Mattermost
AGPLv3 / MIT, per componentTeam messaging where the history has to stay in your estate.
Practice led by Idris Bello, Practice Director, Collaboration
What Mattermost is
Mattermost is self-hosted team messaging: channels, threads, direct messages, file sharing and integrations. The difference from the hosted alternatives is not the feature list — it is that the message history sits in your database, under your retention policy, in a jurisdiction you chose.
Who it suits
- Regulated organisations that must retain and produce internal communications on demand
- Anyone whose data residency obligations rule out a US-hosted service
- Defence, healthcare and public-sector suppliers with contractual restrictions on where conversation data lives
- Teams migrating off Slack or Teams who need the history to come with them
And who it does not
If you have no regulatory driver and no data-residency constraint, hosted Slack or Teams will cost you less in total than self-hosting. Self-hosting is an operating decision, and it only pays off when something makes it necessary.
What we do with it
Our Mattermost work
Configuration is the project. The install is an afternoon.
Deployment with your storage and retention
Your object storage, your database, your retention schedule — per-channel where the policy differs. Configured to the policy your compliance team actually wrote, not to a sensible default.
Identity and directory sync
SSO through SAML or OIDC, group synchronisation from Active Directory or Entra ID, and de-provisioning that actually removes access when someone leaves.
Migration of history
Channels, threads, membership and files brought across from Slack or Teams exports, with a mapping report showing what moved and what could not.
Compliance export and legal hold
Scheduled exports in the formats your auditors and legal team expect, with the evidence trail to show the export ran and was complete.
Shape of the work
How an engagement runs
Policy workshop
Retention, export and access, agreed with compliance before build.
Deploy
Environments, storage, database, TLS, identity.
Migrate
History import with a full mapping report.
Compliance
Export jobs, legal hold, and evidence of both working.
Rollout
Phased by team, with the old system read-only during overlap.
What it connects to
- Active Directory and Entra ID
- Jira, GitLab and GitHub
- Grafana and PagerDuty alerting
- S3-compatible object storage
- Compliance archive systems
- Custom webhooks and bots
The honest bit
Mattermost is licensed per component — parts are AGPLv3 and parts are MIT — and some features that exist in the commercial editions are not in the freely licensed one. We will map what you need against what the open edition actually provides before you commit to anything, and if the answer is that you need a paid Mattermost subscription, we will say so. We do not resell it, so that recommendation costs us nothing either way.
In practice
A Mattermost engagement
Pharmaceutical · Mattermost
An MHRA inspection passed with no findings on communication retention
Self-hosted Mattermost for regulated internal communication, with per-channel retention and evidenced compliance export.
Castleton LabsAt a glance
- Inspection findings
- 0
- Retention on regulated channels
- 7 years
- Total engagement
- 19 days
- Export completeness evidenced
- 100%
Services that go with it
Deployment & configuration
Design, deploy and configure an open-source platform against how your organisation actually works.
How it worksData migration
Profiling, mapping, dry runs at production volume, and reconciliation reporting at every stage.
How it worksManaged hosting
Patching, backups with tested restores, monitoring and upgrades — in your cloud account or ours.
How it worksSupport & maintenance
Annual support against a deployed platform, with response targets and a quarterly review.
How it worksTalk to the Mattermost practice
A scoping conversation with someone who works on this platform every day, not an account manager.