Security Overview

Rocket.Chat is a communications platform with a security architecture built for organizations that require strict privacy and data protection, including regulated industries, government agencies, and defense organizations. You control where your workspace runs, who can access it, how your data is stored, and how long it is kept.

This page maps the security and compliance capabilities available in Rocket.Chat and links to the guide for each one. Use it to check what a capability does, which plan includes it, and where it is documented.

This page is an overview for evaluating Rocket.Chat's security capabilities. To configure them, see Secure Rocket.Chat. For security policies, certifications, and advisories, see the Security Center.

Availability at a glance

Most security capabilities described on this page are available on every plan. The following capabilities depend on your plan or license:

For the full plan comparison, see Our Plans. For a feature-by-feature authentication comparison, see Authentication Across Plans.

Deployment and hosting

• Deploy and scale a self-managed workspace with Docker, Podman, or Kubernetes on a MongoDB database. You manage TLS certificates, reverse proxies, and firewall rules, and you can configure the workspace to match your own infrastructure standards.

• Choose between self-managed and Rocket.Chat cloud hosting, which offers shared and dedicated infrastructure. See Choose Your Deployment Model and the cloud hosting SLA.

• Deploy an air-gapped workspace in an isolated network with no outbound connectivity. See Air-Gapped Workspace Configuration and Apply License in an Air-Gapped Workspace.

• Run Rocket.Chat in a FIPS 140-3 compliant configuration using the dedicated -fips images. Cryptographic operations use FIPS-approved algorithms, and FIPS status is reported in the server logs and workspace statistics. See the FIPS Compliance Guide and the FIPS FAQ.

• Give your users the desktop and mobile apps, which connect to your own workspace rather than a shared service.

Identity and authentication

• Connect your identity provider for centralized authentication through LDAP and Active Directory, SAML, OAuth, OpenID Connect, or CAS. Sync user data, groups, and roles from your directory.

• Enforce two-factor authentication (2FA/MFA) so users provide a second factor before they access their accounts. Users can manage their own factors in the Two-Factor Authentication User Guide.

• Enable the modern OAuth flow for server-side OAuth sign-in with CSRF protection, state validation, and PKCE, which reduces browser exposure to token theft.

• Set password policies and password history to block easy-to-guess and reused passwords.

• Control the lifetime of user sessions so users are asked to verify and log in again based on their activity.

• Manage users and reset their passwords from the admin area, or through the REST API.

• Monitor and revoke access with Device Management. Send login detection emails, review every connected device with its client, OS, last login, device ID, and IP address, and log a device out to end its session immediately.

• Let users create and revoke personal access tokens for API access, and restrict who is allowed to create them.

Access control

• Restrict who can see and post in a conversation by using private, read-only, or broadcast rooms.

• Turn on end-to-end encryption (E2EE) for new or existing rooms, so message content is readable only by room members. See the E2EE User Guide for the user-facing workflow and the E2EE specifications for the algorithms used.

• Apply role-based access control with roles and granular permissions, which govern actions such as editing rooms, creating private rooms, and archiving rooms. Define your own custom roles on the premium plans, and assign room-level roles such as owner and moderator.

• Apply attribute-based access control (ABAC) to enforce access policies based on user attributes. See Configure ABAC and the ABAC FAQs.

• Apply rate limits to the requests your workspace accepts, which limits the impact of denial-of-service attempts and web scraping.

• Enable or disable CORS requests, and allow only the domains you trust.

Data protection

• Terminate TLS at a reverse proxy such as Traefik or nginx to encrypt data in transit. The deployment guides include the proxy configuration.

• Control file uploads by restricting file size, file type, and who can access uploaded files. Store files on AWS S3, Google Cloud Storage, a MinIO server, or a local path on your server. See Recommendations for File Upload.

• Scan uploads for malware with the open-source ClamAV app, which checks a file before it is stored in your workspace.

• Keep message content out of mobile push notifications by excluding the channel name and message body from the payload, which supports requirements such as HIPAA.

• Install the Data Loss Prevention (DLP) app and define rules that block or restrict the sharing of sensitive information. See the DLP User Guide for what users see when a rule matches.

• Set a retention policy to delete messages and files automatically after a period you define.

• Prevent users from editing or deleting their own messages after they are sent.

• Handle data subject requests with User Data Download.

Monitoring and auditing

• Search the contents of any room with the Message Auditor on the premium plans, including edited, deleted, and encrypted messages. Every audit is itself recorded in the audit log, with the user who ran it, the search terms, the filters applied, the results returned, and the timestamp.

• Review security-related activity in your workspace with Audit Workspace Security Logs.

• Send workspace logs and metrics to your own tooling, including Prometheus and Grafana. See Monitor Workspace Logs and Metrics and Configure Workspace Logs.

• Let users report messages and give moderators a queue to act on them with Moderation. The Rocket.Chat Marketplace also offers the Mod Assist and Mod Perspective apps for automated moderation.

Compliance and certifications

• Rocket.Chat runs an information security management system based on the ISO 27001 framework, with documented policies, internal controls, risk assessments, annual internal audits, and vendor assessments. See the Security Compliance Program for the program's scope and for where current certifications are published.

• Meet federal cryptographic requirements with FIPS 140-3 compliant deployments. See the FIPS Compliance Guide, which also documents the known limitations, including platform support and password hashing.

• Review the data protection commitments that apply to your workspace: GDPR, LGPD, and the current list of subprocessors.

• Read the Security Policy and Security Guidelines, and track fixed vulnerabilities and the versions they affect in Rocket.Chat Security Fixes, Updates, and Advisories.

Secure integrations and extensibility

• Build private apps with the Apps-Engine in TypeScript, so custom functionality runs inside your own workspace instead of a third-party service.

• Communicate with people outside your organization through Omnichannel, with contact identity verification, privacy and permission controls, and a record of every conversation.

• Run AI features against a self-hosted model with the Rocket.Chat AI app, so prompts and knowledge base content stay within your infrastructure.

• Add audio and video conferencing through the Pexip app.

Related topics

• Secure Rocket.Chat: configure each security setting in your workspace.

• Security Center: policies, certifications, encryption specifications, and advisories.

• Our Plans: what each plan includes, including the Government and Defense plans.

• Authentication Across Plans: authentication features compared across plans.

• Quick Start: Evaluate Rocket.Chat: set up a workspace to test these capabilities.