Which chat fits your environment? In the collaboration selection we compare chat, files and video against your requirements, for example in demo instances. Operations of the individual systems are described under Matrix, Mattermost and Rocket.Chat. View collaboration selection · Book an intro call (free and non-binding)
Well-known self-hostable alternatives to Slack include Mattermost and Rocket.Chat. Matrix with Element is the third option and differs fundamentally in design: it is a federated protocol, not a single server. In addition, the edition limits have shifted recently. This article compares the three systems along the questions that need answering before a decision: architecture, encryption, licence limits, operations, security advisories and migration from Slack. Individual comparisons with Slack are in Slack vs. Mattermost, Slack vs. Rocket.Chat and the comparison including Zulip. As of November 2026.
Table of contents
- In brief
- Which Slack alternative fits which case?
- What distinguishes centralised and federated chats?
- What can be run for free, and where does the licence start?
- How does encryption work, and what is lost with it?
- What does federation offer a company?
- What do calls and video look like?
- How does operation work: database, resources, updates?
- How does the move from Slack work?
- How are sign-in and directories covered?
- Which security advisories have there been since May 2026?
- Where is Matrix used in the public sector?
- Common misconceptions
- Status and methodology
- Our approach at WZ-IT
- Further guides
- Sources
In brief
| Question | Mattermost | Rocket.Chat | Matrix / Element |
|---|---|---|---|
| Model | Central model, one operator | Central model, optional Matrix federation as add-on | Federated protocol, usually one homeserver per organisation |
| End-to-end encryption | Not available natively | Optional for supported room types | Optional per room |
| Federation | Only between Mattermost instances (Entry and Enterprise tiers) | Native Federation, premium add-on, generally available since 8.3 | Core of the protocol, can be restricted |
| Database | PostgreSQL (from v12: 15+) | MongoDB (8.x: 8.0+) | PostgreSQL (Synapse) |
| Free tier | Team Edition (intended for under 250 activated users, no SSO), Entry (server limits) | Starter (up to 50 users), Community | Synapse and Element Web under AGPL, ESS Community non-commercial |
| Import Slack history | mmetl and mmctl | Import in the admin area | No official tool found, bridge with optional backfill |
Which Slack alternative fits which case?
In our assessment the decision depends less on individual features than on three questions: Should communication stay within your own organisation? Must end-to-end encryption be possible? How much administration and support is needed?
| Requirement | Obvious choice | Reason |
|---|---|---|
| Team chat with channels, threads and integrations, internal only | Mattermost or Rocket.Chat | Central operating model, structure similar to Slack, integrations via webhooks and APIs |
| Communication across organisation boundaries (partners, customers, authorities) | Matrix | Federation is part of the protocol and can be controlled |
| End-to-end encryption as a requirement | Matrix, alternatively Rocket.Chat | Mattermost offers no native end-to-end encryption |
| Topic-based conversation model instead of a channel stream | Zulip | See the comparison including Zulip |
| SSO (OIDC, SAML) without a paid edition | Matrix (OIDC and SAML2 in Synapse) | In Mattermost SSO is removed from the Team Edition; SAML is available in Entry and the paid tiers |
This is our own assessment as orientation, not a ranking. Which combination fits is decided by users, integrations and compliance requirements.
What distinguishes centralised and federated chats?
With Mattermost and Rocket.Chat, communication is typically centralised on one instance controlled by one operator (clusters and multiple instances are possible in the paid plans). Users, channels and messages are at their core held in a shared database. In our assessment this simplifies administration, search, export and permissions.
Matrix is an open standard of the Matrix.org Foundation (specification). It is common for each organisation to run its own homeserver; the protocol does not require this. Rooms can be distributed across several homeservers. According to the Matrix FAQ, Synapse is the most widely deployed homeserver and Element the most popular client. Element is also a provider of additional products.
| Aspect | Mattermost | Rocket.Chat | Matrix (Synapse + Element) |
|---|---|---|---|
| Operator | One | One | Common: one per organisation, rooms federated |
| Rooms across organisation boundaries | Only Mattermost to Mattermost (Connected Workspaces) | Via Native Federation | Standard feature |
| Extension | Webhooks, REST API, plugin framework | REST and realtime API, webhooks, Apps Engine | Client-Server API, appservices, bridges, Hookshot |
| Connecting other services | Webhooks and plugins | Webhooks and apps, XMPP bridging experimental according to docs | Bridges for Slack, Discord, Telegram, WhatsApp, IRC |
For purely internal use we see no clear advantage of federation (our own assessment). It is an argument when conversations with external organisations are to take place on a shared platform.
What can be run for free, and where does the licence start?
Most has changed here recently. A more detailed edition table that also covers Zulip and Teams is in the article Microsoft 365 alternative. Here are the tiers relevant to the decision (as of November 2026).
| System | Source code licence | Free tier | Paid tiers |
|---|---|---|---|
| Mattermost | Team Edition (compiled by Mattermost, Inc.): MIT; Enterprise binaries including Entry: commercial licence; self-built from source: AGPL-3.0 or commercial licence (details in the licence file) | Team Edition: intended for under 250 activated users, no SSO. Entry: commercial licence, according to the docs for teams under 50 users | Professional (up to 250 licensed users, SSO; LDAP sync included according to the pricing page, the AD/LDAP guide excludes Professional from synchronisation, clarify before use), Enterprise (unlimited, high availability, compliance export), Enterprise Advanced |
| Rocket.Chat | MIT, except the ee/ directories under the Enterprise licence |
Starter (0 USD, up to 50 users) and Community according to the vendor page | Commercial plans without public prices (pricing page) |
| Synapse | AGPL-3.0, alternatively Element Commercial License | Free to use under the AGPL | Synapse Pro via ESS Pro |
| Element Web | AGPL-3.0, GPL-3.0 or Element Commercial License | Free to use under the licences | Part of ESS Pro |
| ESS Community (Helm package) | AGPL-3.0 | According to the vendor for non-commercial use cases up to 100 users | ESS Pro from 100 users, billed per user and month |
The changes in detail:
- Mattermost v11: According to the documentation the Team Edition is intended for under 250 activated users (previously 1,000); from 250 an administrator notice appears according to the product specification, and a technical block is not documented. GitLab SSO was removed (forum announcement). Entry added a free tier with a commercial licence. Its server limits: a history of 10,000 channel messages across all channels (older messages stay in the database but are neither visible nor searchable), 1,000 board cards, 5 active playbook runs per month and 40-minute calls (for these three the documentation notes that the limits take effect only in a future release), no compliance features, no high availability, community support only. How the message limit plays out in practice is shown by an issue: a user report about a school instance with over 2,000 active users, not an independently verified operating statistic.
- Mattermost Team Edition and authorities: The documentation calls the Team Edition "not recommended for government or sensitive commercial workloads". This is a vendor recommendation, not a legal prohibition.
- Element ESS Community: The vendor describes the package as not intended for production use in commercial environments, without vendor support and without responsibility for security updates. This concerns the product promise of the package. Synapse and Element Web themselves are under the AGPL, so commercial use is permitted. For proprietary forks Element offers alternative licences (announcement on the AGPL, November 2023).
- Rocket.Chat: The vendor page lists the Community edition with the note "Not suitable for production deployment by organizations that depend on Rocket.Chat for business-critical operations". The statements on the page are not identical in every place, so the edition should be checked against the current page before use.
For the paid offerings none of the three vendors names concrete per-user amounts on the pages checked (Rocket.Chat Starter costs 0 USD). Prices are to be requested from the respective vendor.
How does encryption work, and what is lost with it?
| Mattermost | Rocket.Chat | Matrix | |
|---|---|---|---|
| Server side | TLS and encryption at disk level, not in the database (docs) | Not part of this comparison | Not part of this comparison |
| End-to-end | Not available natively | Optional for supported room types | Optional per room (room messages via Megolm, key exchange between devices via Olm, also in direct-message rooms), cross-signing and key backups according to the specification and the Megolm documentation |
Mattermost justifies the lack of encryption in the database with search and compliance. With end-to-end encryption the server cannot index content without the keys, so server-side search does not work in those rooms. Rocket.Chat documents that encrypted messages are not searchable and that bots and integrations generally cannot read them, with exceptions for E2EE-capable bots (E2EE FAQ). Whether auditing and export are possible with Rocket.Chat E2EE is not clear from the pages checked: the E2EE documentation names restrictions, while the plans page advertises export of encrypted chats. With Matrix, authorised bots can work as decrypting participants, and Element documents auditing and export of encrypted conversations for ESS Pro (Element auditing). A blanket loss of bot access and compliance export therefore does not apply.
Whether end-to-end encryption is the right choice depends, in our assessment, on which requirement weighs more: confidentiality towards the operator, or findability and evidence obligations, and which tools are available for auditing and export. The Matrix specification describes encryption as optional. How the clients preset it by default, we have not checked.
What does federation offer a company?
In our assessment federation pays off when teams of different organisations are to work in shared rooms, for example with partners, customers or authorities. Then there is no need to create guests on a foreign platform.
- Matrix: Federation is part of the protocol. A restriction to specific servers is possible with the Synapse option
federation_domain_whitelist. An empty list disables federation. According to the documentation the option does not prevent the own server from joining rooms in which unlisted servers take part; for a private federation, matching lists and additionally a firewall are recommended. For ESS Pro, Element also names a Secure Border Gateway for federation control. - Rocket.Chat: Native Federation was introduced with version 7.11. According to the documentation it requires a premium plan with the Federation add-on (Commercial, Government or Defense). With version 8.3 Rocket.Chat declared federation generally available in a blog post of 7 April 2026; the documentation now mentions a beta phase only for the setting to join non-private rooms. According to the federation FAQ, end-to-end encryption is not supported for federated communication, so Rocket.Chat cannot decrypt or index encrypted federated content.
- Mattermost: Connected Workspaces link Mattermost instances with each other (from v10.2, in Entry, Enterprise and Enterprise Advanced, not in Professional).
Rooms spanning several servers create an additional surface: data leaves your own instance into rooms that other servers also hold. Whoever introduces it decides with which servers it is permitted.
What do calls and video look like?
| Mattermost | Rocket.Chat | Matrix / Element | |
|---|---|---|---|
| Calls | Calls plugin: in Professional group audio and screen sharing, self-hosted | Video conferencing through provider apps; Community only Jitsi and BigBlueButton, Starter additionally Pexip, Google Meet and Zoom | Element Call on MatrixRTC with LiveKit as SFU; Element Web can also embed a Jitsi widget for conferences |
| Additional operation | Plugin in the Mattermost server; for larger installations a dedicated RTCD service is additionally recommended; according to the Calls deployment guide it requires Enterprise or Enterprise Advanced and is required on Kubernetes | External provider or own service | LiveKit server per deployment |
For self-hosted video conferencing, Jitsi can be integrated with all three systems (for Mattermost through a community plugin). Operating an SFU such as LiveKit or Jitsi is a separate building block that needs network planning; whether a TURN server is required depends on the product and the network.
How does operation work: database, resources, updates?
| Aspect | Mattermost | Rocket.Chat | Synapse |
|---|---|---|---|
| Database | PostgreSQL, from v12.0 at least version 15 (MySQL no longer supported since v11) | MongoDB, for 8.x version 8.0 or later (system requirements) | PostgreSQL, SQLite for testing only (docs) |
| Resources according to docs | 1 to 1,000 users: 1 vCPU, 2 GB RAM; 1,000 to 2,000: 2 vCPU, 4 GB (requirements) | See the vendor's system requirements | At least 1 GB free RAM for joining large public rooms (installation); ESS Community quick setup: 2 CPU cores, 2 GB RAM |
| Scaling | High-availability cluster from Enterprise | Multiple instances only with a premium plan | Worker processes in the free version |
| Retention | Data retention and legal hold from Enterprise | Depending on plan | retention and media_retention in the free Synapse |
| Compliance export | Enterprise: CSV, Actiance XML, GlobalRelay EML, Proofpoint (docs) | According to the vendor page in Government and Commercial plans | ESS Pro with AuditBot and data export (plan assignment not clear in detail) |
| Admin interface | System Console | Admin area of the web app | Admin API, Element Admin in ESS Community |
Version status (November 2026, according to GitHub releases): Mattermost v12.0.x since October 2026, Rocket.Chat 8.9.0 (October 2026) with 9.0.0 at release-candidate stage, Synapse 1.164.2, Element Web 1.12.33, ESS Community 26.11.0.
According to the changelog, Mattermost v12 brings breaking changes: PostgreSQL 15 as minimum, no support for RHEL 7 and 8, OpenSearch at least 2.x when used, and the built-in Slack import has been removed. Rocket.Chat 9.0.0-RC names MongoDB 8.0.
According to the release lists on GitHub, update frequency is high for all three; the vendors do not guarantee a fixed cadence. Mattermost additionally ships patch releases for several lines in parallel. Continuous patching is therefore a fixed part of operation (our own assessment); see the section on security advisories.
How does the move from Slack work?
The precondition lies with Slack itself. According to the Slack documentation, the Free plan exports messages and file links of public channels, and the 90-day limit applies to file links only. Messages from private channels and direct messages can only be exported with Business+ or Enterprise; according to Slack, both plans require an application or separate activation of the export function.
| Target | Path | Notes |
|---|---|---|
| Mattermost | Slack export with mmetl transform slack, then mmctl import validate, upload, process (docs) |
Migrated: channels, direct messages, posts, threads, files, reactions, users. Not migrated: Slack Connect, canvases, user groups and integrations. The built-in import was removed in v12 (changelog) |
| Rocket.Chat | Import in the admin area with Slack export or users CSV (docs) | Users with the same name are skipped, channels with the same name are merged. Export files under 15 MB per time range are recommended |
| Matrix | No official import tool for history found (a research result, not proof that none exists) | The mautrix-slack bridge is listed on matrix.org as stable and recommended and synchronises continuously. Its configuration contains backfill options (disabled by default, max_initial_messages 50). A complete import of arbitrary Slack export archives is therefore not documented |
With the documented import paths, workflows, Slack apps and integrations do not move along. They have to be rebuilt, in Mattermost for example through webhooks and plugins, in Matrix through appservices or Hookshot. Anyone who wants to carry history over to Matrix can evaluate the mautrix-slack backfill; whether it covers the required scope has to be tested case by case. It should first be clarified whether the history is needed at all or whether an archive is enough (our own assessment).
How are sign-in and directories covered?
| Mattermost | Rocket.Chat | Matrix | |
|---|---|---|---|
| SSO | SAML in Entry, Professional, Enterprise and Enterprise Advanced (docs), further protocols per edition according to the editions page; SSO is removed from the Team Edition | Depending on plan, according to the vendor page | OIDC and SAML2 in Synapse, alongside the Matrix Authentication Service (MAS) (docs) |
| LDAP | AD/LDAP sync and group sync according to the guides in Entry, Enterprise and Enterprise Advanced, Professional is excluded there (docs); the pricing page lists LDAP sync for Professional too, clarify before use | Depending on plan | Not listed in the Synapse configuration docs; ESS Pro names LDAP and SCIM |
Keycloak and Authentik are suitable as identity providers. On choosing Keycloak and its alternatives: Keycloak alternatives.
Which security advisories have there been since May 2026?
All three lines had highly rated advisories between May and November 2026. No ranking can be derived from that. The table lists selected, documented advisories.
| Product | Advisory | Source |
|---|---|---|
| Mattermost | CVE-2026-5740 (22 May): unauthenticated WebSocket frame triggers a memory DoS | CVE.org |
| Mattermost | CVE-2026-6346 (18 May): support packet contains sensitive configuration values in plain text | CVE.org |
| Mattermost | CVE-2026-16453 (16 October, CVSS 7.1): SAML RelayState without integrity check, an authenticated SAML user can join arbitrary teams (affected 11.7.0 to 11.7.9, 11.8.0 to 11.8.5, 11.9.0 to 11.9.1 and 11.10.0) | CVE.org |
| Mattermost | CVE-2026-93851 (28 October, CVSS 8.0): Agents plugin, missing validation of the target post ID | CVE.org |
| Rocket.Chat | CVE-2026-45689 (May, CVSS 9.1): NoSQL injection in the OAuth2 token endpoint, account takeover; unauthenticated attack, provided the server has an active OAuth app and at least one stored refresh token | CVE.org |
| Rocket.Chat | CVE-2026-45688 (May, critical): CAS login handler | Advisories |
| Rocket.Chat | CVE-2026-55666 (June, critical): Apple Sign-In, account takeover | Advisories |
| Synapse | Collective release on 28 July 2026 with eleven advisories, example GHSA-6wjm-9p2x-gvpm | Synapse advisories |
The table is a selection and allows no statement about the frequency or pattern of the products' security posture. Further Synapse advisories are listed on the Synapse advisory page. More important than the comparison is patch discipline: know your versions, watch advisories, apply updates promptly. More in CVE monitoring.
Where is Matrix used in the public sector?
Its role in German healthcare is documented: the specification of the gematik TI-Messenger provides for the Matrix protocol of the Matrix.org Foundation so that different TI-Messenger products can communicate with each other. According to gematik, TI-M Pro has been available since April 2024 and TI-M ePA since July 2025.
This means "Matrix protocol in approved products", not "every Synapse server is approved". According to gematik, the protocol is also used outside the TI-Messenger; French authorities, the Bundeswehr and the education sector of individual federal states are named. We do not document details on this here, and we make no statement about deployments of Mattermost and Rocket.Chat in the public sector.
Common misconceptions
- "Matrix is free and open, so there are no licence questions." Synapse and Element Web are AGPL-licensed; the Helm package ESS Community is positioned by the vendor for non-commercial purposes.
- "Mattermost is free and unlimited." Since v11 the Team Edition is intended for under 250 activated users, and Entry has server limits.
- "Mattermost encrypts end-to-end." According to the documentation, it does not. There is transport and disk-level encryption.
- "Mattermost and Rocket.Chat have no federation." Rocket.Chat has Native Federation (premium add-on, generally available since 8.3), Mattermost has Connected Workspaces (Mattermost to Mattermost only).
- "AGPL means not usable commercially." Wrong. The restriction concerns the product promise of ESS Community.
- "Matrix is mandatory in healthcare." The TI-Messenger builds on the protocol; that concerns approved products and not every server.
Status and methodology
As of 5 November 2026. The statements refer to the state of the vendor pages and releases on that day. The basis is vendor documentation, licence files, GitHub releases and advisories, the Matrix specification, CVE.org and the gematik page. Statements on prices and plan contents come from the vendor pages, which are partly not identical. Our own assessments are identified as such in the text. The security table is a selection, not a complete list. We did not check the date on which the Element clients moved to the AGPL, the default encryption setting in the clients, or the full scope of the mautrix-slack backfill. That we found no official Matrix tool for Slack history is a research result, not proof that none exists. Rocket.Chat 9.0 and Mattermost 12.1 had not yet been released as stable versions at this date.
Our approach at WZ-IT
For selection and operation we proceed in this order:
- Clarify requirements: number of users, external communication, encryption, compliance, integrations.
- Clarify edition and licence: which tier covers the requirements and which licence has to be concluded with the vendor. Commercial licence agreements for Element, Mattermost and Rocket.Chat are concluded with the respective vendor.
- Check the export: for a move from Slack we check the available export data, users, files, integrations and the target edition.
- Set up operation: hosting of Matrix, Element, Mattermost or Rocket.Chat. The package Matrix with SSO comprises Synapse and Element Web with Keycloak or Authentik.
- Patch and observe: apply updates, follow advisories, check backups.
Monitoring runs 24/7, and the response to P1 incidents follows the service level.
Still unclear which system suits you? In the collaboration selection we compare chat, files and video against your requirements. For a move from Slack we first check which export data is available. View collaboration selection · Book an intro call (free and non-binding)
Further guides
- Slack vs. Mattermost: open-source alternative for companies
- Slack vs. Rocket.Chat: open-source alternative
- Top 3 Slack alternatives: Mattermost, Rocket.Chat and Zulip
- Microsoft 365 alternative for companies
- Chat control: secure business communication
- Matrix managed hosting
- Matrix with SSO (managed open source)
Sources
- Mattermost Docs: Editions and offerings
- Mattermost Forum: v11 changes in free offerings
- Mattermost Blog: Introducing Mattermost Entry
- Mattermost Pricing
- Mattermost licence (LICENSE.txt)
- Mattermost GitHub issue 34271
- Mattermost Docs: Encryption options
- Mattermost Docs: Connected Workspaces
- Mattermost Docs: Compliance export
- Mattermost Docs: Software and hardware requirements
- Mattermost Docs: v12 changelog
- Mattermost Docs: Migrate from Slack
- Rocket.Chat: Get started and plans
- Rocket.Chat Pricing
- Rocket.Chat licence
- Rocket.Chat Docs: Federation configuration
- Rocket.Chat Docs: Federation FAQ
- Rocket.Chat Blog: Version 8.3
- Mattermost Docs: Calls Deployment Guide
- Rocket.Chat Docs: System requirements
- Rocket.Chat Docs: Import from Slack
- Rocket.Chat security advisories
- Matrix Client-Server API specification
- Matrix bridges and mautrix-slack
- Synapse on GitHub (licence, README)
- Synapse security advisories
- Synapse Docs: configuration, PostgreSQL, installation, workers, OpenID Connect
- Element Blog: Element to adopt AGPLv3
- Element Web on GitHub and Element Call on GitHub
- Element ESS Community and ess-helm on GitHub
- Element Pricing
- Dendrite README
- gematik: TI-Messenger
- Matrix FAQ and Megolm documentation
- Mattermost Docs: SAML SSO, AD/LDAP and AD/LDAP groups
- Rocket.Chat Docs: E2EE FAQ and plans
- Element: Auditing
- mautrix-slack configuration
- Slack: Export your workspace data
