How EFF Maintains Data Sovereignty While Defending Digital Rights

Since 1990, the Electronic Frontier Foundation (EFF) has been defending civil liberties in the digital world, protecting user privacy and free speech through litigation, policy analysis, grassroots activism, and technology development. A nonprofit organization, the EFF works to ensure that technology supports freedom, justice, and innovation for everyone. Headquartered in San Francisco, the EFF is powered by 125 full-time staff, more than 325 volunteers, and a global community of 40,000 members.

Needing to protect sensitive organizational data

EFF stakeholders collaborate every day from all corners of the world to coordinate the organization’s mission. For years, that coordination ran largely on IRC channels and a steady flood of email threads — tools that were low-friction but never designed with confidential casework in mind.

Given the sensitive nature of their work, from active litigation to confidential source communication, EFF needed a secure collaboration platform that let staff and volunteers work together freely without putting member data, case details, or internal strategy at risk.

“We care deeply about user control and insight into the software we’re using and having control over our data and our supporters’ data,” says Lena Gunn, director of technical services at EFF.

Choosing Mattermost to streamline collaboration and maintain data sovereignty

In 2015, EFF began looking to move away from IRC and overreliance on email and consolidate its communications. After researching its options, EFF determined that Mattermost was the best fit for a secure collaboration platform. The organization was drawn to Mattermost for several key reasons: open source flexibility with self-hosting, a fast and familiar user experience, easy administration, and strong data sovereignty capabilities.

“Mattermost enables us to adhere to our privacy policy and our internal confidential information policy,” Gunn explains.

Protecting sensitive information and moving the mission forward

Today, EFF runs two separate instances: one that its internal team of lawyers, activists, and technologists rely on for daily collaboration, and another open to the organization’s broader community, including supporters, open source contributors, and allied organizations.

“Our team is multidisciplinary, so lawyers use it one way and technologists use it another way,” Gunn says. “It’s the tool where we all come together.”

This dual-instance approach gives EFF the best of both worlds. Internal discussions on active strategy and cases stay fully secure and isolated while the organization can still extend real-time, secure collaboration to the wider network that helps carry its mission forward.

“We’ve approved Mattermost for confidential-level information, which includes things like internal strategy, intake conversations, and personnel matters,” Gunn says. “We also maintain coordination with external activists and collaborators that would fall under the confidential category.”

EFF teams rely heavily on Mattermost channels, file sharing, mobile access, and data retention controls to support this work.

“We’re very interested in having fine-grained control over the retention policies for different channels,” Gunn says. “One thing we’re looking into now is sensitivity labels for different conversations, as well as the ability to systematically remove inactive users from our public instance. We want to make sure we’re ready for discovery or legal holds.”

The organization also has extended Mattermost with integrations.

“We use webhooks to bring over information about our GitLab and GitHub pipelines,” Gunn continues.

EFF also values Mattermost’s regular security updates, which give the organization peace of mind knowing its sensitive collaboration data stays protected.

“Mattermost has been key to enabling us to securely communicate with allied grassroots organizations and like-minded activists all over the country,” Gunn concludes. “It allows us to communicate about our current technologies, upcoming local legislative issues, and shared resources for campaigns, as well as facilitate communication between staff with a physically dispersed presence.”

Approaching AI with caution and control

EFF is currently developing its internal AI policy, and the organization has real concerns about applying AI to confidential information — particularly legal case materials and sensitive security discussions. For now, EFF is pleased that Mattermost lets it control AI functionality directly rather than having it imposed by default.

“We appreciate the ability to turn AI functionality off,” Gunn says. “We don’t see ourselves doing any generalized adoption of commercial models in the short term.”