Mobile security features

<PlanAvailability slug="ent-adv" />

This document outlines the key security features implemented in the mobile application, explains the significance of each control, and details our continuous security practices to maintain an up-to-date security posture.

Jailbreak and root detection

Mattermost leverages built-in checks from the Expo framework to identify jailbroken (iOS) and rooted (Android) devices:

• On Android, the app looks for the presence of known jailbreak/root binaries, such as the su binary in /system/xbin/su, which is a common indicator that the device has been rooted to allow unauthorized elevated access.
• On iOS, the detection process involves checking for unusual apps (e.g., Cydia), modified system paths, and testing whether the app can alter protected system files—all signs that the device may be jailbroken.

See the jailbreak/root protection configuration setting documentation for details on enabling this feature.

<Note>

Client-side detection methods are not bulletproof and can be bypassed by a sufficiently motivated user with root or jailbreak access. Determined users can employ reverse engineering to disable or modify these checks to produce false positives/negatives or even modify and recompile the source code to remove them entirely, allowing app usage on rooted/jailbroken devices.

</Note>

Biometric authentication

Mattermost integrates with iOS Face ID/Touch ID and Android’s Biometric API. When enabled by the server administrator, biometric checks are required before accessing specific servers, and the Mattermost mobile app mandates that a device PIN or biometric lock is active.

See the biometric authentication configuration setting documentation for details on enabling this feature and the user workflows in which users must authenticate.

<Note>

Biometric authentication, such as Face ID or fingerprint recognition, is handled by the device’s operating system. Mattermost does not provide or warrant the biometric functionality. The app will unlock if the OS determines that the biometric input is a positive match. Accuracy, security, and availability of biometric authentication depend entirely on the device and its underlying platform.

</Note>

Screenshot and screen recording prevention

Preventing screenshots and screen recordings protects sensitive information from being inadvertently or maliciously shared. This control is essential in ensuring that confidential communications and data remain within the secure confines of the app. By blocking unauthorized screen captures, Mattermost significantly reduces the risk of data leakage via visual content.

• On iOS, the app detects attempts to capture the screen. For screen recordings, it immediately applies a blur overlay to the view to obscure any sensitive information, while screenshots will capture no content at all.
• On Android, the app utilizes the FLAG_SECURE flag to block screen captures and recordings.

See the prevent screen capture configuration setting documentation for details on enabling this feature.

<Note>

This feature prevents screen recording and screenshot capture on the mobile device where the Mattermost app is running. It cannot control or prevent recording from external devices, such as another phone or camera pointed at the screen. Mattermost provides these protections through mobile OS-level capabilities but cannot guarantee absolute prevention of visual data capture through other means.

</Note>

Secure file previews

Preventing file downloads protects sensitive information from being inadvertently or maliciously shared. This control is essential in ensuring that confidential documents and media remain within the secure confines of the app. By enabling in-app previews for supported file types and restricting downloads, Mattermost significantly reduces the risk of data leakage while maintaining essential file-viewing capabilities.

See the secure file preview and managing PDF link navigation configuration settings documentation for details on enabling these features.

Mobile watermarking

Mobile watermarking is an experimental Enterprise Advanced capability from Mattermost v11.7 onward, that helps organizations attribute mobile screenshots and shared screen captures to a specific user, server, and point in time. When this setting is enabled by a system admin, authenticated Mattermost mobile sessions display a visible watermark overlay on top of the app interface that includes:

• The user's username.
• The server domain.
• The current date in YYYY-MM-DD format.
• The current time in HH:mm format.

The watermark is intended to support data loss prevention (DLP) workflows by making it easier to identify the source and timing of any image taken of the Mattermost mobile app. Mobile watermarking is disabled by default.

See the Enable Mobile Watermark configuration setting documentation for details on enabling this experimental feature.

<Note>

• The mobile watermark is a visual overlay only. It does not prevent users from taking screenshots, recording the screen, exporting files, or sharing content through other means. For controls that block screen capture on the device itself, see screenshot and screen recording prevention.
• This feature applies only to the Mattermost mobile app. It does not add a watermark to the Mattermost web app or desktop apps.
• This is an experimental capability. Its behavior, defaults, and visual presentation may change in future releases based on customer feedback.

</Note>

Microsoft Intune Mobile Application Management (MAM)

Mattermost supports Microsoft Intune MAM to enforce identity-based, app-level data protection on iOS devices without requiring full device enrollment in a mobile device management (MDM) solution.

Microsoft Intune MAM enforcement for Mattermost is currently supported on iOS only. We recommend using Android for Work profiles until Android Intune support is available.

Intune MAM applies security policies directly to the Mattermost mobile app using Microsoft Entra ID as the identity authority. This enables organizations to protect corporate or mission-sensitive data on Bring Your Own Device (BYOD) and mixed-use devices while preserving user privacy.

Key security capabilities enabled through Intune MAM include:

• Mandatory enrollment before accessing Mattermost on mobile
• Identity-based enforcement using Microsoft Entra ID
• Selective wipe of Mattermost work data without affecting personal apps or device data
• Clipboard, file sharing, and data transfer restrictions
• Screenshot and screen recording prevention
• Managed browser enforcement and controlled link handling
• Immediate enforcement when policies or licensing change, including during active sessions

Intune MAM enforcement is applied per Mattermost workspace and evaluated continuously at runtime. If a device becomes non-compliant, enrollment fails, or required policies are not met, access to protected content is blocked automatically.

This approach allows organizations to extend zero-trust and data loss prevention (DLP) controls to mobile users without assuming ownership or management of the underlying device.

See the Microsoft Intune MAM configuration guide for deployment and configuration details.

Mobile Ephemeral Mode

Mobile applications typically cache messages, files, and attachments on-device indefinitely. Two security concerns drive the need for administrator-controlled data lifecycle management on mobile devices:

• Unbounded sensitive data accumulation. Without data-age controls, weeks or months of sensitive content can accumulate on any device a user has logged into — well beyond what operational need justifies.
• Offline exposure after device loss. Remotely wiping a device requires it to be reachable — the condition least likely to hold when a device is lost, stolen, or in an adversarial environment. Unmanaged or personally-owned devices may not be enrolled in MDM at all, leaving cached content with no remote deletion path.

Mobile Ephemeral Mode addresses both concerns by giving administrators direct, server-side control over how long data persists on mobile devices. The app enforces this policy locally — including while offline and across app and device restarts — so data is removed based on elapsed time, not device reachability.

Mobile Ephemeral Mode generates an audit log event for each delete, purge, and wipe operation. Because these operations can execute on a device that is unreachable — where no administrator has direct visibility — audit logging provides verifiable proof that ephemeral policies were enforced. This supports compliance requirements for data lifecycle management and destruction accountability. Events that occur while the device is offline are reported to the server on reconnection.

See the Mobile Ephemeral Mode configuration settings to configure these controls.

Mobile data isolation

Mattermost mobile applications are designed to ensure that sensitive data is stored securely and isolated from other applications on the device. This isolation is achieved through a combination of OS-level security features, app sandboxing, and secure data storage practices.

Mattermost stores 3 types of data within the mobile app:

• SQLite Database: For offline access to posts and channels that the user has viewed.
• Cached Files: For temporary storage (e.g., PDFs) of viewed files. They are periodically purged.
• Logs: Minimal logs kept for troubleshooting purposes.

The Mattermost mobile app for Apple iOS and Android devices uses the native OS security architecture to encrypt data-at-rest on mobile devices, ensuring that stored information remains secure even if the device is lost or stolen. This encryption protects sensitive data, such as messages and files, from unauthorized access.

Data stored by the Mattermost mobile app only resides within the app’s private storage container. This storage location is isolated by each platform’s rigorous sandboxing model. Learn more about secure file storage for Mattermost mobile applications.

Security measures

• OS sandboxing & app access isolation: Mattermost’s data is confined within its app-specific sandbox (see Apple’s iOS sandboxing and Android’s sandboxing guidelines). This sandboxing mechanism ensures that all stored data—whether in the SQLite databases, cached files, or logs—is isolated and inaccessible to other applications. This is why TikTok, and any other application is blocked from accessing Mattermost data.
  • iOS employs a rigorous sandboxing model that relies on containerized file systems and strict process isolation. Each app operates within its own sandbox, with its home directory randomly assigned during installation. As a result, data stored within the Mattermost app’s sandbox directory remains accessible only to the app unless explicitly shared by the user.
  • Android employs scoped storage by assigning each app its own Linux user ID and a dedicated private directory. This model prevents other applications from accessing an app’s private directory without explicit permission. As a result, the Mattermost app’s data remain inaccessible to other apps—unless the device is rooted, or the user explicitly shares the data.
• Cache invalidation: Cached files are periodically deleted.
• No Google or Apple Cloud backup: Mattermost files are not backed up during normal cloud backup procedures.
  • On Android, the application explicitly disables backups (using the appropriate manifest settings), ensuring that all Mattermost files remain strictly on-device.
  • On iOS, although the operating system automatically backs up files stored in the app's Documents folder, Mattermost intentionally stores its files in the Library/Caches directory, which is excluded from iCloud backups.
• Controlled data export: Data only leaves Mattermost through explicit user actions such as:
  • Manually exporting a file.
  • Takes a screenshot (if not blocked by policy or with a secondary camera).
  • Sharing content using OS features (e.g., share sheet).

<Note>

This feature restricts direct access to stored data through robust OS-level sandboxing and storage controls. However, it cannot prevent unauthorized extraction if attackers employ alternative methods. For instance, on jailbroken (iOS) or rooted (Android) devices, where system integrity is compromised, an attacker may bypass standard security measures.

Similarly, exploiting zero-day or known OS vulnerabilities—or malicious apps that exploit permission weaknesses—could grant access to device storage. Mattermost uses mobile OS-level safeguards but cannot guarantee absolute prevention of such unauthorized data access.

</Note>

Security compliance

• Secure SDLC: The mobile app adheres to the same secure Software Development Lifecycle (SDLC) process as all Mattermost components. This guarantees that new mobile features undergo comprehensive security reviews and that any issues are addressed before release.
• Vulnerability management: The Mattermost mobile app is included in Mattermost’s public bug bounty program, inviting security researchers to rigorously assess the application. Additionally, established remediation SLAs ensure that any security issues are resolved promptly.
• Continuous dependency scanning: Mattermost uses Snyk Open Source to conduct daily scans of all dependencies. This continuous approach ensures that any newly disclosed vulnerabilities are quickly identified and addressed within defined SLAs.
• BESPIN compliance: Mattermost adheres to strict security evaluations including:
  • Device Protection Profiles (NIAP Evaluation)
  • Security Dependency & Code Analysis
  • Code Complexity & Testing Standards