240db4e2a7
Some checks failed
Server CI / Postgres (shard 0) (push) Has been skipped
Server CI / Postgres (shard 3) (push) Has been skipped
BuildEnv Docker Image / build-image (push) Failing after 4s
BuildEnv Docker Image / build-image-fips (push) Failing after 4s
Migration Review & Release Notes / Generate migration review & release notes (push) Failing after 3s
Server CI / Build Environment (push) Failing after 3s
Server CI / Postgres (shard 1) (push) Has been skipped
Tools CI / check-style (mattermost-govet) (push) Failing after 4s
Server CI / Postgres (shard 2) (push) Has been skipped
Tools CI / check-style (mmgotool) (push) Failing after 3s
Server CI / Elasticsearch v8 Compatibility (push) Has been skipped
Server CI / OpenSearch v2 Compatibility (push) Has been skipped
Server CI / Postgres FIPS (shard 0) (push) Has been skipped
Tools CI / Test (mattermost-govet) (push) Failing after 3s
Server CI / Postgres FIPS (shard 1) (push) Has been skipped
Server CI / Postgres FIPS (shard 2) (push) Has been skipped
Tools CI / Test (mmgotool) (push) Failing after 3s
Server CI / Postgres FIPS (shard 3) (push) Has been skipped
Server CI / Run mmctl tests (push) Has been skipped
Server CI / Run mmctl tests (FIPS) (push) Has been skipped
Server CI / Merge Postgres Test Results (push) Has been skipped
Server CI / Merge Postgres FIPS Test Results (push) Has been skipped
Server CI / Check backport migrations (push) Has been skipped
Server CI / Check generated files (push) Has been skipped
Server CI / check-style (push) Has been skipped
Server CI / Vet API (push) Has been skipped
Server CI / Build mattermost server app (push) Has been skipped
Server CI / Server CI Complete (push) Failing after 2s
Server CI / Server CI Artifacts (push) Has been skipped
Server CI / Sentry Upload (push) Has been skipped
Server CI / Server CI Report (push) Failing after 5m1s
Server CI Nightly Race / Race Detector (push) Has been skipped
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Webapp CI Cache Warm / Warm Webapp node_modules Cache (push) Has been cancelled
E2E CI Cache Warm / Warm E2E npm Registry Cache (push) Has been cancelled
API / build (push) Has been cancelled
Web App CI / check-types (push) Has been cancelled
Web App CI / check-lint (push) Has been cancelled
Web App CI / check-i18n (push) Has been cancelled
Web App CI / check-external-links (push) Has been cancelled
Web App CI / test (platform) (push) Has been cancelled
Web App CI / test (mattermost-redux) (push) Has been cancelled
Web App CI / test (channels shard 1/4) (push) Has been cancelled
Web App CI / test (channels shard 2/4) (push) Has been cancelled
Web App CI / test (channels shard 3/4) (push) Has been cancelled
Web App CI / test (channels shard 4/4) (push) Has been cancelled
Web App CI / upload-coverage (push) Has been cancelled
Web App CI / build (push) Has been cancelled
YAML Lint / yamllint (push) Has been cancelled
Push mirrored docker images / cd/Push mirrored docker images (push) Has been cancelled
docs-cd / Build and deploy docs (push) Has been cancelled
Docs CI / build (push) Has been cancelled
E2E Cache Warm: Cypress deps / Warm Cypress deps cache (push) Has been cancelled
Scorecards supply-chain security / Scorecard analysis (push) Has been cancelled
Server CI Weekly / Postgres FIPS (push) Has been skipped
Server CI Weekly / Run mmctl tests (FIPS) (push) Has been skipped
Server CI Weekly / Postgres with binary parameters (push) Has been skipped
Server CI Weekly / Build Environment (push) Failing after 1s
Server CI Nightly Race / Build Environment (push) Failing after 1s
Server CI Cache Warm / Warm Go Module and Build Cache (push) Failing after 2s
85 lines
6.1 KiB
Plaintext
85 lines
6.1 KiB
Plaintext
---
|
|
title: "Cloud Dedicated"
|
|
---
|
|
import Inc0_cloud_supported_integrations from './cloud-supported-integrations.mdx';
|
|
|
|
Mattermost Cloud Dedicated is designed for larger organizations with higher demands for performance, scalability, customizability, and compliance looking to offload operational overhead and focus on more business-critical tasks.
|
|
|
|
Your own private Mattermost instance running [Mattermost Enterprise](/product-overview/editions-and-offerings) is a Kubernetes cluster hosted and managed by Mattermost that runs on dedicated cloud infrastructure, where resources are exclusively available for your organization.
|
|
|
|
## Reference architecture
|
|
|
|
|
|
|
|
## Available features
|
|
|
|
### Zero-downtime upgrades
|
|
|
|
Mattermost releases biweekly updates and leverages recurring maintenance windows to keep your instance up-to-date with new stable or beta features behind feature flags, fix security issues, and ensure the overall reliability and performance of your environment. Maintenance windows are announced in advance on [https://status.mattermost.com/](https://status.mattermost.com/)
|
|
|
|
Additional support options, including quicker response times, dedicated support personnel, and stronger service level agreements (SLAs), are also available.
|
|
|
|
### Disaster Recovery
|
|
|
|
Mattermost Cloud Dedicated supports data failover to a secondary region/site should the primary instance experiences an unrecoverable outage with guaranteed recovery times.
|
|
|
|
Mattermost supports a **multi-AZ (availability zones)** strategy in the same site/region.
|
|
|
|
Daily backups of the database, object storage, and high availability clusters are captured and retained for 30 days.
|
|
|
|
In addition, highly available observability tools with automated alerting, long-term metrics, and logs retention are retained for a duration of 1 year, or longer, if requred.
|
|
|
|
### Security
|
|
|
|
You have access to all the resources required to run the Mattermost application with the highest security standards, including data encryption at rest and in transit.
|
|
|
|
Your pre-configured cluster is secure by default, based on industry best practices including Data encryption at rest and in transit, TLS certificates life cycle management, and automatic security updates.
|
|
|
|
Mattermost maintains control over network and security policies, including [encryption](#encryption), database, data, object storage, backup schedules, and compliance certifications.
|
|
|
|
### Authentication and authorization
|
|
|
|
Mattermost offers advanced security and authentication options for integrating with corporate directories, including [Active Directory/LDAP](/administration-guide/onboard/ad-ldap), [Okta](/administration-guide/onboard/sso-saml-okta), [OneLogin](/administration-guide/onboard/sso-saml-onelogin), [SAML](/administration-guide/onboard/sso-saml), [Google](/administration-guide/onboard/sso-google), [EntraID](/administration-guide/onboard/sso-entraid), and [OpenID](/administration-guide/onboard/sso-openidconnect).
|
|
|
|
### Secure networking
|
|
|
|
Mattermost Cloud Dedicated supports [IP filtering](/administration-guide/manage/cloud-ip-filtering) through CIDR-based IP ranges, providing flexibility for system administrators to include various authorized IPs or IP ranges for seamless access control. Users attempting to access their [workspace](/end-user-guide/end-user-guide-index) from IPs outside defined ranges are restricted from entry. Cloud system admins can [configure IP filtering](/administration-guide/manage/cloud-ip-filtering#configure-ip-filtering) through their Mattermost System Console.
|
|
|
|
### Encryption
|
|
|
|
Mattermost provides encryption-in-transit and encryption-at-rest capabilities. Mattermost supports [TLS encryption](/deployment-guide/server/setup-tls), including AES-256 with 2048-bit RSA on all data transmissions, between Mattermost client applications and the Mattermost server. You may either set up TLS on the Mattermost Server or [install a proxy such as NGINX](/deployment-guide/server/setup-nginx-proxy), and set up TLS on the proxy.
|
|
|
|
Connections to [Active Directory/LDAP](/administration-guide/onboard/ad-ldap) can [optionally be secured with TLS or stunnel](/administration-guide/configure/authentication-configuration-settings#adldap-port).
|
|
|
|
Connections to calls are secured with a combination of:
|
|
|
|
- TLS: The existing WebSocket channel is used to secure the signaling path.
|
|
- DTLS v1.2 (mandatory): Used for initial key exchange. Supports `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` and `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA` algorithms.
|
|
- SRTP (mandatory): Used to encrypt all media packets (i.e. those containing voice or screen share). Supports `AEAD_AES_128_GCM` and `AES128_CM_HMAC_SHA1_80` algorithms.
|
|
|
|
### Cloud native exports
|
|
|
|
Mattermost supports optional [filestore configuration settings](/administration-guide/configure/environment-configuration-settings#enable-dedicated-export-filestore-target) to direct compliance and bulk export data to a separate S3 bucket from standard files. This separate bucket can be configured to allow for secure access by Mattermost Cloud teams as well as admins who manage a given Mattermost deployment. The exports can also be accessed by generating unique download links as needed.
|
|
|
|
The following diagram provides a high-level view of how this functionality works:
|
|
|
|
|
|
|
|
### SMTP
|
|
|
|
Email sent from Mattermost Cloud Dedicated uses SendGrid, and the connection to SendGrid is encrypted.
|
|
|
|
### Audit and observability
|
|
|
|
Mattermost Cloud Dedicated provides access to [audit and system logs](/administration-guide/manage/logging) generated by the application.
|
|
|
|
### Customization
|
|
|
|
The following Mattermost plugins are available for cloud-based deployments:
|
|
|
|
<Inc0_cloud_supported_integrations />
|
|
|
|
## Migrate from a self-hosted instance
|
|
|
|
See our [self-hosted to cloud migration](/administration-guide/manage/cloud-data-export#migrate-from-self-hosted-to-cloud) documentation to learn more about migrating from a self-hosted to a Mattermost Cloud instance.
|