Managed team chat (Mattermost)
Private, self-hosted team messaging (channels, direct messages, calls, files) that we run for ourselves every day and operate as a managed service for other organisations: a dedicated instance, your own domain, your own data, in our datacenters, never on a public SaaS that can read or terminate the account.
How we run it
Each customer gets a dedicated instance on Oracle Linux with PostgreSQL, behind our own firewalls, with its own backups taken by our backup plane (which pulls; nothing on the instance can push to it). A release watcher announces every vendor build to our operations channel and offers the upgrade; it carries a downgrade guard, so a back-port for an older branch is labelled “do not deploy” instead of being offered by mistake.
Every upgrade is changelog-reviewed and pre-flight validated per instance: operating system, database, system libraries, plugins. Major versions go to our own production instance first and soak before any customer instance moves, and every upgrade has a tested rollback. Network exposure is an allowlist of countries plus a block list of cloud and VPS provider networks, verified from several countries after each change, so scanners and bots never reach the login page. Channel histories can be moved between instances with byte-level verification when a team restructures or a company is acquired.
What it protects you from
- Your company’s conversations on a public SaaS that can read them, change the terms, or close the account.
- A wrong-branch “update to latest” that quietly downgrades or breaks the platform.
- An upgrade that bricks the instance on a hidden dependency.
- Scanner and credential-stuffing traffic hitting a private platform.
In practice
A major version upgrade on our own instance, measured in about a minute of downtime. Pre-flight caught stricter configuration validation and a raised minimum database version before the upgrade started; both were handled in advance. The upgrade itself ran its migrations over millions of posts in about a minute, with the licence intact, and the customer instances were held back until ours had soaked.
A customer upgrade stopped before it could fail. The same pre-flight found that one customer’s operating system shipped a system library too old for the new build. The upgrade was rescheduled behind an operating-system move, with zero downtime and no surprise.
A back-port declined automatically. When the release watcher later announced a build for an older branch, the guard tagged it “do not deploy”, and nobody had to remember why.
Also available
Managed Request Tracker (ticketing, with bridges to your partners’ systems), GitLab, Nextcloud with in-browser office editing, and PowerDNS: the platforms we run for ourselves, run for you on the same discipline.