Threema Work

The Team Lead

What's evidenced is flat group chats with reactions, polls, calls and edit/delete — no channels, no threads, no mentions, and no search documented anywhere, so I can't confirm my team could find last spring's decision at all. No export of a conversation into a human-readable form is evidenced either; this is a consumer messenger pattern, not a workspace, which is why it sits near the bottom rather than mid-scale. 1 2

Report an error

The Security Officer

Group chats, polls, reactions, file sharing and edit/delete are evidenced, but the evidence says nothing about threads, channels, search, or exporting a conversation in human-readable form. For a product whose whole pitch is that the server cannot read anything, that silence matters: I have no evidence a decision made eighteen months ago can be found or extracted by the organisation that made it. 1 2

Report an error

The Works Council Advocate

Group chats, reactions, polls and file sharing are confirmed, but the evidence shows no threads, no channels, no mentions, and no search capability at all — eighteen months back, a decision here is found by scrolling, if the client still holds it. External communication is only a 'coming soon' EasyConnect. This sits between the flat-chats anchor and the basic-search anchor, closer to the bottom. 1 2

Report an error

The Compliance Counsel

Flat group chats, direct messages, file sharing, polls and reactions are evidenced, but no channels, no threads, no mentions, and no search capability appears anywhere in the registry. For a decision made eighteen months ago, the evidence gives me nothing to find it with. 1 2

Report an error

The Platform Engineer

This is a messenger wearing a work badge, not a workplace chat: flat group chats, file sharing, reactions and polls, with no threads, no channel model and — telling — search is never mentioned anywhere in the evidence. Eighteen-month-old decisions live in scrollback, not in a queryable archive. I give it the 3 because reactions, editing and broadcast feeds beat a plain attachment list, but the search silence is information. 1 2

Report an error

The Skeptic

Flat group chats with reactions, polls, message editing and file sharing, but no channels, no threads, no mentions, and not one word about search — and given the zero-knowledge claim the vendor structurally cannot search the archive server-side, so an eighteen-month-old decision is unfindable by design. No conversation export is evidenced either. Structure sits below the anchor-3 bar (no channels, no documented search); feature richness sits above rubric level 0, so I split at 2. 1 2

Report an error

The Team Lead

E2EE is the default, the code is open source with regular independent audits and perfect forward secrecy, and the zero-knowledge statement says plainly that not even Threema can read message content — that's the 10-side of the crypto half. It holds at 8 rather than higher because the access-control half is unevidenced: no SSO, no per-channel roles, no guest scoping, and nothing showing an admin can revoke a session — central user management and MDM are device policy, not room-level control, and identity verification isn't mentioned. 1 2

Report an error

The Security Officer

This is the product's spine: end-to-end encryption as the default mode with a zero-knowledge statement in plain words — "not even Threema has access" — plus perfect forward secrecy, open source and independent audits, which is exactly the vendor-cannot-decrypt statement I demand. It stays below the top because the evidence evidences no device or key verification, no admin-revocable sessions, and no documented key handling; MDM and central management are named but never as session revocation. 1 2

Report an error

The Works Council Advocate

End-to-end encryption is not an option, it is the product, with the vendor stating plainly that 'not even Threema has access', plus Perfect Forward Secrecy, open source code and regular independent audits. I dock a point only because the evidence is silent on device verification, cross-device key handling and admin session revocation — everything else here is what I would demand in a works agreement. 1 2

Report an error

The Compliance Counsel

End-to-end encryption is the first-class mode, not an option: zero-knowledge with the vendor stating plainly it cannot read content, Perfect Forward Secrecy, open source, and regular independent audits, with MDM central access control and two-factor authentication. Only the missing documentation of identity verification and cross-device key management keeps this off the top anchor. 1 2

Report an error

The Platform Engineer

End-to-end encryption is the default, not an option, backed by a plain zero-knowledge statement ('not even Threema has access'), Perfect Forward Secrecy, open source and regular independent audits. Device/session control is there operationally via 2FA, PIN-protected confidential chats and MDM-centralised access. It misses a 10 only because identity verification and cross-device key handling aren't evidenced in the evidence. 1 2

Report an error

The Skeptic

The sentence I hunt for is actually here: end-to-end encryption is the default mode with the vendor stating plainly what it cannot decrypt ('not even Threema has access'), backed by Perfect Forward Secrecy, open source, independent audits, 2FA and PIN-protected chats. Held at 8, not 10, because identity verification and key handling are asserted as principles rather than documented mechanisms, and SSO appears in no tier at all — the closest is AAD sync at an unstated 'additional charge'. 1 2

Report an error

The Team Lead

No message retention policy, no export format, no audit log and no eDiscovery appear anywhere in the evidence — the only retention facts are website cookies, forms and truncated 10-day logs, which say nothing about the message archive. The off-hours policy and the absence of any productivity analytics are works-council-friendly, but an archive I cannot produce for a lawyer is a liability in discovery, not just a privacy feature. 1 3

Report an error

The Security Officer

Every retention statement in the evidence concerns Threema's own website forms and logs; for the customer's message archive there is no retention policy, no export format, no audit log and no legal hold anywhere. The off-hours policy is the single control a works council would recognise, and it does not make an archive governable. 1 3

Report an error

The Works Council Advocate

The only retention numbers in the whole sheet are for website cookies, forms and truncated IP logs — nothing on message retention policy, admin export, eDiscovery or an audit log for the product itself. On the plus side for co-determination: no activity analytics or individual scoring is evidenced anywhere, and there is an off-hours policy plus availability status, which is exactly the presence control I ask for. Absence of the legal-tooling half pulls this down to just above the manual-copy anchor. 1 3

Report an error

The Compliance Counsel

No message retention policy, no per-channel retention, no discovery export, no audit log and no legal hold is evidenced — the only retention facts concern website visitor data such as contact forms, cookies and server logs. Zero-knowledge architecture means the vendor cannot produce my archive at subpoena time and no client-side export is offered to compensate, while edit and delete of messages carries no history. 1 3

Report an error

The Platform Engineer

The only retention numbers in the evidence are for Threema's own website forms and logs — nothing on message retention policy, admin export, audit trail or legal hold for the customer's tenancy. The off-hours policy is a genuine works-council olive branch, and zero-knowledge means there's little metadata to subpoena, but eDiscovery here means 'ask every user for their phone'. 1 2 3

Report an error

The Skeptic

Every retention statement in the evidence governs the vendor's website — cookies, server logs, support forms — while the messaging archive gets no retention policy, no audit log, no legal hold, no discovery export; under zero-knowledge the vendor cannot produce an eDiscovery output even under subpoena. The lone works-council gesture is an off-hours policy, real but lonely. That is rubric level 0 plus one point. 1 3

Report an error

The Team Lead

OnPrem self-hosting with air-gapped operation and white-labeling, plus an open-source claim, is a real custody option rather than a checkbox. It stops short of 8 because no export or migration path in or out — complete export including files and metadata — is documented anywhere in the evidence; custody I can hold but not leave with is only half of sovereignty. 1 2

Report an error

The Security Officer

A genuine self-hosted OnPrem edition with air-gapped operation and white-labelling of all apps is evidenced, which puts real custody within the customer's reach. But no export or migration path in or out is documented anywhere in the evidence, and "Open Source" is unscoped — client apps or server, it does not say. 1 2

Report an error

The Works Council Advocate

OnPrem self-hosting with air-gapped operation, white-labeling and an admin API is genuine custody, not a checkbox, and the cloud runs on the vendor's own servers in named Zurich data centres. But the evidence evidences no export or migration path in or out, no federation, and OnPrem is priced 'custom' rather than sold as a first-class public deployment — so a real exit is asserted, not documented. 1 2

Report an error

The Compliance Counsel

Custody is genuinely available: an OnPrem plan with self-hosting, air-gapped operation, white-labeling and its own 6-hour support tier, on own servers in named Zurich data centres. But the OnPrem licence is priced only as CUSTOM and no export or migration path in and out is documented, so the exit story is unproven. 1 2 3

Report an error

The Platform Engineer

This is what I want to see: an OnPrem plan with self-hosting, white-labeling of all apps and air-gapped operation, plus open source and vendor-owned Swiss servers for the cloud. It holds at 8 rather than 9–10 because the evidence evidences no open protocol or federation, no documented upgrade path for a self-hosted instance, and no migration/export path in or out — 'custom' on the pricing page is not documentation. 1 2

Report an error

The Skeptic

OnPrem is a first-class tier with air-gapped operation and white-labeling, and the cloud service runs on Threema's own servers in Zurich — custody is genuinely transferable. It stays at 8 because 'Open Source' is a bare bullet with no scope stated, the migration path and complete export in and out of OnPrem are undocumented, and OnPrem is priced only as 'CUSTOM' — the vendor does not yet document the exit it enables. 1 2 3

Report an error

The Team Lead

There is a genuine API surface: integration API, admin API, broadcast API with bots, scheduled messages and gateway credits, plus AAD sync at an extra charge. But no webhooks, no slash commands, no SSO, no app framework, no documented rate limits, and the AI bridge is 'coming soon' — this is a messaging pipe, not a platform, so it lands between the anchors. 1 2

Report an error

The Security Officer

An integration API, an admin API for automated administration, a broadcast API with bots, and gateway credits are evidenced, plus AAD sync at an unstated additional charge. No webhooks, slash commands, SSO, documented rate limits or sandbox appear anywhere, so this is a thin but real API surface rather than a framework. 1 2

Report an error

The Works Council Advocate

There is a real API surface — integration API, admin API, Broadcast API with bots and feeds, MDM, metered gateway credits — but no webhooks, no slash commands, no app framework, no SCIM, no documented rate limits or sandbox, and directory sync with AAD costs extra without a stated price. This is automation plumbing above the webhook anchor, well short of the documented-API-platform anchor. 1 2

Report an error

The Compliance Counsel

There is real surface: an integration API, Broadcast API with bots and feeds, an admin API, MDM and AAD sync. But no webhooks, no slash commands, no SSO statement, no documented rate limits or sandbox, and the AI bridge is still 'coming soon'. 1 2

Report an error

The Platform Engineer

There is a real API with gateway credits metered per license, bots, feeds, a broadcast API and an admin API for automated user management, which is more than a webhook toybox. But there's no webhook/event framework, no slash commands, no app-directory permissions model, no rate-limit documentation, and directory sync (AAD) is a surcharged bolt-on. AIBridge for AI integration is still 'coming soon'. 1 2

Report an error

The Skeptic

There are real server-side APIs — admin API, broadcast API, bots, feeds, scheduled messages — but nothing lives in the chat itself: no webhooks, no slash commands, no app framework, no SCIM, and no SSO in any tier; AAD sync is directory replication at an extra, unquoted charge and AIBRIDGE is 'coming soon'. That covers roughly half of the anchor-5 list, so I split between 3 and 5. 1 2

Report an error

The Team Lead

Swiss vendor running exclusively on its own servers in two named ISO 27001 datacenters in Zurich, with real GDPR engagement (Art. 27 representative in Bonn, a DPO) and a named subprocessor, plus an OnPrem option that largely removes the question. It misses the top because the contracting entity and primary law sit outside the EU (Swiss FADP), ownership is unknown, and the only disclosed subprocessor covers webinar tooling rather than a published full chain. 1 2 3

Report an error

The Security Officer

Hosting is named and certified — Threema's own servers in two ISO 27001 colocation data centers in Zurich — but the contracting entity is Swiss, not EU, and the pipeline found no published subprocessor list beyond Livestorm for webinar registration. The OnPrem option would remove the question entirely, but on the cloud product this is a third-country arrangement dressed with an Art. 27 GDPR representative in Bonn. 1 3

Report an error

The Works Council Advocate

The contracting entity Threema AG is Swiss, not EU — they even need an Art. 27 GDPR representative in Bonn — and hosting is on their own servers at a named ISO 27001 colocation partner in Zurich, which is geographically European but contractually outside the EU. Only one subprocessor (Livestorm, Ireland, webinars) is disclosed, and the pipeline itself marks product subprocessor exposure unknown. Switzerland on own infrastructure is better than most non-EU setups, but the entity and the undisclosed chain keep this just above the bottom anchors. 3 1

Report an error

The Compliance Counsel

The vendor's own pages state own servers in two ISO 27001-certified data centres in Zurich, a named Swiss controller, an Art. 27 GDPR representative in Bonn, and one named subprocessor (Livestorm, hosting in Ireland) — stronger custody than the pipeline's 'unknowns' suggest. But the contracting entity sits outside the EU and no full subprocessor list for the messaging service is published. 1 3

Report an error

The Platform Engineer

Swiss is not EU, so the literal anchor caps this below 8 — Threema AG is the contracting entity under Swiss FADP — but the custody story is unusually strong: own servers in two named ISO 27001 data centres in Zurich, an Art. 27 GDPR representative in Bonn, a DPO, a DPA, GDPR compliance claims. I dock it because the pipeline found no published full subprocessor list (only Livestorm, for webinars) and ownership is unknown; the OnPrem option is what keeps me comfortable despite that. 1 3

Report an error

The Skeptic

The contracting entity is Threema AG, Switzerland, under Swiss FADP with GDPR only 'may additionally apply' and an Art. 27 representative in Bonn — an entity outside the EU is rubric level 3's own wording, and the pipeline's computed 3 agrees. Own-server hosting in Zurich is stable but not EU, and the only named subprocessor (Livestorm, Ireland) touches webinars, not the messaging service; no full subprocessor list is published. 1 3

Report an error

The Team Lead

Core at EUR 3 and Professional at EUR 5 per user per month on annual billing are public, with tier limits spelled out (gateway credits, support response times). But OnPrem is 'CUSTOM', AAD sync is an unquantified 'additional charge', and VAT treatment is nowhere stated — I can compute the SaaS invoice for a headcount, but not the one for the self-hosted deployment this product is actually best at. 1 2

Report an error

The Security Officer

Core at EUR 3/user/month with annual payment stated and Professional at EUR 5 are public. But the OnPrem tier — the one carrying the sovereignty and air-gap — is priced only as "CUSTOM", AAD sync is an unpriced "additional charge", and VAT treatment is nowhere stated, so the invoice for the deployment a security buyer actually wants is not computable from public pages. 1 2

Report an error

The Works Council Advocate

Core at EUR 3 and Professional at EUR 5 per user per month, with annual billing stated, lets a buyer compute the SaaS invoice for any headcount. But the compliance-relevant choices — self-hosted OnPrem at 'custom', and AAD sync as an unpriced additional charge — sit behind a sales conversation, and minimum term and VAT treatment are unstated; only a 30-day trial is public. 2 1

Report an error

The Compliance Counsel

Core (EUR 3/user/month, annual payment) and Professional (EUR 5/user/month) are public with tier boundaries like gateway credits and support response times. The deployment I would actually buy — OnPrem — is CUSTOM, AAD sync is 'additional charge' with no figure, and VAT treatment and minimum term are unstated, so the annual invoice is not computable. 1 2

Report an error

The Platform Engineer

Core at EUR 3.00/user/month and Professional at EUR 5.00/user/month are public with the billing period stated, which is decent. But the OnPrem tier — the one I care about — is 'CUSTOM', AAD sync is 'additional charge' with no number, and VAT treatment and guest/external pricing (EasyConnect) are unstated. I can price the SaaS invoice, not the deployment I'd actually buy. 1 2

Report an error

The Skeptic

Core at EUR 3 and Professional at EUR 5 per user monthly with annual payment stated is computable — but the data-sovereignty capability sits in an OnPrem tier priced only 'CUSTOM' and AAD sync is 'additional charge' with no figure, so a compliance-conscious buyer cannot derive their annual invoice. VAT treatment and minimum term are unstated. That is rubric level 5 almost verbatim. 1 2

Report an error