Mattermost licenses are sold as prepaid annual subscriptions based on the number of annual seat licenses purchased, or "seats". Each seat license purchased entitles a customer to an "activated user", which is a user registered on a specific Mattermost server and not deactivated. Administrators can view user status in the System Console and activate and deactivate registered users at any time. Deactivated users have history and preferences saved.
Plans to accelerate your mission-critical work
Professional
Teams and departments. Sovereign collaboration for teams. For engineering, security, and operations teams that need collaboration on their own infrastructure, with their own identity stack and their own LLM.
- Self-hosted: your data stays on your infrastructure
- SSO (SAML, OIDC, OAuth) with MFA and AD/LDAP sync
- Bring-your-own multi-LLM; no data sent externally
- Multiplayer tool calling under your permissions
- Channel controls: read-only, restricted, locked
- DevSecOps integrations: Jira, GitHub, and GitLab
- Self-hosted group audio calls and screen sharing
- Guest accounts, custom user groups, and 20 languages
- Professional support, next business day response
- Up to 250 users.
Enterprise
Regulated enterprise and critical infrastructure. Secure collaborative workflows and agentic automation. For critical infrastructure and regulated enterprises that need automated response, audit-ready records, and agents that never leave their network.
Everything in Professional, plus:
- Playbooks with automated triggers, agent retrospectives
- Sovereign agents: creation, MCP, and tool controls
- Agent search, summarization, channel briefing
- Enterprise LLM management, per-user token tracking
- Out-of-band channel when primary comms go down
- Calls with live transcription and agent summaries
- Federated channels with Teams and Matrix interop
- Granular RBAC and AD/LDAP group, team, and channel sync
- Data retention, legal hold, compliance export
- FIPS 140-3 validated and STIG-hardened images
- HA cluster to 50,000 users with Enterprise Search
- 24×7 enterprise support, 4-hour response target
- Supports compliance programs including ISO 27001, SOC 2, GDPR, NIS2, and DORA.
Enterprise Advanced
National security. Multi-domain operations in contested and classified environments. For national security organizations, defense industrial base, and allied militaries operating across classified, air-gapped, and contested networks.
Everything in Enterprise, plus:
- Dynamic ABAC: clearance, program, device posture
- Classification banners and NATO program masking
- Burn-on-read and cross-classification spillage
- Air-gapped deployment with offline and DDIL ops
- Sovereign enclave: models and agents, no egress
- Secure mobility: biometrics, encryption, ephemeral
- Microsoft Intune MAM for government and BYOD devices
- Mission partners: translation and anonymous URLs
- Scale to 200,000 concurrent users per deployment
- Channel Attributes: attribute-driven classification banners
- LLM model fallback when a primary endpoint fails
- Optional add-on: Cross Guard CDS for cross-domain data transfer
- Optional add-on: Externally Managed Encryption, bring-your-own keys
View the full capability breakdown across plans
Swipe horizontally to compare plans
Tap a feature for details. Checks show plan availability.
Deployment and licensing
Self-hosted on your own infrastructure
Deploy Mattermost on your own servers—in your data center, private cloud, or air-gapped network—ensuring complete ownership and control over your data and infrastructure.
Air-gapped deployment
Mattermost is engineered for secure deployment in air-gapped and government cloud environments enabling mission-critical collaboration in disconnected or classified networks.
Offline operation and smart resync
Mattermost enables local collaboration during outages or in DDIL environments, then automatically syncs all messages and updates across servers once connectivity is restored—ensuring no data is lost and operations stay aligned.
Maximum licensed users
Professional: 250. Enterprise: Unlimited. Enterprise Advanced: Unlimited. The maximum number of licensed user seats available per deployment tier. Professional is capped at 250 users; Enterprise and Enterprise Advanced support unlimited seats.
Concurrent user scale
Professional: Single server. Enterprise: 50,000. Enterprise Advanced: 200,000. The number of users who can be simultaneously active. Enterprise scales to 50,000 concurrent users; Enterprise Advanced scales to 200,000 and beyond with dedicated caching.
Channel-based collaboration
Messaging, file sharing, and previews across web, desktop, iOS, and Android
Channels-based messaging including 1-1, group messaging, public and private channels, file sharing, link and media previews across web, PC, Mac, iOS, and Android devices.
Threaded discussions and thread inbox
Organize discussions within channels using threaded discussions and the thread inbox to follow-up on threaded discussions in addition to channels.
Message priority and persistent notifications
Elevate the focus of organizations with the ability to specify message priority as Standard, Important, or Urgent. Persistent Notifications ensure urgent messages remain visible until acknowledged or replied to.
Custom branding, themes, emoji, hashtags, channel categorization
Match your organization's look and brand by customizing the site name, login image, and theme colors. Hashtags and channel categorization keep discussions organized and discoverable.
Multi-window desktop and compact view
Open multiple chat windows simultaneously to keep priority conversations visible at all times. Compact view increases efficiency for technical teams.
Available in 20 languages
Multiple languages including English (US/AU), Bulgarian, Chinese (Simplified and Traditional), Dutch, French, German, Hungarian, Italian, Japanese, Korean, Persian, Polish, Portuguese (Brazil), Romanian, Russian, Spanish, Swedish, Turkish, Ukrainian, and Vietnamese.
Core search (up to 3 million posts)
Search over messages and files in Mattermost. Core search happens in a relational database and is intended for deployments under 3 million posts and file entries.
Enterprise Search beyond 3 million posts (Elasticsearch)
Enable enterprise-scale search after exceeding 3 million posts by deploying Elasticsearch with dedicated indexing and usage resourcing via cluster support.
Agentic Operations
Interactive agents with bring-your-own and multi-LLM integration
Agent-driven bots assist with workflows, provide real-time updates, and automate routine tasks. Supports multiple LLM service backends with unified management and observability of both private and commercial LLMs.
Multiplayer tool calling under the invoking user's permissions
Users can invoke agents within channels or group messages, delegating their own permissions to the agent for real-time collaborative workflows.
Summarization, composition, and real-time channel briefing
Agent-generated summaries of unreads and custom date ranges, contextual composition assistance, and real-time channel briefing that integrates live transcription, chat logs, and automated summaries.
Agent creation, sharing, and tool policy control
End users can create, update, delete, and share agents via a configuration UI. Admins have granular control over tool execution—configuring which tools require approval or disabling specific tools entirely.
Agent-enhanced search and sovereign agentic web search
Semantic search delivers context-aware answers across your workspace while respecting access controls. Sovereign web search adds real-time internet access inside your secure Mattermost environment with your sovereign LLM.
Universal connector with Model Context Protocol (MCP)
Model Context Protocol (MCP) empowers agents to securely search across enterprise systems and take action in real time—without leaving Mattermost. Agents can access external tools, knowledge, and workflows.
Enterprise LLM management with per-user token accounting
Assign LLM account authorizations at the user, group, or team level, and track LLM token usage at the user level for optimal performance and accountability.
Models and agents running inside an air-gapped enclave
Supports sovereign agentic deployment in air-gapped, private, or sovereign cloud environments, ensuring sensitive data remains under complete control while leveraging agents to streamline workflows.
LLM model fallback
Automatic failover across model endpoints to maintain agent availability when a primary model is unreachable or degraded.
Zero Trust security
Dynamic attribute-based access control (ABAC)
Dynamic and granular attribute-based access controls allow organizations to define custom attributes for users and resources, synchronizing them from various computing systems and data sources—the foundation of zero trust security.
Zero Trust channel access with CEL or GUI policy
Configure channels with policy enforcement using Common Expression Language (CEL) or a simple GUI, ensuring only users with the required credentials, clearances, and device or network attributes can enter.
Environmental attribute-based controls from network, endpoint, and ICAM tools
Extend ABAC policies with environmental inputs—network posture, endpoint compliance, and identity/credential management (ICAM) signals—to enforce real-time zero trust access decisions.
Team ABAC membership managed by team admins
Extend attribute-based access control to teams, not just channels. Team admins can set and manage their own membership policies without involving a system admin.
Native user attributes in ABAC policies
Write ABAC policies from day one using built-in attributes like email, account age, and user type—no custom integrations required.
Global Attributes
Define attributes once and apply them to users, channels, and posts across the system from a single Attribute Management console.
Hierarchical Attributes
Attribute values form a parent/child hierarchy; policies evaluate them with coversAll, coversAny, withinAll, and withinAny for clearance-level comparisons.
Environmental and session attributes
Policies evaluate session context -- IP address, user agent, device and network posture -- to enforce real-time, environment-aware access decisions.
ABAC audit logging
Records every ABAC access decision with full attribute context and policy version evaluated, satisfying DoD Zero Trust Mandatory Capability 7.1.
Classified and sensitive information control
Classification banners (ISOO, DoD, TLP, and custom schemes)
These banners ensure the classification or restrictions of a channel are clearly visible to users at all times. Includes preset schemes from ISOO, DoD/DoW, TLP, and supports customization according to local rules and policies.
Classification markings on mobile
Server- and channel-level classification banners appear in the mobile app, keeping sensitivity context visible across servers, channels, and threads.
Program masking
With Program Masking, administrators can only see sensitive attributes they have in common with the policy. All other sensitive attributes are hidden.
Burn-on-read messages
Set visibility time limits on messages and posts, ensuring they are removed from endpoints after a set time period. Minimizes risks to sensitive data such as one-time passwords or Social Security Numbers.
Data spillage handling
Enables any user to flag and report potential sensitive data. Flagged content is immediately hidden and a designated security team is notified with context about the potential exposure.
Smart Markings
Classification levels and global banner are managed on the Classification Markings page; channels require attributes on creation with banners built from those values.
Federation and interoperability
Federated shared channels across Mattermost servers
Enables real-time collaboration between users on different Mattermost servers, allowing organizations to securely connect and synchronize messages, emoji reactions, and file sharing.
Microsoft Teams messaging interoperability
Connect users across Microsoft Teams and Mattermost with integrated direct messaging bridging the two platforms, maintaining specialized environments for developers, security professionals, and operators.
Matrix protocol interoperability
Bidirectional real-time sync between Mattermost and any Matrix-connected platform, with full formatting, reactions, threads, and file attachments.
DDIL Microsoft Teams app for disconnected operation
In disconnected, degraded, intermittent, or limited (DDIL) environments, this integration ensures teams can continue secure collaboration and workflow execution independently—maintaining operational continuity even if Teams is inaccessible.
Coalition and mission partner federation
Designed for multi-national, distributed, and multi-domain operations, ensuring secure, real-time communication across allied forces and partner organizations, even in disconnected or classified environments.
Automatic channel translation
Automatic Channel Translations enhances real-time collaboration by translating conversations into each user's preferred language, reducing friction and improving clarity across multilingual teams.
Security-Optimized Mobility
Enterprise mobility management (AppConfig) support
Enhance mobile security by deploying with Enterprise Mobility Management (EMM) to secure mobile endpoints with management application configuration and Mattermost AppConfig compatibility.
ID-only push notifications
Protects against breaches in iOS and Android notification infrastructure by replacing notification text with an opaque message ID. The mobile app retrieves the full message directly from your Mattermost server—Apple and Google never see your content.
Mobile biometrics
Leverages hardware-level security through native biometric authentication (Face ID or fingerprint) to ensure only the authorized device owner can access Mattermost. Administrators can require biometric authentication on every access.
Mobile data-at-rest encryption
Uses the native OS security architecture to encrypt data-at-rest on mobile devices. Data resides within the app's private storage container, isolated by each platform's sandboxing model. Users cannot disable this protection.
Mobile ephemeral mode
Define a window for when a device is considered 'disconnected' and how long cached data persists on a disconnected device, mitigating data leakage on deprovisioned, lost, or stolen devices.
Screenshot and screen-recording prevention
Ensures that sensitive information remains secure by blocking screenshots and screen recordings on the Mattermost mobile app, protecting classified data from inadvertent or malicious capture.
Jailbreak and root detection
Ensures only secure, uncompromised devices can access Mattermost by detecting and blocking jailbroken or rooted devices that have been tampered with or are running non-standard operating systems.
Secure file viewer (view without download)
Allow PDF documents, videos and images to be viewed but not downloaded to the user's device, keeping sensitive or classified documents within the organization's control at all times.
Microsoft Intune MAM for iOS
Secure Mattermost app data with policy-based controls, prevent data leakage between personal and work apps, and enforce compliance without requiring full device enrollment.
Real-time communications
1:1 audio calls and screen sharing
Call another user to start a 1-1 audio discussion in web, desktop, and mobile experiences with optional screen sharing.
Self-hosted group audio calls and screen sharing
Streamline real-time collaboration with complete privacy by enabling group audio calling and screen share up to approximately 50 concurrent users per self-hosted server.
High-availability, horizontally scalable calls
Enable high-scale, high availability deployment of audio calling and screen share through dedicated servers managed on an integrated Kubernetes platform.
Calls with live transcription and agent summaries
Captures every spoken word in real time and automatically generates concise, agent-powered summaries—ensuring teams stay aligned and ready to act, even in high-pressure environments.
Video integrations (Pexip, Zoom, Microsoft Teams)
Elevate secure collaboration with Pexip, Zoom, and Microsoft Teams video integrations. Seamless video calls, screen sharing, and chat—right within your channels—fully under your command.
Workflow automation and work management
Channel checklists
Instantly create a simple checklist, then deploy into a complete organizational playbook in two clicks.
Collaborative playbooks with automated triggers
Collaborative playbooks provide structure, monitoring, and automation for repeatable, team-based processes. They enable seamless coordination ensuring efficient incident response, release management, and operational logistics.
Workflow dashboards and enhanced run reports
Workflow dashboards provide a centralized view of all ongoing playbooks, enabling teams to track progress and manage workflows. Enhanced run reports let you analyze playbook activities and export reports in PDF format.
Mobile playbooks
Bring the power of Mattermost Playbooks to your mobile device, enabling field workers and government personnel to collaborate and execute mission-critical workflows on the go.
Agent-assisted summaries and retrospectives
Agent-assisted summaries and retrospectives reduce time and increase the accuracy of in-progress playbook status updates, understanding the context of the playbook, user roles, and team progress.
Boards for kanban work management
Mattermost Boards empower teams to manage projects and mission-critical workflows with visual clarity. Kanban-style task tracking built into the secure Mattermost platform.
Hardening, resiliency, and scale
FIPS 140-3 validated image
Mattermost is available in a FIPS-validated image for FedRAMP compliance, satisfying NIST 800-53 standards. Ensures cryptographic modules meet specific security requirements for processing sensitive, classified, or regulated data.
STIG-hardened image for DoD information assurance
Mattermost offers a STIG-hardened DISA-approved image ensuring compliance with the Department of Defense's Security Technical Implementation Guides (STIGs) for IA and IA-enabled devices and systems.
High-availability cluster deployment
Enable business continuity through component failures using cluster-based deployment with multiple application servers, multiple database servers, and multiple front-end proxies and/or load balancers.
Horizontal scalability architecture
Scale to tens of thousands of users with horizontal scale-out architectures offering a range of deployment options from on-prem data centers to cloud-based hyperscalers including AWS and Azure.
Supported Kubernetes deployment
Simplify and automate IT administration through supported options for deploying to Kubernetes clusters running either on-prem in data centers or in managed services such as Amazon EKS, Azure Kubernetes Service, and Google Kubernetes Engine.
Performance monitoring (Grafana, Prometheus)
Track system health in large deployments, including high availability clusters, using advanced performance monitoring integrated with Grafana and Prometheus.
Dedicated write-through caching
Boost performance and reliability at scale with Dedicated Write-Through Caching powered by Redis. Ensures lightning-fast access to critical data while maintaining full data integrity.
Identity and access
SSO (SAML, OIDC, OAuth) with MFA
Single Sign-On supports SAML, OpenID Connect, and OAuth 2.0 for seamless and secure access across platforms. Multifactor authentication adds an extra layer of security beyond traditional username and password.
AD/LDAP user sync
Ensures seamless synchronization of user attributes and group memberships from Active Directory or LDAP directories, automating user management and maintaining up-to-date access controls.
Channel administration controls (read-only, restricted mentions, locked membership)
Empower admins to configure channels to be read-only, restrict channel mentions and emoji reactions, and lock down channels so users can only be added or removed by selected administrators.
Granular role-based access controls
User roles (Admin, Channel Admin, User) are applied to all users and determine access to system functions. These roles can be synchronized from AD/LDAP and updated automatically.
AD/LDAP group, team, and channel sync
Automate management of users, groups, access controls, and channel and team membership through synchronizing with Entra ID/AD/LDAP Groups.
Delegated granular administration
Delegate specific administrative capabilities to team and channel admins without granting full system administrator access, enabling distributed governance at scale.
Compliance and administration
Data retention policy
Configure automated message and file retention schedules to enforce compliance requirements, manage storage, and align with your organization's information governance policies.
Custom end user terms of service
Increase clarity on legal expectations for internal employees and guests with the ability to set custom Terms of Service agreements and re-acceptance periods.
Legal hold
Comply with legal hold and litigation hold requests to preserve information in anticipation of legal action. Can be combined with eDiscovery integration and data retention policies.
Compliance export and eDiscovery
Fulfill eDiscovery and compliance requirements with manual and automated export of message history in standard and custom compliance formats.
Channel export
Archive, backup, or submit the contents of a channel into other systems to fulfill reporting and auditability requirements.
Advanced logging and audit logging
Comprehensive tracking of all system activities for auditing, optimizing, and troubleshooting high-scale, mission-critical deployments to a full range of destinations.
Multi-team collaboration
Guest accounts and custom user groups
Guest accounts bring external users with restricted access into your instance. Custom user groups let you mention and notify up to 256 users who work together on projects or functions.
System-wide notification banners
Notify users across teams of upcoming system maintenance, service changes, and other announcements using system-wide announcement banners.
Anonymous team and channel URLs
When enabled, team and channel URLs are anonymized using random identifiers, preventing team and channel names from being identified through shared links.
Support
Community support
Community support for all Mattermost offerings is available on peer-to-peer forums.
Response commitment
Professional: 8am to 8pm PT, next business day. Enterprise: 24×7, 4-hour target. Enterprise Advanced: 24×7, 4-hour target. Guaranteed service level targets for support response times based on issue priority and plan tier, ensuring predictable resolution timelines for mission-critical deployments.
Premier Support and US-based Premier Support
Professional: –. Enterprise: Add-on. Enterprise Advanced: Add-on. Premier Support offers additional license entitlements for non-production environments, direct access to senior support team members, screen-sharing and audio calling for P1/P2 tickets, and access to a private channel with Mattermost technical staff. US-based option is delivered exclusively by US citizens.
Add-ons (Enterprise Advanced)
Cross Guard CDS
Professional: –. Enterprise: –. Enterprise Advanced: Add-on. Federates channel messaging across classification boundaries via customer-accredited Cross Domain Solutions, without operators switching networks.
Externally Managed Encryption
Professional: –. Enterprise: –. Enterprise Advanced: Add-on. Bring-your-own key management for encryption at rest and in transit, keeping cryptographic control entirely within your infrastructure.
Frequently Asked Questions
How are Mattermost licenses sold?
Does Mattermost have a Software-as-a-Service offering?
Yes, Enterprises can inquire about Mattermost Cloud Enterprise, as a single-tenant cloud-managed service for Mattermost Enterprise hosted by Mattermost, Inc. The system is offered on the same Kubernetes-based platform as the self-hosted edition, and managed by Mattermost, Inc.
For more information, contact the Mattermost Sales organization at contact sales.
How can U.S. government customers procure Mattermost licenses?
Please review our U.S. government offerings at government and public sector solutions to contact channel partners and resellers. You can also contact Carahsoft regarding Mattermost by phone or email with the information at carahsoft.com/mattermost.
How can government organizations outside the U.S. procure Mattermost licenses?
Governmental organizations outside the U.S. that need to procure licenses through resellers can contact the Mattermost sales organization at contact sales to connect with existing resellers by country and geographic region, or to onboard new approved resellers.
I'd like to buy Mattermost through a reseller, or I am a reseller, how do I get in touch?
Please contact the Mattermost sales team at contact sales to find a reseller for your geography and organization. Resellers can read about our partner programs at partner programs.
What happens when activated users exceed the number of licensed seats?
During the period of the annual license, when the number of activated users exceeds the number of seat licenses purchased, additional seats should be purchased on a quarterly "true forward" basis. For example, if activated users exceed licensed seats in the first quarter since annual licenses were purchased, then additional seat licenses should be purchased for the remaining three quarters until renewal, with an invoice amount prorated for the annual cost of the license.
Where can I find more information on subscriptions and billing?
Please see the Mattermost subscription documentation.
Do you offer special programs for non-profit organizations, open source projects, or educational institutions?
Yes, please see the information here.
Can I use my Mattermost license on multiple servers?
Each Mattermost server requires its own license, including servers that are federated with one another.
A High Availability configuration, where multiple nodes share a single database, counts as a single server and requires one license. Non-production servers (development, staging, and UAT) each require their own license key.
Customers with Premier Support are eligible for up to four non-production license keys. Customers without Premier Support should contact their account team for assistance.
Find the Right Plan
Not sure which plan fits your requirements?
Tell us your security posture and deployment constraints and we will match you to the right plan.
