When a deployed team changes networks, brings a coalition partner into an operation or removes a compromised device, its communications arrangements have to adapt. Operators still need to share updates and coordinate activity, while those responsible for security need confidence that the devices, connections and information involved remain under control. Maintaining that trust requires the communications infrastructure and operational workflows to work together.

Mattermost v12 and Arqit’s SKA-Platform combine quantum-safe key management with sovereign collaboration for defence operations. Arqit provides trust at the device and network layer; Mattermost provides messaging, file sharing and mission integrations governed by application-level access controls. Together, they bring a deployable communications capability into infrastructure the customer controls, including air-gapped environments.

Quantum-safe trust meets sovereign collaboration

Mattermost v12 brings stronger data controls, cross-domain information sharing, and AI-ready workflows to mission-critical collaboration. Its ecosystem approach allows specialist partner capabilities to operate within the customer’s infrastructure, alongside the people, information and workflows they support. The customer retains control over where the environment runs, how systems connect and how sensitive data is handled.

The Arqit partnership addresses two distinct questions within that environment: is a device trusted to communicate, and is a user authorised to access the information? Cryptographic device authentication and policy-based application access provide complementary controls. Valid user credentials alone do not establish that a device should participate in a protected communications environment. Equally, a trusted connection does not determine which operational conversations a user should be able to access.

As Paul Feenan, General Manager for Defence & Government at Arqit, said in the launch announcement: “Trust in a protected channel starts with trust in the device.”

Securing communications at the deployed edge

Arqit’s SKA-Platform provides quantum-safe symmetric key management on commodity Linux hardware. It uses forward-rotating symmetric keys for session protection, without requiring teams to pre-position key material or use hardware tokens. The joint architecture supports hosting Arqit and Mattermost on a single commodity Linux server, providing a compact deployment option for environments where size, weight and power matter.

The architecture is also transport-independent, supporting communications over Wi-Fi, 5G, mobile ad hoc networks (MANET), satellite communications and commercial networks. This allows the collaboration environment to operate over the network bearer Arqit secures, rather than tying it to one form of connectivity.

For denied, degraded, intermittent and limited (DDIL) conditions, Arqit’s key management supports reconstitution as bearers change or fail. Mattermost contributes high-availability architecture and federated communications capabilities. The deployment design should bring those capabilities together around the mission’s connectivity and resilience requirements, rather than assume that one configuration will suit every operating environment.

Extending zero trust from the network to the application

Arqit’s dynamic security groups support device quarantine and group reformation at the encryption layer. Mattermost channels can be associated with distinct Arqit key groups, allowing operational channels to align with encryption-layer separation without requiring individual users to manage cryptographic identities. Mattermost separately enforces application-level controls over access to the collaboration environment.

Mattermost v12 gives those application policies more context. Environmental attributes allow access decisions to consider device identity, network context and device posture for each session, with signals refreshed continuously. Hierarchical attributes support rules based on clearance or organisational structure, while smart markings bring classification and handling context into channel policies. Access decisions are recorded for oversight. This allows policies to distinguish between different sessions belonging to the same user, rather than treating every connection as equivalent.

These controls provide defence-in-depth: Arqit governs participation in the trusted communications environment, while Mattermost governs access to channels within that environment. Each addresses a different part of the security requirement, reducing reliance on a single layer of protection.

From security events to operational action

Security events need to reach the people coordinating the mission, as well as those administering the infrastructure. Mattermost’s webhooks and REST APIs enable integration with the Arqit SKA-Platform console, allowing device quarantine, key rotation and enrolment events to appear as automated notifications in the appropriate channel.

Consider an illustrative deployment in which a device is reported lost during a coalition exercise. Arqit can quarantine the device and reform its security group to exclude it. Mattermost continues to apply its own access policies, while an integrated quarantine notification brings the event into the operational channel. The watch officer can then use that workspace to establish the impact, agree next steps and keep participating teams informed. The technical controls and the operational response remain distinct, but the people responsible for acting have shared context.

Supporting secure coalition operations

Coalition collaboration requires a way to share information without treating participation in the same mission as permission to access every conversation. Arqit manages trust-group membership dynamically and supports need-to-share policies at the encryption layer. Mattermost contributes the mission partner environment and channel translation capabilities that help authorised teams coordinate across organisational and language boundaries.

As those organisational boundaries become critical, Mattermost’s Cross Guard plugin allows federated channel messaging with trusted organizations and partners through the customer’s accredited cross-domain solution. It does not replace that infrastructure or the accreditation behind it. The distinction matters: device and network trust, application access and authorised cross-domain transfer each have a role, and none should be presented as a substitute for the others.

An ecosystem designed for mission-critical environments

The broader v12 release brings data-centric security, cross-domain coordination and sovereign agent workflows into customer-controlled environments. Arqit contributes a focused capability within that ecosystem: quantum-safe key management and device-level trust for protected communications. Its role complements Mattermost’s collaboration and access controls, rather than replacing them or changing who governs the environment.

For defence organisations, the value lies in bringing those capabilities together around their own operational requirements. Teams can combine sovereign messaging, file sharing, burn-on-read messages and mission integrations with network-level trust controls, while retaining ownership of the deployment. That provides a practical foundation for coordinating operations across changing devices, participants and network conditions.

Explore quantum-safe collaboration for your mission. Speak with Mattermost’s forward-deployed engineers about your deployment requirements and how Mattermost v12 and Arqit can fit into your existing operational environment.

Frequently asked questions

Can Mattermost and Arqit operate in air-gapped environments?

Yes. The joint solution is designed for sovereign, air-gapped deployment without a cloud dependency. Mattermost provides self-hosted collaboration, while Arqit supplies the quantum-safe trust capability. The customer retains ownership of the environment, with the deployment configured around its security and operational requirements.

How does the joint solution support zero-trust security?

Arqit provides network-level controls through dynamic key groups and device quarantine. Mattermost applies application-level controls through attribute-based access control and data-spillage handling. Mattermost channels can also be associated with distinct Arqit key groups, providing complementary protection at the communications and collaboration layers.

What infrastructure is required to deploy Mattermost and Arqit?

The joint architecture supports commodity Linux hardware, including a configuration that hosts both products on a single server. Infrastructure sizing, availability and integration requirements should be agreed for the intended deployment; a compact edge node and a high-availability environment have different design objectives.

How does the solution support communications in DDIL environments?

Arqit’s bearer-agnostic key management supports reconstitution as network bearers change or fail. Mattermost contributes high-availability architecture and federated communications capabilities. These support deployment planning for DDIL conditions, with the recovery behaviour and connectivity constraints validated against the mission’s operating environment.