snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

docs/main/security-guide/cmmc-compliance.mdx

@@ -0,0 +1,86 @@
+---
+title: "CMMC Compliance"
+---
+## Overview
+
+The [Cybersecurity Maturity Model Certification (CMMC) 2.0](https://dodcio.defense.gov/CMMC/) is a U.S. Department of Defense (DoD) program that requires all contractors, subcontractors, and suppliers who handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to achieve certification. Whether your organization works directly with the DoD or as part of the Defense Industrial Base (DIB) supply chain, demonstrating compliance is mandatory to maintain contract eligibility.
+
+Achieving CMMC compliance is not guaranteed as it depends on proper configuration, policies, and broader organizational practices outside the software’s scope. However, this document outlines how Mattermost’s features can help U.S. Department of Defense contractors and subcontractors address specific [Level 2 requirements](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL2v2.pdf).
+
+## Access Control and Identity Management
+
+Mattermost supports robust identity and access management to ensure that only authorized users access the system and that they only see data permitted for their role. Key capabilities include:
+
+[Single Sign-On (SSO) Integration](/administration-guide/onboard/sso-saml): Mattermost integrates with enterprise identity providers via [SAML 2.0](/administration-guide/onboard/sso-saml), [OpenID Connect](/administration-guide/onboard/sso-openidconnect), and [AD/LDAP](/administration-guide/onboard/ad-ldap). This allows you to centrally manage user accounts and enforce enterprise authentication policies. Only users provisioned in your directory (and assigned to the Mattermost service) can log in. This helps satisfy access control requirements to “limit system access to authorized users” (AC 3.1.1) using vetted corporate identities.
+
+[Role-Based Access Control (RBAC)](/administration-guide/onboard/advanced-permissions): Granular permissions in Mattermost ensure users can perform only the actions permitted for their role. For example, regular users cannot perform administrative functions, and [guest accounts](/administration-guide/onboard/guest-accounts) have restricted access to specific channels. Administrators can configure [team-wide](/administration-guide/onboard/advanced-permissions#team-override-scheme) and [channel-specific roles/permissions](/administration-guide/configure/user-management-configuration-settings#advanced-access-control) so that users only access data and functions needed for their duties. This supports the principle of least privilege (AC 3.1.5) and limits users’ actions to authorized functions (AC 3.1.2, AC 3.1.7).
+
+[Group-Based Access Management](/administration-guide/onboard/ad-ldap-groups-synchronization): Mattermost [AD/LDAP Group Sync](/administration-guide/onboard/ad-ldap-groups-synchronization) automates user provisioning and de-provisioning. Users can be added or removed from Mattermost teams/channels based on their directory group membership. This ensures timely removal of access when personnel change roles or leave (addressing account management aspects of AC 3.1.1) and helps enforce separation of duties (AC 3.1.4) by aligning channel access with organizational roles.
+
+[Session Management and Timeout](/administration-guide/configure/environment-configuration-settings#session-lengths): Mattermost administrators can define session security settings, including session idle timeouts and session lifetime. Sessions can be automatically invalidated after a period of inactivity or on demand. By limiting session duration and requiring re-authentication, Mattermost reduces the risk of unauthorized access via unattended sessions (helps address AC 3.1.6 for session lock and IA 3.5.2 for session control). Failed login attempt thresholds can also be set (e.g. lock out after X failed attempts) to mitigate brute-force attacks, aligning with AC 3.1.8.
+
+**User Agreement and Access Approval**: Mattermost Enterprise supports a [Custom Terms of Service](/administration-guide/comply/custom-terms-of-service) banner that users must accept upon first login. This can be used to remind users of acceptable use policies or consent to monitoring, indirectly supporting training/awareness requirements and ensuring users acknowledge security terms before accessing CUI.
+
+## Authentication and Multi-Factor Authentication (MFA)
+
+Secure authentication is critical for protecting Controlled Unclassified Information (CUI). Mattermost offers several features to strengthen user authentication in alignment with CMMC requirements:
+
+**Unique User Identification**: Each Mattermost user has a unique account (username/email), satisfying the need for unique IDs (IA 3.5.1). Administrators can [deactivate accounts](/administration-guide/configure/user-management-configuration-settings#deactivate-users) that are found to be generic or shared, and when integrated with enterprise SSO or LDAP, organizational policies can prevent shared account use.
+
+**Password Policy Enforcement**: For built-in authentication, Mattermost administrators can [enforce strong password requirements](/administration-guide/configure/authentication-configuration-settings#password) (minimum length, complexity). This helps meet IA 3.5.2 by requiring robust passwords and reducing the risk of credential compromise.
+
+[Multi-Factor Authentication](/administration-guide/onboard/multi-factor-authentication): Mattermost supports MFA for all user accounts. In self-hosted deployments, admins can enable and enforce TOTP-based MFA (e.g. requiring a one-time code from Google Authenticator during login). When Mattermost is integrated with SSO (SAML/OIDC), you can leverage the IdP’s MFA policies (e.g. CAC/PIV or OTP) for Mattermost logins. Requiring two factors for authentication aligns with CMMC practice IA 3.5.3, adding an extra layer of verification to protect accounts even if passwords are compromised.
+
+**Account Lockout and Recovery**: Mattermost can limit failed login attempts and lock accounts after a specified number of failures, helping to thwart brute-force attacks (IA 3.5.3, additional aspect). It also provides options for [secure password reset](/end-user-guide/access/access-your-workspace#reset-your-password) or [administrator-issued password resets](/administration-guide/configure/user-management-configuration-settings#reset-users-password) to support account recovery while maintaining security controls.
+
+## Audit Logging and Accountability
+
+CMMC Level 2 (NIST 800-171) places heavy emphasis on audit logging and the ability to track and monitor system activity (Audit & Accountability, AU 3.3.x controls). Mattermost provides built-in logging and monitoring features that help meet these requirements:
+
+**System and Application Audit Logs**: Mattermost records server and application events in an [audit log](/administration-guide/manage/logging#audit-logging) ([JSON format](/administration-guide/comply/embedded-json-audit-log-schema)). This includes security-relevant events such as logins, account creations, permission changes, server configuration changes, and more. Enterprise editions can send logs to external [syslog or monitoring systems](/administration-guide/manage/logging#syslog-target-configuration-options) in real time. These logs provide the evidence needed for AU.3.3.1 (“generate audit records for user/activity”) and support analysis of incidents.
+
+**Message History Retention**: By default, Mattermost retains a complete history of all messages (including edits and deletions) and file uploads in the database. Even if a user deletes a message in the application, the data is still preserved in the backend (unless a retention policy is in place). This ensures actions are traceable to individuals (AU 3.3.2) and meets requirements to retain and archive audit data. Administrators can also [disable users’ ability to edit or delete messages](/administration-guide/onboard/advanced-permissions#system-scheme), guaranteeing an unalterable record of conversation content for compliance purposes (useful for investigations and meeting audit retention requirements).
+
+[Compliance Export](/administration-guide/comply/compliance-export) and [Electronic Discovery](/administration-guide/comply/electronic-discovery): Mattermost’s [Compliance Export](/administration-guide/comply/compliance-export) feature can automatically export message history and metadata on a scheduled basis. This helps organizations produce chat records for audits, e-discovery, or long-term archival outside the application (relevant to AU 3.3.3 on audit record retention and review). Additionally, integration with third-party archiving and e-discovery tools is supported (e.g. Smarsh/Global Relay), enabling centralized analysis of communications for compliance.
+
+**Automated Monitoring and Alerts**: Administrators can generate daily compliance reports of Mattermost activity or use the audit data for anomaly detection. Mattermost supports integration with Security Information and Event Management (SIEM) systems by sending logs to a [syslog](/administration-guide/manage/logging#syslog-target-configuration-options) or via the [API](https://developers.mattermost.com/api-documentation/). This allows organizations to correlate Mattermost events with other security data and receive alerts on suspicious behavior (e.g. multiple failed logins, unexpected user account changes), supporting AU 3.3.4 and RA 3.11.2 (continuous monitoring and risk assessment). Mattermost’s audit log can thus feed into your incident monitoring process for rapid detection of issues.
+
+**Protection of Audit Information**: Access to Mattermost logs is restricted to system administrators – regular users cannot view or tamper with audit records. Logs written to files on the server can be further protected by OS-level access controls. This aligns with AU 3.3.5 (prevent unauthorized access/modification of audit records). Additionally, if using Mattermost Cloud or an external log aggregator, you should apply appropriate controls to those environments to safeguard the logs.
+
+## Incident Response and Incident Collaboration
+
+Under CMMC Level 2, companies must establish and maintain an effective Incident Response (IR) capability (IR 3.6.1–3.6.3). Mattermost is a valuable tool for incident response planning, execution, and documentation:
+
+[Incident Playbooks](/end-user-guide/workflow-automation/learn-about-playbooks): Collaborative workflows managed through Mattermost Playbooks allow teams to codify their incident response plans and checklists directly in the platform. For example, you can create a playbook for “Cyber Incident Response” that automatically spins up a dedicated incident channel, assigns tasks to responders, notifies stakeholders, and tracks investigation steps when an incident is declared. This ensures a standardized response process, fulfilling the requirement to establish an operational incident-handling capability (IR 3.6.1) with defined preparation, detection, containment, and recovery steps.
+
+**Dedicated Incident Channels**: Mattermost enables the creation of [private, invite-only channels](/end-user-guide/collaborate/channel-types#private-channels) for incident responders. During an incident (e.g. a network breach or system outage), teams can coordinate in a secure Mattermost channel that is isolated from potentially compromised systems. Mattermost’s self-hosted or air-gapped deployment options allow it to serve as an [out-of-band communication](/deployment-guide/deployment-scenarios/deploy-oob) platform if primary systems or networks are affected. This approach helps contain incidents by preventing adversaries from monitoring or disrupting incident comms, and supports IR 3.6.1’s requirement for effective coordination during an incident.
+
+**Real-Time Notifications and Integrations**: Mattermost can integrate with monitoring tools and security systems to streamline detection and response. For instance, a SIEM or IDS can post an alert to a Mattermost channel (via webhooks or integrations) to notify the team of a potential incident. Mattermost [Playbooks](/end-user-guide/workflow-automation/learn-about-playbooks) support [automated incident notifications](/end-user-guide/workflow-automation/notifications-and-updates) – triggering alerts to responders when certain conditions are met. This real-time alerting and centralization of incident communication assists with prompt detection and reporting of incidents (IR 3.6.2). Team members can discuss and analyze the threat in Mattermost, accelerating triage.
+
+**Task Tracking and Documentation**: With Mattermost [Playbooks](/end-user-guide/workflow-automation/learn-about-playbooks) and [Boards](/end-user-guide/project-management/work-with-boards), each incident response run can have an associated [checklist of tasks](/end-user-guide/workflow-automation/work-with-tasks) (e.g. Identify affected systems, Collect logs, Eradicate malware, etc.) and an owner for each task. Responders check off tasks as they are completed, and all actions are timestamped. This creates an auditable timeline of the incident. All discussion in the incident channel, file attachments (like forensic screenshots), and timeline of actions are preserved. This comprehensive documentation of incidents satisfies IR 3.6.2’s mandate to track and report incidents to appropriate officials, and helps during post-incident analysis. Mattermost also facilitates post-incident reviews by enabling teams to add [retrospective notes](/end-user-guide/workflow-automation/metrics-and-goals#configure-retrospectives-before-a-run) in the channel or Playbook run after resolution. These records can be exported as needed for reporting to DoD or other authorities.
+
+**Testing Incident Response**: Mattermost can be used to conduct incident response drills or tabletops. Teams can simulate incidents by [running playbooks](/end-user-guide/workflow-automation/work-with-runs) in Mattermost (e.g. a planned exercise) to verify that everyone receives notifications and follows the procedures. This helps meet IR 3.6.3 (test the incident response capability) by providing a platform to perform and document response tests. Over time, playbook analytics and metrics (e.g. average time to resolution) allow you to gauge improvements in IR performance.
+
+By leveraging Mattermost for incident response, organizations create a central hub for managing incidents from initial alert to post-mortem. This directly supports CMMC Level 2 requirements to have an established, tested incident response process and to document and report incidents in a timely manner.
+
+## Communications Protection and Data Security
+
+CMMC Level 2 includes controls to safeguard information during storage and transmission (System & Communications Protection, SC 3.13.x) and to limit unauthorized information flows. Mattermost offers multiple features to protect data and control communications:
+
+[Encryption in Transit](/deployment-guide/transport-encryption): All Mattermost client-server communication can be [encrypted](/deployment-guide/encryption-options) using TLS (Transport Layer Security). When configured with HTTPS, Mattermost encrypts data in transit between the server and clients (web, desktop, mobile), preventing eavesdropping on CUI being discussed or transferred. This meets the requirement to protect CUI on networks by encrypting it during transmission (SC 3.13.8). Mattermost supports modern TLS protocols and ciphers; administrators should configure TLS per DoD guidelines (e.g. FIPS 140-2 validated cryptographic modules where applicable) to fully satisfy this control.
+
+[Encryption at Rest](/deployment-guide/encryption-options#encryption-at-rest): Mattermost supports encryption of data at rest through enterprise database and storage configurations. The application can be deployed on encrypted file systems or use encrypted storage backends. For instance, if using Amazon S3 for file storage, Mattermost Enterprise can enable [server-side encryption with S3-managed keys](/administration-guide/configure/environment-configuration-settings#enable-server-side-encryption-for-amazon-s3). If using a self-hosted database, administrators can enable disk encryption or TDE on the database server. By encrypting the Mattermost database and storage drives, organizations add a layer of protection for CUI stored in chat messages and files, helping to meet SC 3.13.16 (protect confidentiality of CUI at rest) and MP 3.8.3 (media sanitization if disks are disposed). Mattermost documentation encourages regular key rotation and secure key management for encryption at rest.
+
+**Network Access Control and Segmentation**: Mattermost can be deployed in a manner that controls network access to the system. In self-hosted deployments, organizations often place Mattermost servers in a secure enclave or DMZ with firewalls controlling ingress/egress. For cloud deployments, Mattermost Cloud offers [IP allowlisting](/administration-guide/manage/cloud-ip-filtering) (Enterprise plan) to restrict access to known IP ranges. These configurations address SC 3.13.1 and SC 3.13.2 by allowing Mattermost to reside within a protected network segment and ensuring only trusted networks or VPN users can reach it. Additionally, within Mattermost, data is segmented by [Teams](/end-user-guide/collaborate/organize-using-teams) and [Channels](/end-user-guide/collaborate/channel-types) – you can create separate teams for different projects or clearance levels, and mark channels as private to restrict membership. This “micro-segmentation” of conversations ensures that sensitive discussions (e.g. about a specific CUI program) are isolated to authorized individuals, reducing inadvertent information exposure.
+
+[Self-Hosted](/deployment-guide/server/deploy-server#deployment-options) and [Air-Gapped Deployment](/deployment-guide/deployment-guide-index): Unlike many collaboration tools, Mattermost can be fully self-hosted on-premises or in a sovereign cloud, giving organizations complete control over data locality. DoD contractors can [deploy Mattermost in an air-gapped environment](/deployment-guide/deployment-scenarios/air-gapped-deployment) with no outside internet connectivity if required. This supports compliance when handling CUI that cannot be exposed to external systems. By keeping Mattermost within the same secured IT boundary as other CUI systems, contractors address concerns of SC 3.13.5 (isolate system components from external access). Mattermost’s deployment flexibility (on-prem, GovCloud, etc.) allows alignment with DoD requirements (e.g. hosting at IL4/IL5 for sensitive data, if using cloud infrastructure). All user data resides in the infrastructure you control, aiding data sovereignty and compliance with any [FedRAMP](https://www.fedramp.gov/) or [ITAR](https://www.pmddtc.state.gov/ddtc_public/ddtc_public?id=ddtc_public_portal_itar_landing) restrictions that may apply in addition to CMMC.
+
+**Data Loss Prevention Measures**: While Mattermost does not natively include a full DLP suite, administrators can enforce certain restrictions to prevent unauthorized sharing or retention of data. For example, [public link sharing](/administration-guide/configure/site-configuration-settings#public-links) (for files) can be disabled or restricted, ensuring that shared files are not exposed to untrusted users. [File Upload Settings](/administration-guide/configure/site-configuration-settings#file-sharing-and-downloads) and [Plugin Whitelisting](/administration-guide/configure/plugins-configuration-settings#enable-remote-marketplace) allow you to control what types of files can be shared or which integrations are allowed, supporting SC 3.13.4 (control of information flows). Additionally, the [Push Notification contents](/administration-guide/configure/site-configuration-settings#push-notification-contents) can be configured to omit message text, so that if mobile push notifications are used, they do not leak sensitive message content to device lock screens or external services. For more advanced DLP, Mattermost’s open [APIs](https://developers.mattermost.com/api-documentation/) and [webhooks](https://developers.mattermost.com/integrate/webhooks/) enable integration with external DLP solutions or content filtering systems (e.g. a script could detect and remove messages containing certain keywords or PII). These measures help fulfill AC 3.1.3 / SC 3.13.4 by controlling the flow of CUI and preventing it from leaving authorized channels.
+
+**Sensitive Information Controls**: [System-wide banners](/administration-guide/manage/system-wide-notifications) can display CUI handling notices such as "⚠️ This system contains CUI. Use authorized accounts only. All activity is monitored." Supports AC.L2-3.1.9, AT.L2-3.2.1, IR.L2-3.6.2, and MP.L2-3.8.2. As well as [channel-specific banners](/end-user-guide/collaborate/display-channel-banners) can be used to flag channels containing CUI or incident response data, reinforce workflow integrity, or restrict data sharing. Supports AC.L2-3.1.3, MP.L2-3.8.2, AU.L2-3.3.1/3.3.2, and SC.L2-3.13.4.
+
+**Antivirus Scanning**: To address system integrity requirements (SI 3.14.5 for scanning files for malware), Mattermost can integrate with antivirus tools. A [ClamAV plugin](https://mattermost.com/marketplace/antivirus-plugin/) is available that scans files uploaded to Mattermost for viruses and malware. When enabled, this helps ensure that malicious files are detected and quarantined, protecting users and meeting the intent of controls on detecting and protecting against malware (SI 3.14.4 and SI 3.14.5). Administrators should also keep the Mattermost server host up-to-date with security patches and monitor for vulnerabilities (SI 3.14.1/3.14.2), as part of overall system integrity maintenance.
+
+Register to our [Trust site](https://trust.mattermost.com/) to see a full listing of all controls mapped to Mattermost features.
+
+[Book a live demo](https://mattermost.com/request-demo/) or [talk to a Mattermost expert](https://mattermost.com/contact-sales/) to explore tailored solutions for your organization’s secure collaboration needs. Or try Mattermost yourself with a [1-hour preview](https://mattermost.com/sign-up/) for instant access to a live sandbox environment.

docs/main/security-guide/finra-compliance.mdx

@@ -0,0 +1,19 @@
+---
+title: "FINRA Compliance"
+---
+Mattermost Enterprise and Enterprise Advanced features help users to meet the [cybersecurity requirements of the United States Financial Industry Regulatory Authority (FINRA)](https://www.finra.org/rules-guidance/key-topics/cybersecurity) as part of a customer's existing operational systems, including technology governance, system change management, risk assessments, technical controls, incident response, vendor management, data loss prevention, and staff training.
+
+FINRA reviews a firm’s ability to protect the confidentiality, integrity, and availability of sensitive customer information. This includes reviewing each firm’s compliance with SEC regulations, including:
+
+- Regulation [S-P (17 CFR §248.30)](https://www.ecfr.gov/current/title-17/chapter-II/part-248/subpart-A/subject-group-ECFR83262a0bce5ffaa/section-248.30), which requires firms to adopt written policies and procedures to protect customer information against cyber-attacks and other forms of unauthorized access.
+- Regulation [S-ID (17 CFR §248.201-202)](https://www.ecfr.gov/current/title-17/chapter-II/part-248), which outlines a firm's duties regarding the detection, prevention, and mitigation of identity theft.
+- The [Securities Exchange Act of 1934 (17 CFR §240.17a-4(f))](https://www.ecfr.gov/current/title-17/chapter-II/part-240), which requires firms to preserve electronically stored records in a non-rewriteable, non-erasable format.
+
+Mattermost supports FINRA compliance as part of a customer's integrated operations in the following ways:
+
+- **Continuous archiving:** Configuration as a non-rewriteable, non-erasable system of record for all messages and files entered into the system. Moreover, automated compliance exports and integration support for Smarsh/Actiance and Global Relay provide third-party eDiscovery options.
+- **Secure deployment:** Deployment within private, public, and on-premises networks with existing FINRA-compliant safeguards and infrastructure to protect customer information from cyber attack.
+- **Support for intrusion detection:** Ability to support multi-layered intrusion detection from authentication systems to application servers to database access, including configuration of proxy, application, and database logging to deeply audit system interactions.
+- **Multi-layered disaster recovery:** High Availability configuration, automated data back up, and enterprise information archiving integration to prevent data loss and recover from disaster.
+
+**\*DISCLAIMER:** MATTERMOST DOES NOT POSITION ITS PRODUCTS AS "GUARANTEED COMPLIANCE SOLUTIONS". WE MAKE NO GUARANTEE THAT YOU WILL ACHIEVE REGULATORY COMPLIANCE USING MATTERMOST PRODUCTS. YOUR LEVEL OF SUCCESS IN ACHIEVING REGULATORY COMPLIANCE DEPENDS ON YOUR INTERPRETATION OF THE APPLICABLE REGULATION, AND THE ACTIONS YOU TAKE TO COMPLY WITH THEIR REQUIREMENTS. SINCE THESE FACTORS DIFFER ACCORDING TO INDIVIDUALS AND BUSINESSES, WE CANNOT GUARANTEE YOUR SUCCESS, NOR ARE WE RESPONSIBLE FOR ANY OF YOUR ACTIONS. NO GUARANTEES ARE MADE THAT YOU WILL ACHIEVE ANY SPECIFIC COMPLIANCE RESULTS FROM THE USE OF MATTERMOST OR FROM ANY RECOMMENDATIONS CONTAINED ON OUR WEBSITES, AND AS SUCH, THIS SHOULD NOT BE A SUBSTITUTE TO CONSULTING WITH YOUR OWN LEGAL AND COMPLIANCE REPRESENTATIVES ON THESE MATTERS.

docs/main/security-guide/hipaa-compliance.mdx

@@ -0,0 +1,16 @@
+---
+title: "HIPAA Compliance"
+---
+Deploying Mattermost as part of a HIPAA-compliant IT infrastructure requires a deployment team trained on [HIPAA-compliance requirements and standards](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/).
+
+HIPAA-compliant deployments commonly consider the following:
+
+- Omitting the contents of messages from mobile push and email notifications:
+  - If your [Push Notifications Contents](/administration-guide/configure/site-configuration-settings#push-notification-contents) option is set to `Send full message snippet` there is a chance Personal Health Information (PHI) contained in messages could be displayed on a user's locked phone as a notification. To avoid this, set the option to `Send generic description with user and channel names` or `Send generic description with only sender name`.
+  - Similarly, setting [Email Notifications Contents](/administration-guide/configure/site-configuration-settings#email-notification-contents) to `Send generic description with only sender name` will only send the team name and name of the person who sent the message, with no information about channel name or message contents included in email notifications.
+- Beyond Technical Safeguards, HIPAA compliance deployments also require:
+  - Administrative Safeguards
+  - Physical Safeguards
+  - Organizational requirements and other standards.
+
+To learn more, please review [HIPAA requirements from the US Department of Health and Human Services](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/).

docs/main/security-guide/mobile-security.mdx

@@ -0,0 +1,98 @@
+---
+title: "Mobile Security"
+---
+Mattermost mobile is built with a robust security framework to protect user data and prevent unauthorized access. The Mattermost Mobile app's comprehensive security framework ensures that user data remains protected against unauthorized access.
+
+Continuous compliance through [secure SDLC practices and proactive vulnerability management](/deployment-guide/mobile/mobile-security-features#security-compliance) further reinforces the platform’s resilience.
+
+## Mobile Device Management (MDM)
+
+Mattermost supports the ability for an EMM provider to push Mattermost Mobile apps to EMM-enrolled devices. This approach is recommended for organizations that typically use EMM solutions to deploy Mobile apps to meet security and compliance policies. Learn more about [deploying Mattermost mobile using an EMM provider](/deployment-guide/mobile/deploy-mobile-apps-using-emm-provider).
+
+### Remote wipe capability
+
+Administrators can remotely wipe Mattermost data from mobile devices in case of loss or theft. This capability prevents unauthorized access to sensitive information by ensuring that data is erased from compromised devices.
+
+### Compliance policies
+
+Mattermost can be integrated with mobile device management solutions to enforce compliance policies. These policies ensure that mobile devices accessing the application adhere to security standards, such as encryption, password complexity, and device integrity. Learn more about [compliance with Mattermost](/administration-guide/comply/comply-index).
+
+### Mobile access platforms
+
+Mattermost mobile applications can be operated under the protection of mobile access platforms like [Hypori](https://www.hypori.com/). These platforms provide an additional layer of security by creating a virtualized environment for mobile applications, ensuring that sensitive data is isolated from the device's operating system. This approach enhances data protection and minimizes the risk of data leakage or unauthorized access.
+
+## Microsoft Intune Mobile Application Management (MAM)
+
+Mattermost supports Microsoft Intune Mobile Application Management (MAM) to enforce app-level data protection on **iOS** devices without requiring full device enrollment in a mobile device management (MDM) solution. Intune MAM applies security policies directly to the Mattermost mobile app based on user identity, enabling organizations to protect corporate or mission-sensitive data on Bring Your Own Device (BYOD) and mixed-use devices while preserving user privacy.
+
+Intune MAM for Mattermost is currently supported on iOS only. For Android deployments, we recommend using **Android Enterprise work profiles** as an alternative approach until Mattermost adds support for Intune MAM on Android.
+
+Intune MAM enforcement is applied per Mattermost workspace and is evaluated continuously at runtime. If a device becomes non-compliant or enrollment fails, access to protected content is blocked automatically. This approach allows organizations to extend zero-trust and data loss prevention (DLP) controls to mobile users without assuming ownership of the underlying device.
+
+Learn more about the [security capabilities enabled through Intune MAM](/deployment-guide/mobile/mobile-security-features#microsoft-intune-mobile-application-management-mam)).
+
+## Jailbreak and root detection
+
+Jailbreaking or rooting a device disables many built-in security measures, making the device prone to malware and unauthorized access. This protection enables Mattermost administrators to deny access from any mobile device that appears to have been tampered with or is running a non-standard version of the operating system. Additionally, a rooted device may stop checking for software updates and security patches, and it might not be able to install them because the kernel is no longer properly signed.
+
+By detecting such devices, Mattermost ensures that only secure, uncompromised devices can access sensitive data. When enabled by the system admin, this proactive measure ensures the underlying mobile platform operates reliably and performs the expected kernel and operating system security protections before sending any customer data to the Mattermost application, and minimizes risk in environments where personal device security cannot be guaranteed. Learn more about Mattermost [mobile jailbreak and root detection](/deployment-guide/mobile/mobile-security-features#jailbreak-and-root-detection).
+
+## Biometric authentication
+
+Native biometric authentication ensures only the authorized device owner can access the Mattermost application. By utilizing hardware-level security, biometrics significantly enhance data protection, especially in cases of lost or stolen devices. This advanced security measure is far more robust and user-friendly compared to traditional passwords, adding a resilient layer of protection against unauthorized access.
+
+Administrators can mandate biometric authentication each time users attempt to open the Mattermost application, further safeguarding customer data and mitigating risks. Learn more about Mattermost [mobile biometric authentication](/deployment-guide/mobile/mobile-security-features#biometric-authentication), and the [user workflows in which users must authenticate](/administration-guide/configure/environment-configuration-settings#enable-biometric-authentication), when biometric authentication is enabled.
+
+## Screenshot and screen recording prevention
+
+Preventing screenshots and screen recordings protects sensitive information from being inadvertently or maliciously shared. This control is essential in ensuring that confidential communications and data remain within the secure confines of the app. By blocking unauthorized screen captures, Mattermost significantly reduces the risk of data leakage via visual content by preventing users from taking screenshots or recording their screens on the mobile device. This feature ensures that users can not intentionally or inadvertently capture an image of any information shared in Mattermost. Learn more about Mattermost [mobile screenshot and screen recording prevention](/deployment-guide/mobile/mobile-security-features#screenshot-and-screen-recording-prevention).
+
+## App sandboxing and secure data storage
+
+Sandboxing is a critical defense that isolates the application’s data from other apps—even if malicious software is present on the device. This isolation helps maintain user privacy and data integrity by ensuring that only Mattermost has access to its stored data. Learn more about Mattermost [mobile app sandboxing and secure data storage](/deployment-guide/mobile/mobile-security-features#mobile-data-isolation).
+
+Learn more about how Mattermost leverages robust sandboxing mechanisms on both iOS and Android to [securely store files](/deployment-guide/mobile/secure-mobile-file-storage) in its cache folder within the application container, ensuring isolation from unauthorized third-party apps.
+
+## Push notification message visibility
+
+Push notifications are a convenient way to stay updated, but they can also pose security risks if sensitive information is displayed. Mattermost provides options to [control the visibility of message content in push notifications](/administration-guide/configure/push-notification-server-configuration-settings#id-only-push-notifications), ensuring that sensitive information is not inadvertently exposed through locked mobile screens and via relay servers from Apple and Google when sending notifications to iOS or Android mobile apps.
+
+## Disable downloads
+
+Environments with strict data loss prevention (DLP) policies or where sensitive information must not be stored on mobile devices can benefit from disabling file uploads and downloads on mobile devices.
+
+Disabling file uploads adds an additional layer of security by reducing the risk of malware or malicious files being introduced into the system, ensuring tighter control over sensitive corporate data, and preventing accidental leaks from unsecure mobile networks.
+
+Similarly, by disabling downloads, Mattermost ensures that files cannot be saved locally on the device, reducing the risk of unauthorized access or data leakage. Learn more about [disabling mobile uploads](/administration-guide/configure/site-configuration-settings#allow-file-downloads-on-mobile) and [disabling mobile downloads](/administration-guide/configure/site-configuration-settings#allow-file-uploads-on-mobile) in the Mattermost mobile app.
+
+## Secure file preview
+
+For organizations requiring even stricter control over file access on mobile devices, Mattermost provides secure file preview capabilities from Mattermost v10.11. This advanced security feature allows administrators to prevent file downloads, previews, and sharing for most file types while still enabling in-app viewing of essential content such as PDFs, videos, and images.
+
+When secure file preview is enabled, files are stored temporarily in the app's cache and cannot be exported or shared externally. This approach provides a balance between security and usability, ensuring that users can view necessary content without creating potential data leakage pathways.
+
+Additionally, administrators can control link navigation within PDF files when secure file preview mode is active, allowing links to open in the device browser or supported applications as needed.
+
+Learn more about [enabling secure file preview on mobile](/administration-guide/configure/environment-configuration-settings#enable-secure-file-preview-on-mobile) and [allow PDF link navigation on mobile](/administration-guide/configure/environment-configuration-settings#allow-pdf-link-navigation-on-mobile) in the Mattermost mobile app.
+
+## Mobile watermarking
+
+Mobile watermarking is an experimental Enterprise Advanced capability available from Mattermost v11.7 onward that helps organizations identify the source and timing of mobile screenshots or shared screen captures. When enabled by a system admin, authenticated Mattermost mobile sessions display a visible watermark overlay that includes the user's username, the server domain, and the current date and time. This supports data loss prevention (DLP) workflows by attributing any image taken of the Mattermost mobile app to a specific user, server, and point in time.
+
+The mobile watermark is a visual overlay only. It does not prevent screenshots, screen recordings, file exports, or content sharing through other means, and it is not a substitute for screen capture prevention or other mobile security controls. Mobile watermarking is disabled by default.
+
+Learn more about Mattermost [mobile watermarking](/deployment-guide/mobile/mobile-security-features#mobile-watermarking) and how to [enable the experimental Mobile Watermark setting](/administration-guide/configure/experimental-configuration-settings#enable-mobile-watermark).
+
+## Burn-on-read messages
+
+Burn-on-read messages reduce the window of exposure for sensitive content by automatically deleting messages after they are revealed. This approach supports secure, time-bound communication by ensuring that sensitive information doesn't persist on the device longer than necessary.
+
+Administrators can enable burn-on-read messaging and set the burn-on-read duration to align with organizational policies. Learn more about [sending burn-on-read messages](/end-user-guide/collaborate/send-messages#send-burn-on-read-messages) and [enabling burn-on-read messages](/administration-guide/configure/site-configuration-settings#enable-burn-on-read-messages).
+
+## Mobile Ephemeral Mode
+
+Mobile applications typically cache messages, files, and attachments indefinitely. Without data-age controls or a device-side deletion mechanism, a lost or stolen device retains all cached content — and MDM remote wipe cannot help when the device is offline. Mobile Ephemeral Mode addresses this by giving administrators timer-based controls that run on-device, independently of server connectivity, ensuring data is removed based on elapsed time rather than device reachability.
+
+Administrators can configure the maximum age of cached content and how long data persists after a device goes offline. A server-initiated wipe triggered by access revocation removes all data, including credentials, as soon as the device receives the command. Learn more about [Mobile Ephemeral Mode](/deployment-guide/mobile/mobile-security-features#mobile-ephemeral-mode).
+
+[Book a live demo](https://mattermost.com/request-demo/) or [talk to a Mattermost expert](https://mattermost.com/contact-sales/) to explore tailored solutions for your organization's secure collaboration needs. Or try Mattermost yourself with a [1-hour preview](https://mattermost.com/sign-up/) for instant access to a live sandbox environment.

docs/main/security-guide/secure-mattermost.mdx

@@ -0,0 +1,19 @@
+---
+title: "Secure Mattermost"
+---
+Mattermost ships with several security features that can help organizations safeguard their data. Mattermost Enterprise Edition includes features designed to offer extra layers of security protection.
+
+- [Encryption options](/deployment-guide/encryption-options) - Setup encryption for data in transit and at rest.
+- [Transport encryption](/deployment-guide/transport-encryption) - Secure data in transit between Mattermost and other services.
+- [Multi-factor authentication](/administration-guide/onboard/multi-factor-authentication) - Require users to provide a secure one-time code in addition to their username and password to log in to Mattermost.
+- [ID-only push notifications](/administration-guide/configure/push-notification-server-configuration-settings#id-only-push-notifications) - Enable fully private mobile notifications to protect against iOS and Android notification infrastructure breaches.
+- [Enterprise mobility management](/deployment-guide/mobile/deploy-mobile-apps-using-emm-provider) - Secure mobile endpoints with management application configuration.
+- [Delegated granular administration](/administration-guide/onboard/delegated-granular-administration) - Grant user access to specific areas of the Mattermost System Console.
+- [Custom terms of service](/administration-guide/comply/custom-terms-of-service) - Increase clarity on legal Mattermost expectations for internal employees and guests.
+- [Manage session length](/administration-guide/configure/environment-configuration-settings#session-lengths) - Control how long user sessions remain active.
+- [User and group provisioning via AD/LDAP](/administration-guide/onboard/ad-ldap-groups-synchronization) - Provision and synchronize users and groups to pre-defined roles.
+- [SAML-based single sign-on (SSO)](/administration-guide/onboard/sso-saml) - Enable login using a single user ID and password managed through a SAML 2.0 Service Provider.
+- [SAML SSO technical documentation](/administration-guide/onboard/sso-saml-technical) - Technical details on SAML SSO.
+- [Certificate-based authentication](/administration-guide/onboard/certificate-based-authentication) - Identify a user or a device before granting access to Mattermost.
+- [Manage file sharing and downloads](/administration-guide/configure/site-configuration-settings#file-sharing-and-downloads) - Control file sharing and downloads in Mattermost.
+- [Log path restrictions](/administration-guide/manage/logging#log-path-restrictions) - Restrict log file locations to authorized directories for enhanced access control and configuration integrity.

docs/main/security-guide/security-guide-index.mdx

@@ -0,0 +1,186 @@
+---
+title: "Security Guide"
+---
+Mattermost offers a comprehensive set of security features to protect information in its mobile applications. These features, ranging from encryption and authentication to device management and user education, provide a secure environment for team collaboration and communication. By prioritizing security, Mattermost ensures that customers can trust the mobile application to safeguard their data and privacy.
+
+<CardGrid columns={3} cards={[
+  {title: 'Security Updates', to: '/security-guide/security-updates', description: 'Live bulletin: filter by version, severity, product, and date.'},
+  {title: 'Secure Mattermost', to: '/security-guide/secure-mattermost', description: 'Hardening features and where to configure them.'},
+  {title: 'Zero Trust', to: '/security-guide/zero-trust', description: 'Control mapping against the CISA Zero Trust Maturity Model.'},
+]} />
+
+## Data-in-Transit Encryption
+
+Mattermost can be configured to use Transport Layer Security (TLS) to encrypt data transmitted over the network. TLS provides a secure channel for data exchange, protecting it from eavesdropping and tampering during transmission. This encryption ensures that only the intended recipients can access the content, preventing unauthorized parties from intercepting or reading the information.
+
+Mattermost administrators who wish to configure access settings for private and public networks can do so with 3rd party infrastructure using a [reverse proxy](/deployment-guide/server/setup-tls). This ensures that devices connected to secure networks can safely access the application while restricting access from untrusted networks. Learn more about Mattermost [data-in-transit encryption](/deployment-guide/encryption-options#encryption-in-transit).
+
+## Data-at-Rest Encryption
+
+Encryption-at-rest ensures that messages, files, and other data stored in the Mattermost database and file storage are protected from unauthorized access by safeguarding data on physical storage media (e.g., disks) by encrypting it, making it inaccessible without the appropriate encryption keys. Learn more about Mattermost [data-at-rest encryption](/deployment-guide/encryption-options#encryption-at-rest).
+
+Encryption-at-rest also available for files stored in Amazon's proprietary S3 system using server-side encryption with [Amazon S3-managed keys](/administration-guide/configure/environment-configuration-settings#enable-server-side-encryption-for-amazon-s3) (Mattermost Enterprise) when users choose not to use open source options.
+
+We strongly recommend regularly rotating and securely storing encryption keys using tools, enabling logging and monitoring for access to encrypted data, and ensuring that backup data is encrypted.
+
+## Authentication and Access Control
+
+### Single Sign-On (SSO)
+
+The mobile application integrates with Single Sign-On providers, allowing users to authenticate using their existing credentials from other trusted systems. This reduces the risk of password-related security breaches and streamlines the login process. Learn more about Mattermost [SSO](/administration-guide/onboard/corporate-directory-integration).
+
+### Multi-Factor Authentication (MFA)
+
+An additional layer of security beyond username and password. Customers can [enable and enforce MFA](/administration-guide/onboard/multi-factor-authentication) to protect accounts from unauthorized access, even if login credentials are compromised.
+
+### User Password Requirements
+
+System administrators can configure user password settings to help safeguard the platform against a range of common attack vectors while maintaining usability and compliance with enterprise security policies:
+
+- Enforcing longer passwords ensures a baseline level of strength for every user's credentials. Learn more about configuring a [minimum password length](/administration-guide/configure/authentication-configuration-settings#minimum-password-length).
+- Enforcing character complexity protects against attackers exploiting weak or overly simple passwords by enforcing passwords that resist dictionary attacks and common password vulnerabilities. Learn more about configuring [password requirements](/administration-guide/configure/authentication-configuration-settings#password-requirements).
+- Limiting the number of failed authentication attempts before locking the account temporarily or permanently mitigates brute-force, where attackers attempt to guess passwords by repeatedly entering potential combinations. Learn more about configuring the [maximum number of login attempts](/administration-guide/configure/authentication-configuration-settings#maximum-login-attempts).
+- Enabling the forgot password flow adds a layer of convenience by ensuring users can reset their password when needed while preventing users from being locked out due to legitimate loss of credentials. Learn more about [enabling a password reset workflow](/administration-guide/configure/authentication-configuration-settings#enable-forgot-password-link).
+
+### Session Management
+
+System administrators can configure session management settings, including session length, session cache, and idle timeout to ensure user sessions are managed effectively and securely. Session fixation attacks are mitigated as Mattermost sets a new session cookie with each login. Learn more about [session management configuration settings](/administration-guide/configure/environment-configuration-settings#session-lengths).
+
+### Protection Against Brute Force Attacks
+
+System administrators can [rate limit Mattermost APIs](/administration-guide/configure/environment-configuration-settings) based on query frequency, memory store size, remote address, and headers.
+
+### Remote Session Revocation & Password Reset
+
+System administrators can remotely [revoke user sessions](/end-user-guide/preferences/manage-your-security-preferences) across web, mobile devices, and desktop apps. User passwords can be remotely [reset](/administration-guide/configure/user-management-configuration-settings#reset-users-password) to enhance security.
+
+Admins can also enforce re-login after a specified period of time by defining [session lengths](/administration-guide/configure/environment-configuration-settings#session-lengths) and by [revoking user sessions](/administration-guide/configure/user-management-configuration-settings#revoke-a-users-session) to force users to log back into the system immediately.
+
+### Role-Based Access Control (ABAC)
+
+Administrators can set granular permissions to control access to sensitive information within the application. This feature ensures that users only have access to the data necessary for their roles, minimizing the risk of accidental or intentional data exposure. Learn more about Mattermost [role-based access control](/end-user-guide/collaborate/learn-about-roles).
+
+### Cross-Origin Requests Control
+
+Choose whether to restrict or enable [cross-origin requests](/administration-guide/configure/integrations-configuration-settings#enable-cross-origin-requests-from) for enhanced control.
+
+## Public Link Management
+
+Public links for account creation, file, and image shares can be invalidated by [regenerating salts](/administration-guide/configure/site-configuration-settings#public-link-salt) to ensure security.
+
+Public links can also be disabled by setting the [public link salt](/administration-guide/configure/site-configuration-settings#public-link-salt) to an empty string. This prevents the creation of new public links and invalidates existing ones.
+
+## LLM Context Management
+
+Mattermost Agents are designed to ensure that only necessary information is sent to the Large Language Model (LLM) for generating accurate responses in Mattermost. Learn how Mattermost [Agents manages LLM context](/end-user-guide/collaborate/agents-context-management) and how to ensure data privacy.
+
+## Audit Logs and Monitoring
+
+Mattermost writes logs to both the console and to a log file in a machine-readable JSON format. Customers with a Mattermost subscription can additionally log directly to syslog and TCP socket destination targets. Learn more about [Mattermost logging](/administration-guide/manage/logging).
+
+### Activity Monitoring
+
+Mattermost stores a complete history of messages, including edits and deletes, along with all files uploaded. User interface actions for deleting messages and channels only remove the data from the user interface; the data is retained within your database. If your compliance guidelines require it, you can disable users' ability to edit and delete their messages after they are posted. Learn more about [Mattermost permissions](/administration-guide/onboard/advanced-permissions).
+
+The Mattermost mobile app generates audit logs that record user activities and system events. These logs enable administrators to monitor access and identify potential security threats, ensuring timely detection and response to suspicious behavior.
+
+## Regular Security Updates
+
+### Patch Management
+
+Mattermost regularly releases security updates to address vulnerabilities and enhance the application's security posture. Users are encouraged to keep their mobile applications up to date to benefit from the latest security improvements. Browse the live [Security Updates bulletin](/security-guide/security-updates) and filter by affected version, severity, and product. Learn more about Mattermost [releases and the release life cycle](/product-overview/releases-lifecycle).
+
+### Community and Expert Contributions
+
+Being an open-core platform, Mattermost benefits from contributions from the security community and experts. These contributions help identify and mitigate potential security risks, ensuring that the mobile application remains robust and secure. Learn more about [contributing to Mattermost](https://mattermost.com/contribute/).
+
+[Book a live demo](https://mattermost.com/request-demo/) or [talk to a Mattermost expert](https://mattermost.com/contact-sales/) to explore tailored solutions for your organization's secure collaboration needs. Or try Mattermost yourself with a [1-hour preview](https://mattermost.com/sign-up/) for instant access to a live sandbox environment.
+
+## Compliance Considerations
+
+Mattermost can be deployed as part of regulated environments where compliance with industry standards is essential.
+
+- HIPAA: Review our guidance on [deploying Mattermost as part of a HIPAA-compliant IT infrastructure](/security-guide/hipaa-compliance), with key considerations for protecting electronic protected health information (ePHI).
+- FINRA: Learn how [Mattermost supports organizations in meeting the cybersecurity requirements of FINRA](/security-guide/finra-compliance).
+
+## Frequently Asked Questions
+
+### What are the trust benefits of Mattermost compared to third-party SaaS systems that let customers manage their own encryption keys?
+
+**Encryption doesn't mean a third-party SaaS vendor can't read your data.** A third-party vendor who provides encryption keys to the database that stores a customer's data at rest may still be able to read a customer's data while its in transit.
+
+For example, performing a search on message histories requires access to unencrypted messages in order to match the search term to words in your unencrypted message history.
+
+As another example, a customer's data encryption key is unlikely to be deployed to the mobile devices of end users; therefore, when a third-party system sends a push notification to an end user's mobile device, the unencrypted text is available to the third party.
+
+In contrast, Mattermost is hosted by the customer. Not only can data be encrypted at rest and in-transit with keys generated by the customer (which no vendors ever touch), unencrypted data for search and mobile notifications is handled by systems under your IT team's control.
+
+If it’s unclear from the vendor’s documentation whether or not your data can be read, ask them directly.
+
+**Moreover, high trust enterprises need more than encryption - they need privacy, total data ownership, auditability, and control of their infrastructure.**
+
+*Privacy* means a third-party service cannot monitor the identity, IP address, location, or access patterns of your employees, nor their activity on your system, nor provide that information either intentionally through a court order (which you may never be informed about) or unintentionally through a data breach.
+
+*Total data ownership* means a third party cannot prevent you from accessing your data at any time. It means no third party can read your data, analyze it or monetize it. It means that should you end your commercial relationship, you maintain your records with any backups. It also means you can delete your data at any time and verify that no additional copies remain.
+
+*Audibility* means being able to fully observe, monitor, and trace the operations of your systems.
+
+*Control of infrastructure* means being able to operate and customize your system to the specific needs of your business, including the ability to run on public and private networks, as well as on-prem, and interoperate with critical legacy systems with full observability and transparency down to reading the source code.
+
+As an open source self-hosted system, Mattermost provides privacy, total data ownership, and control of infrastructure required by high trust teams.
+
+### What are the fundamental security challenges with Massive, Multi-Tenant Applications (MMTA)?
+
+The key risk of allowing confidential data to enter a Massively Multi-Tenant Applications (MMTA) is having the system breached, never knowing your data has been compromised, and having stolen data used to breach your other systems.
+
+Marketers from MMTA vendors pay highly credentialed security professionals to offer "Death Star Logic" to gain a customer’s trust: "MMTA's SaaS offering is the most secure system in the galaxy because it outspends its customers on security investments, therefore the MMTA is more secure than a customer's self-hosted infrastructure."
+
+The problem with Death Star Logic is that it omits the fact that hosting confidential data from thousands of enterprise customers makes it the prime target for cyber attacks, which increases risk to customers for four key reasons:
+
+**1) Over time, MMTA vendors become Nation State Targets**
+
+The effort behind a cyber attack is proportional to the value of breaching the system. As the value of the data held by an MMTA vendor increases, so does the scale of its cyber threats.
+
+Vendors become "Nation State Targets" when the value of the breaching their system is so high it attracts the attention of the cyberwarfare branches of hostile nations. From there, even the smallest errors in system security can result in a significant breach.
+
+**2) MMTA systems can't protect customers from unknown vulnerabilities**
+
+A single bug in an MMTA system can put all customers at risk. For example, [Slack reported a bug that exposed message histories and files for nearly four million users](https://www.wired.com/2017/03/hack-brief-slack-bug-everyones-worst-office-nightmare/) (2017), and [a bug left 400 million Microsoft accounts exposed to account takeover](https://hackread.com/critical-bug-in-microsoft-left-400m-accounts-exposed/) (2018).
+
+For multi-tenant systems, bugs in infrastructure can present vulnerabilities as well. For example, in 2018 researchers discovered that chip-level exploits like [Meltdown and Spectre](https://www.wired.com/story/intel-meltdown-spectre-storm/), which had been around for decades, could make it possible for malicious code run by one tenant to affect the operations of another tenant that shared the same CPU.
+
+Keeping MMTA systems secure depends on the ability of internal and external security researches to continually stay ahead of cyber-attackers.
+
+**3) Customers don't know when breaches occur**
+
+When an MMTA is breached, it is most likely from an unknown bug or an unknown vulnerability. Because of this, it may not be clear that a system has been breached, and customers may not be notified. Moreover, following a breach, there's often no way for the customer's security team to audit the MMTA vendor and understand how their confidential data may have been accessed or stolen.
+
+The end result is confidential information passing through an MMTA may be used to exploit other systems the customer operates, with no way to trace the root of the breach to mitigate it in future.
+
+As an example, when [OneLogin reported a security breach that allowed the attacker to decrypt encrypted data impacting 2000 customers and 70 SaaS apps](https://krebsonsecurity.com/2017/06/onelogin-breach-exposed-ability-to-decrypt-data/) (2017), details were vague and there was little customers could do to analyze their risk or reduce risk in future.
+
+In contrast, an open source, self-hosted collaboration solution remains within the layers of physical security and network security enterprises use to protect their most valuable assets, with full access to logging and system histories to know when, where and how an attack might have occurred.
+
+Moreover, as a single-tenant solution, the strength of cyberattacks is typically limited to the breach value of just your confidential data and not the aggregate breach value of all customer data held by an MMTA. Plus, the sum of security investments your company makes to protect systems in its private networks accrues to your collaboration system - and for banks, this could be hundreds of millions of dollars a year.
+
+**4) MMTA systems risk cross-bleeding your data**
+
+MMTA also runs the risk of bugs or misconfigurations in a vendor’s multi-tenant system bleeding your data into another customer’s space, or vice versa. Bleeds can occur via logging systems, in application logic, middleware, and data layer errors. In 2019, [Facebook admitted to accidentally storing hundreds of millions of user passwords in clear text for years due to a configuration oversight](https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/).
+
+### Why does Mattermost disclose whether or not an account exists when a user enters an incorrect password?
+
+Mattermost's core design principle is to be "fast, obvious, forgiving" and, telling users that they made a mistake in entering their password, is in service of our principle of prioritizing user interests.
+
+When using username-password authentication, especially with AD/LDAP, there's the possibility of usernames being email addresses, Mattermost username, AD/LDAP username and ID, or other AD/LDAP attributes and our design principle intends to help end users understand whether their login error came from having the wrong password or the wrong email/username.
+
+We believe this design increases productivity, speeds up user adoption, and reduces help desk tickets and support costs - and that these benefits outweigh the trade-offs.
+
+The trade-off with this design is that if physical security is not in effect, network security is not in effect (i.e., no VPN or a malicious user within the private network), and username-password authentication is used, an attacker may be able to enumerate email addresses or usernames by sending HTTP requests to the system, up to the maximum number of requests per second defined in Mattermost's [API rate limiting settings](/administration-guide/configure/environment-configuration-settings).
+
+For organizations who choose to deploy in such a configuration, please consider the following mitigations:
+
+1.  Instead of username-password, use a Single Sign-On (SSO) provider in Mattermost Enterprise Edition like OneLogin, Okta, or ADFS, or use the open source GitLab SSO option available with Mattermost Team Edition.
+2.  Per the recommended install instructions, use a VPN client to apply network security to your deployment.
+3.  Enable monitoring and alerting from your proxy server to detect and isolate malicious behavior reaching your deployment.
+
+Above all, make sure to subscribe to the [Mattermost Security Bulletin](https://mattermost.com/security-updates/#sign-up), review the [Security Updates](/security-guide/security-updates) page, and apply security patches as recommended.

docs/main/security-guide/security-updates.mdx

@@ -0,0 +1,15 @@
+---
+title: Security Updates
+description: Live Mattermost security advisories. Filter by product, severity, issue ID, date, and affected version.
+hide_table_of_contents: true
+---
+
+This bulletin lists publicly disclosed security issues for Mattermost Server, Desktop, Mobile, and Plugins after a fix is available. Use the table to check whether an advisory affects your deployment and which release contains the fix. Filter by product, severity, issue ID, date, or affected version.
+
+To report a vulnerability, follow the [Responsible Disclosure Policy](https://mattermost.com/security-vulnerability-report/). Subscribe to fix-release notifications on the [Security Bulletin signup](https://mattermost.com/security-updates/#sign-up).
+
+<Note>
+Specific details on security updates are announced 30 days after the fix is available. Mattermost has a [mandatory upgrade policy](/administration-guide/upgrade/upgrading-mattermost-server) and provides updates for supported releases.
+</Note>
+
+<SecurityUpdates />

docs/main/security-guide/zero-trust.mdx

@@ -0,0 +1,190 @@
+---
+title: "Zero Trust with Mattermost"
+---
+Mattermost is designed from the ground up to blend seamlessly into an organization’s existing Zero Trust practices and requirements. Rather than treating Zero Trust as a checklist of security controls bolted on after the fact, Mattermost implements it as a continuous enforcement model across every layer of collaboration-identity, devices, networks, applications, and data.
+
+For security teams, Mattermost’s zero-trust-first approach ensures consistent compliance with organizational risk policies by automating key governance processes like incident response or data lifecycle management.
+
+This guide maps Mattermost's security capabilities to the five pillars of the [CISA Zero Trust Maturity Model](https://www.cisa.gov/zero-trust-maturity-model) and describes how organizations can progress from a traditional perimeter-based stance to full, dynamic Zero Trust enforcement. Features are available on Enterprise or Enterprise Advanced editions as noted.
+
+## User Management / Identity
+
+Zero Trust requires that every user be continuously verified, not just at login. Mattermost integrates with enterprise Identity, Credential, and Access Management (ICAM) platforms to automate this verification and make access decisions dynamic rather than static.
+
+### Foundation: federated authentication and directory sync
+
+At the most basic level, Mattermost replaces standalone passwords with enterprise identity providers (IdPs) and keeps access rights synchronized automatically.
+
+- [Single Sign-On (SSO)](/administration-guide/onboard/sso-saml) [Enterprise] — Supports SAML 2.0, and OpenID Connect with Okta, Microsoft ADFS, Entra ID, OneLogin, and GitLab. User accounts and attributes are created and synchronized automatically on first login, eliminating locally managed credentials.
+- [AD/LDAP User Sync](/administration-guide/onboard/ad-ldap) [Enterprise] — Continuously synchronizes user attributes and group memberships from Active Directory or LDAP. When a user is disabled in the directory, their Mattermost access is revoked automatically on the next sync cycle.
+- [Role-Based Granular Access Controls](/administration-guide/onboard/advanced-permissions) [Enterprise] — Defines System, Team, and Channel Admin roles with fine-grained permission scopes. Roles can be synchronized from AD/LDAP and updated automatically, keeping permissions current with organizational policy.
+- [Multifactor Authentication (MFA)](/administration-guide/onboard/multi-factor-authentication) [Enterprise] — TOTP-based second factor compatible with Google Authenticator, Microsoft Authenticator, and FreeOTP. Admins can enforce MFA across all users or delegate enforcement to the identity provider.
+- [Session Management](/administration-guide/configure/environment-configuration-settings#session-lengths) [Enterprise] — Controls session lifetimes and revokes sessions on inactivity or policy violation, limiting the window of exposure from stolen tokens.
+- [Custom Profile Attributes](/administration-guide/manage/admin/user-attributes) [Enterprise] — Admin-managed user metadata (clearance level, program affiliation, location, role) displayed on profiles and available for use in access policy definitions.
+- [Guest Accounts](/administration-guide/onboard/guest-accounts) [Enterprise] — External users receive scoped access limited to specific channels. Single-channel guests are free up to a 1:1 ratio with licensed seats. Guests cannot discover other channels or teams.
+- [Magic Link for Guests](/administration-guide/onboard/guest-accounts) [Enterprise] — Passwordless, expiring access links for external users eliminate shared credential risk. Links expire after 48 hours; guests can request a new link with the same email address.
+
+### Advanced: attribute-based and session-scoped access
+
+As organizations mature, role-based controls give way to attribute-based policies that adapt to the user's current context—not their role at the time they were provisioned.
+
+- [Advanced Access Controls](/administration-guide/manage/admin/attribute-based-access-control) [Enterprise Advanced] — Combines RBAC system and team override schemes with CEL-syntax Attribute-Based Access Control (ABAC) for complex, context-sensitive authorization decisions.
+- [ABAC for Team Admins](/administration-guide/manage/admin/abac-team-channel-policies) [Enterprise Advanced] — Channel membership policies are evaluated continuously against user attributes. As a user's profile changes (e.g., program affiliation, clearance level), they are automatically added to matching channels without admin intervention. On private channels, members who no longer match are removed. On public channels the policy is advisory — no one is removed, and matching channels are surfaced as recommendations.
+- [Team membership access policies](/administration-guide/manage/admin/abac-team-membership) [Enterprise Advanced] — From Mattermost v11.10, the same continuous evaluation applies at the team boundary. On private teams, users who no longer match are removed from the team and its channels; on public teams the policy is advisory and highlights the team to qualifying users.
+
+### Optimal: continuous, dynamic enforcement synchronized from ICAM
+
+At the highest maturity level, access is evaluated in real time against authoritative sources, and no trust is assumed to persist between sessions.
+
+- [Dynamic Attribute-Based Access Controls](/administration-guide/manage/admin/abac-system-wide-policies) [Enterprise Advanced] — Eliminates manual role management by enforcing access based on attributes synchronized from multiple authoritative sources. Policies evaluate clearance level, program affiliation, device type, and network location dynamically.
+- [User Authoritative Source Interface](/administration-guide/manage/admin/attribute-based-access-control) [Enterprise Advanced] — For government organizations using a secure User Authoritative Source system, this interface queries individual clearances on demand rather than storing them locally. Clearances are evaluated at access time for real-time Zero Trust policy enforcement.
+
+## Devices
+
+Zero Trust requires that device health be a factor in every access decision. Mattermost's mobile and endpoint security features ensure that only compliant, uncompromised devices can reach sensitive data.
+
+### Foundation: managed device deployment
+
+- [Enterprise Mobility Management (AppConfig)](/deployment-guide/mobile/deploy-mobile-apps-using-emm-provider) [Enterprise] — Deploy the Mattermost mobile app via any EMM provider using the AppConfig standard. Pre-configure server URLs, authentication settings, and data protection policies including AppTunnel, app-level encryption, and backup prevention—without requiring full device enrollment.
+- [Private Mobility with ID-Only Push Notifications](/deployment-guide/mobile/host-your-own-push-proxy-service) [Enterprise] — Replaces notification text with an opaque message ID. The mobile app retrieves the full notification content directly from your Mattermost server over an encrypted connection. Apple and Google notification infrastructure never sees message content.
+
+### Advanced: device posture enforcement
+
+- [Mobile Biometrics](/security-guide/mobile-security#biometric-authentication) [Enterprise Advanced] — Requires biometric authentication (Face ID or fingerprint) via the device OS at each app launch. Administrators can enforce this requirement, adding a hardware-anchored second factor that cannot be bypassed at the software level.
+- [Intune MAM for iOS](/deployment-guide/mobile/configure-microsoft-intune-mam) [Enterprise Advanced] — Applies Microsoft Intune App Protection Policies to the Mattermost iOS app with identity-based controls, without requiring full device enrollment. Prevents data leakage between work and personal apps.
+
+### Optimal: real-time device integrity verification
+
+- [Mobile Jailbreak / Root Detection](/security-guide/mobile-security#jailbreak-and-root-detection) [Enterprise Advanced] — Detects jailbroken iOS and rooted Android devices at runtime and blocks access automatically. Access from tampered devices is denied regardless of valid credentials.
+- [Mobile Data-at-Rest Encryption](/deployment-guide/mobile/mobile-security-features#mobile-data-isolation) [Enterprise Advanced] — Mandatory OS-level encryption using Apple iOS and Android native security architecture. Data is confined to the app's private sandboxed storage container. Users cannot disable this protection.
+- [Mobile Screenshot Prevention](/security-guide/mobile-security#screenshot-and-screen-recording-prevention) [Enterprise Advanced] — Blocks screenshots and screen recordings on the Mattermost mobile app. Enforceable by administrators via mobile security policies.
+- [Secure File Viewer (Mobile)](/deployment-guide/mobile/secure-mobile-file-storage) [Enterprise Advanced] — Allows users to view PDFs, images, and videos without downloading files to the device. Sensitive and classified documents remain under organizational control at all times.
+
+## Networks
+
+Zero Trust treats every network as hostile. Mattermost supports deployment models that eliminate implicit trust in network location—from air-gapped installations to federated cross-organizational connectivity over hardened channels.
+
+### Foundation: self-hosted and encrypted transport
+
+- [Self-Hosting Mattermost](/deployment-guide/deployment-guide-index) [Enterprise] — Complete data sovereignty with no dependence on public cloud infrastructure. Administrators retain full control over network placement, access controls, and configuration.
+- [Transport Layer Security (TLS)](/deployment-guide/encryption-options#encryption-in-transit) [Enterprise] — All data in transit is encrypted. TLS configuration is documented for both direct server deployments and NGINX proxy deployments.
+- [Cloud IP Filtering](/administration-guide/manage/cloud-ip-filtering) [Enterprise] — Restricts platform access to trusted network ranges for cloud deployments, ensuring every inbound connection is evaluated against an allowlist.
+
+### Advanced: resilient, distributed, and isolated deployment
+
+- [High Availability Cluster-Based Deployment](/deployment-guide/server/high-availability-cluster-based-deployment) [Enterprise] — Multiple redundant application servers, database servers, and load balancers ensure no single point of failure. Supports inter-node state synchronization and HA for WebSocket connections.
+- [Horizontal Scalability Architecture](/deployment-guide/scale/scaling-for-enterprise) [Enterprise] — Stateless application nodes scale horizontally. Reference architectures support 5K, 10K, 25K, and 50K+ concurrent users. Load balancer distributes traffic across nodes transparently.
+- [Supported Kubernetes Deployment](/deployment-guide/server/deploy-kubernetes) [Enterprise] — Production deployments on EKS, AKS, GKE, and DigitalOcean Kubernetes using the Mattermost Kubernetes Operator and Helm. Enables declarative, auditable infrastructure configuration.
+- [Air-Gapped & DDIL/CDO-L Environments](/deployment-guide/deployment-scenarios/air-gapped-deployment) [Enterprise] — Offline installation packages, private container registries, and Kubernetes-based orchestration for fully disconnected or intermittent-connectivity environments. Integrates with on-premises LDAP, PostgreSQL, and Elasticsearch with no internet dependency.
+- [Air-Gapped Deployment](/deployment-guide/deployment-scenarios/air-gapped-deployment) [Enterprise] — Engineered for Amazon GovCloud, Azure Government Cloud (including IL5), and Oracle AGC. Supports classified government networks and U.S. federal defense agency requirements.
+- [Offline Operation and Smart Resync](/deployment-guide/deployment-scenarios/deploy-ddil-operations) [Enterprise] — Local collaboration continues when network connectivity is unavailable. All messages and updates are automatically synchronized once connectivity is restored, with zero data loss.
+- [Shared Channels (Federated)](/administration-guide/onboard/connected-workspaces) [Enterprise] — Real-time message and file synchronization across separate Mattermost servers over HTTPS/VPN. Enables controlled inter-organizational information flow without merging identity namespaces.
+- [Federated Communications](/administration-guide/onboard/connected-workspaces) [Enterprise] — Cross-organizational workflows via connected workspaces and Matrix/XMPP bridge support for legacy system integration.
+
+### Optimal: micro-segmented access with dynamic policy enforcement
+
+- [Zero Trust Channel Access](/administration-guide/manage/admin/abac-channel-access-rules) [Enterprise Advanced] — Administrators configure channel-level access policies using Common Expression Language (CEL) or a graphical interface. Access decisions evaluate credentials, clearances, device posture, network attributes, and environmental data at entry time.
+- [Mission Partner Environments](/deployment-guide/deployment-scenarios/deploy-mission-partner) [Enterprise Advanced] — Designed for multi-national and multi-domain operations. External partner users receive guest accounts with least-privilege access. DMZ deployment topology supports external federation with defense-in-depth architecture.
+- [Ultra-High Resiliency](/deployment-guide/scale/scale-to-200000-users) [Enterprise Advanced] — Supports up to 200,000 concurrent users via high-availability cluster architecture with dedicated Redis write-through caching and zero-downtime upgrades. Designed for operational continuity in DDIL and mission partner environments.
+- [DDIL Microsoft Teams App](/integrations-guide/mattermost-mission-collaboration-for-m365) [Enterprise] — When Microsoft Teams is inaccessible in a DDIL environment, the embedded Mattermost experience within Teams and Outlook clients maintains workflow continuity independently.
+
+## Applications and Workloads
+
+Zero Trust requires that applications verify every request, integrate security testing into their lifecycle, and enforce controls at the application layer rather than relying on network perimeter protections.
+
+### Foundation: access-controlled applications and integrations
+
+- [Advanced Permissions Infrastructure](/administration-guide/onboard/advanced-permissions-backend-infrastructure) [Enterprise] — System-wide and team-override permission schemes control create, read, update, and delete capabilities per resource type. Channel-level controls restrict posting, reactions, and member management independently.
+- [ABAC for File Permissions](/administration-guide/manage/admin/attribute-based-access-control) [Enterprise Advanced] — Granular rules governing whether a user can upload or download files based on their user and channel attributes. Enforces data handling policies at the application layer without relying on file system permissions.
+- [Anonymous ID-Based URLs](/administration-guide/configure/site-configuration-settings) [Enterprise] — Team and channel URLs use random identifiers, preventing team and channel names from being enumerated via shared links.
+- [Agent Control Plane](/administration-guide/configure/agents-admin-guide) [Enterprise] — Security boundaries for AI integration defined by user and channel. Tool integrations are restricted to direct messages by default. Explicit user approval is required before any AI agent executes an action.
+- [Tool Policy Editor](/administration-guide/configure/agents-admin-guide) [Enterprise] — Admins configure which AI tools require approval based on context (DM vs. channel) and can disable specific tools entirely. Provides centralized, auditable control over AI-assisted workflows.
+
+### Advanced: automated, monitored, and security-tested workflows
+
+- [Collaborative Playbooks](/end-user-guide/workflow-automation/work-with-playbooks) [Enterprise] — Structured, automated workflows with configurable task checklists, trigger conditions, and approval gates. Provides a complete audit log of all user actions within each playbook run.
+- [Conditional Workflows](/end-user-guide/workflow-automation/work-with-tasks) [Enterprise] — Tasks are conditionally included based on attribute values and runtime conditions (e.g., severity, category, ticket ID). Consolidates compliance documentation into a single workflow run with full audit trail.
+- [STIG-Hardened Image](/deployment-guide/server/deploy-containers) [Enterprise] — DISA-approved STIG-hardened configuration per DoD Security Technical Implementation Guide standards. Rigorous vulnerability scanning of base images. Required for DoD Information Assurance and IA-enabled systems.
+- [FIPS 140-3 Compliant](/deployment-guide/server/containers/fips-stig) [Enterprise] — FIPS 140-3 validated cryptographic algorithms and modules. Available in a FIPS-validated container image for FedRAMP and NIST 800-53 compliance. Enforced at both build time and runtime.
+- [CyberSecurity Toolchain Integrations](/use-case-guide/integrated-security-operations) [Enterprise] — Native integrations with Microsoft Sentinel, Defender, Entra ID, and Intune for real-time, out-of-band security collaboration. Deployable to segregated networks for SOC and red team operations.
+- [Performance Monitoring](/administration-guide/scale/deploy-prometheus-grafana-for-performance-monitoring) [Enterprise] — Prometheus collects CPU, request latency, goroutine, and connection metrics. Pre-built Grafana dashboards for application, cluster, job server, and system-level visibility. Enables detection of anomalous behavior patterns in production environments.
+- [Advanced Logging](/administration-guide/manage/logging) [Enterprise] — Error, panic, debug, trace, and conditional logging to Syslog and TCP destinations. Grafana Loki integration for centralized log aggregation across all servers. Supports compliance-grade audit requirements.
+
+### Optimal: classified information controls and immutable workloads
+
+- [Classified and Sensitive Information Control](/administration-guide/manage/admin/content-flagging) [Enterprise Advanced] — Program-specific information labelling for channels. Visibility time limits on messages. Content flagging and moderation for spillage mitigation. Aligned with FIPS 140-3 and STIG-hardened deployment requirements.
+- [Channel Banners](/end-user-guide/collaborate/display-channel-banners) [Enterprise Advanced] — Customizable per-channel classification notices with Markdown styling. Ensures users are continuously reminded of data handling requirements for sensitive, classified, or CUI channels, consistent with U.S. government notification mandates.
+- [Critical Infrastructure Hardening](/deployment-guide/server/containers/fips-stig) [Enterprise Advanced] — Combines FIPS 140-3 validated cryptography with STIG-hardened Chainguard base images for Docker and Kubernetes deployments. Rigorously scanned against DoD security standards.
+
+## Data
+
+Zero Trust treats data protection as a continuous obligation—not a perimeter defense. Mattermost provides controls across the full data lifecycle: classification, retention, export, recovery, and cryptographic protection.
+
+### Foundation: encryption and basic inventory
+
+- [Database Encryption](/deployment-guide/encryption-options#encryption-at-rest) [Enterprise] — Protects user and organizational data at rest. Encryption configuration options are documented for PostgreSQL deployments.
+- [Channel Export](/administration-guide/comply/export-mattermost-channel-data) [Enterprise] — Exports channel message data to CSV. Restricted to system, team, and channel admins. Provides an initial mechanism for data inventory and auditability.
+- [Custom End-User Terms of Service](/administration-guide/comply/custom-terms-of-service) [Enterprise] — Enforces acceptance of organization-specific terms before platform access. Configurable re-acceptance periods ensure terms remain current and users are regularly reminded of data handling obligations.
+
+### Advanced: governed retention, eDiscovery, and sovereign AI
+
+- [Data Retention Policies](/administration-guide/comply/data-retention-policy) [Enterprise] — Granular retention controls at the team and channel level. Reduces the data footprint available for exploitation. Supports compliance with data minimization requirements under GDPR, HIPAA, and other frameworks.
+- [Legal Hold](/administration-guide/comply/legal-hold) [Enterprise] — Preserves all electronically stored information (ESI) for specified users and durations in anticipation of legal action. Can be combined with eDiscovery integration and retention policies for customized compliance posture.
+- [Compliance Export and eDiscovery](/administration-guide/comply/compliance-export) [Enterprise] — Export to Actiance XML, Global Relay EML, or generic CSV. Reconstructs channel state and determines message visibility history. Supports Smarsh, Actiance Vantage, and Proofpoint integrations.
+- [Compliance Monitoring](/administration-guide/comply/compliance-monitoring) [Enterprise] — Ongoing visibility into adherence to security and compliance policies.
+- [Sovereign AI](/agents/docs/sovereign_ai) [Enterprise] — Fully self-hosted LLM integration with pgvector for semantic search. Complete organizational control over AI data processing and infrastructure. Compatible with air-gapped and disconnected environments; no data leaves the organization's control.
+- [Advanced Logging](/administration-guide/manage/logging) [Enterprise] — Trace-level audit logs to Syslog and TCP targets. Enables compliance with stringent operational and security audit standards across multi-server deployments.
+
+### Optimal: classified data controls, spillage handling, and cryptographic enforcement
+
+- [Data Spillage Handling](/administration-guide/manage/admin/content-flagging) [Enterprise Advanced] — Any user can flag potentially sensitive content, and designated reviewers are notified with context. Depending on the configured workflow, flagged content can be hidden while under review. After review, content can be retained or permanently deleted.
+- [Burn-on-Read Messages](/administration-guide/configure/site-configuration-settings#enable-burn-on-read-messages) [Enterprise Advanced] — Messages are concealed until recipients reveal them and are automatically deleted after a configurable timer expires. Deletion is permanent and prevents recovery. Senders can track read status and delete for all recipients before expiration.
+- [FIPS 140-3 Compliant](/deployment-guide/server/containers/fips-stig) [Enterprise] — FIPS 140-3 validated cryptographic modules used throughout the product for all cryptographic operations. Satisfies NIST 800-53 standards for agencies processing sensitive, classified, or regulated data.
+- [Mobile Data-at-Rest Encryption](/deployment-guide/mobile/mobile-security-features#mobile-data-isolation) [Enterprise Advanced] — Mandatory OS-level encryption on iOS and Android. Data stored in the app's private container cannot be accessed outside the sandboxed environment, even on a lost or stolen device.
+
+## Progressing through Zero Trust maturity
+
+No organization starts at Optimal maturity, and no single product delivers Zero Trust in isolation. Mattermost is designed to meet organizations at their current maturity level and provide a concrete capability path forward.
+
+<table>
+<thead>
+<tr>
+<th>Maturity Level</th>
+<th>What Mattermost enables</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>Traditional</td>
+<td>MFA, SSO, guest accounts, role-based access, basic audit logging, and TLS encryption. A secure collaboration baseline without implicit perimeter trust.</td>
+</tr>
+<tr>
+<td>Initial</td>
+<td>AD/LDAP sync, RBAC with team override schemes, EMM mobile deployment, air-gapped and Kubernetes deployment, advanced logging, and compliance export. Automated access lifecycle with formal integration into security operations.</td>
+</tr>
+<tr>
+<td>Advanced</td>
+<td>ABAC with CEL syntax, HA cluster deployment, FIPS 140-3, STIG-hardened images, sovereign AI, legal hold, playbook-driven incident response, biometric mobile authentication, and federated cross-org channels. Context-aware access with security testing integrated throughout the deployment lifecycle.</td>
+</tr>
+<tr>
+<td>Optimal</td>
+<td>Dynamic ABAC with ICAM sync, Zero Trust channel access policies, User Authoritative Source integration, data spillage handling, burn-on-read messages, classified channel controls, and full mobile security hardening. Continuous, attribute-driven enforcement with no implicit trust at any layer.</td>
+</tr>
+</tbody>
+</table>
+
+## Related resources
+
+- [Set up attribute-based access controls](/administration-guide/manage/admin/attribute-based-access-control)
+- [Mobile security features](/deployment-guide/mobile/mobile-security-features)
+- [Air-gapped deployment](/deployment-guide/deployment-scenarios/air-gapped-deployment)
+- [Compliance export](/administration-guide/comply/compliance-export)
+- [FIPS 140-3 and encryption options](/deployment-guide/server/containers/fips-stig)
+- [STIG-hardened image and DoD IA standards](/deployment-guide/server/deploy-containers)
+- [High availability cluster deployment](/deployment-guide/server/high-availability-cluster-based-deployment)
+- [Sovereign AI implementation](/agents/docs/sovereign_ai)
+- [Content flagging and data spillage](/administration-guide/manage/admin/content-flagging)
+- [CMMC Compliance](/security-guide/cmmc-compliance)
+- [Mobile Security](/security-guide/mobile-security)
+
+To explore how Mattermost can support your organization's Zero Trust strategy, [contact a Mattermost Zero Trust Expert](https://mattermost.com/contact-sales/).