, and history limits, storage and VAT treatment go unstated.