Mattermost

Mattermost is an Intelligent Mission Environment built specifically for national security, defense, intelligence, and critical infrastructure. Unlike general-purpose tools, it is designed for complete data sovereignty and operational control—deployable on-premises, in private cloud, or within disconnected, denied, intermittent, and limited (DDIL) environments.

Mattermost delivers persistent, encrypted team communication, including classification banners, data spillage prevention, role-based access control, and full audit trails across web, desktop, and mobile. Through Playbooks, our workflow automation codifies operational procedures into repeatable sequences, while AI-powered decision support connects to private or sovereign LLMs without external dependencies. Trusted by the U.S. Department of Defense, Air Force, NASA, and allied Five Eyes and NATO governments, the platform is co-built by over 4,000 contributors, meets DISA Impact Levels IL2–IL6, and offers FIPS 140-3 validated cryptography.

The Virtru integration operates via the Virtru ZTDF Bridge, a Mattermost plugin that designates the Virtru Data Security Platform as the Policy Decision Point for all file activity within Mattermost channels. When a file is uploaded, Mattermost verifies the user's identity and attributes against central policies before accepting the file. Similarly, when a file is opened, Mattermost consults the Virtru PDP to evaluate the viewer’s clearance, role, and assignment before rendering the content natively. Users can securely view protected images, PDFs, text, audio, and video directly within the Mattermost interface, ensuring data remains within the controlled environment throughout its lifecycle.

Mattermost’s role-based access controls integrate seamlessly with the Virtru Policy Decision Point. Instead of relying on fragmented, per-channel rules, access is governed by a unified policy across all systems. This ensures that clearance and role attributes are evaluated consistently at both upload and view. Consequently, any access revocation takes effect in seconds across the entire data layer.

Furthermore, Mattermost’s DDIL (Disconnected, Denied, Intermittent, and Limited) architecture ensures continuity during operations. ZTDF protection is applied to files before they enter Mattermost, meaning that even in air-gapped or offline environments, files carry their access policies with them. In forward-deployed nodes without direct PDP connectivity, cryptographic protection remains active—ensuring that only authorized users can open the file—with audit records automatically syncing once connectivity is restored.

Together, Mattermost and Virtru provide a unique collaboration environment where the communication and data layers enforce policy independently. This synergy makes Mattermost the first chat platform to achieve data-centric Zero Trust protection at the file layer.

• Secure Channels offers persistent, encrypted messaging with classification banners, data spillage prevention, and role-based access controls. Operational across web, desktop, mobile, and air-gapped environments.
• Workflow Automation codifies complex procedures into repeatable, automated workflows for incident response, mission planning, and compliance tracking.
• Task & Mission Planning provides Kanban-style coordination enabling cross-functional teams to manage mission execution and maintain operational continuity.
• Sovereign AI Collaboration enables secure audio calls with transcription and AI-assisted summarization. Connects to private or sovereign LLMs without needing external dependencies.
• Extensible Integration Framework utilizes open APIs, webhooks, and a flexible plugin architecture with pre-built connectors for GitHub, GitLab, Jira, ServiceNow, TAK, Pexip, and other key systems.
• DDIL-Ready Deployment supports self-hosted on-premises or private cloud (AWS GovCloud, Azure Government, Oracle NSR) deployments. Designed for rapid field setup using Kubernetes or a single VM.
• Zero Trust Architecture provides dynamic, attribute-based access controls enforced via user attributes, clearance levels, and device posture. Fully supports DISA IL2–IL6.

Deploying the Virtru Data Security Platform with Mattermost requires an active Mattermost Enterprise Advanced deployment, a Virtru deployment, and an identity provider to source the user and environmental attributes that drive access decisions.

Mattermost Enterprise Advanced — required for the Virtru ZTDF Bridge plugin and advanced security controls

Virtru Data Security Platform — SaaS, customer VPC, on-premises, or air-gapped; supports the same environmental profiles as Mattermost's DDIL and disconnected deployments

Virtru ZTDF Bridge plugin — installed and configured in the Mattermost admin console

Compatible OIDC/OAuth2 identity provider — Okta, Microsoft Entra ID, Ping Identity, or equivalent — for ABAC attribute sourcing

Network connectivity — between the Mattermost deployment and the Virtru PDP for online policy evaluation; offline mode available for DDIL environments

Security

The Virtru Data Security Platform enhances Mattermost with object-level ZTDF encryption and attribute-based access control, ensuring security persists even after files leave the channel. Access policy is enforced independently at both upload and view, creating two distinct security decision points for every file interaction. This protection travels with the data, regardless of its destination. Decryption authority remains strictly with the data owner, and every access event—including user identity, attributes, policy context, and decision outcomes—is fully logged within both Mattermost and Virtru audit systems.

Compliance

Virtru’s Trusted Data Format (TDF) and OpenTDF—evolved from NSA-developed technology—provide persistent protection. Virtru supports ACP-240—the Five Eyes-ratified Zero Trust standard for coalition data sharing—alongside IC-TDF and NATO STANAG 5636. Complementing these data-layer protections, Mattermost meets DISA Impact Levels IL2–IL6, offers FIPS 140-3 validated cryptography, and provides STIG-compliant container images. Both organizations actively drive ACP-240 adoption to secure NATO and allied government missions.

Privacy

Your file content and encryption keys never leave your controlled environment, as the entire integration deploys within your accreditation boundary. Because you retain control of your own keys, decryption authority remains exclusively with you. Virtru enforces your access policies without ever accessing or holding your plaintext data.