---
title: "Rocket Chat Security Overview: Zero-Trust Messaging"
slug: "security-overview"
description: "Explore Rocket Chat security. Ensure zero-trust messaging, data sovereignty, regulatory compliance, and fully encrypted communication for mission-critical use."
updated: 2026-10-19T17:17:37Z
published: 2026-10-19T17:17:37Z
canonical: "docs.rocket.chat/security-overview"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

Rocket.Chat is a communications platform with a security architecture built for organizations that require strict privacy and data protection, including regulated industries, government agencies, and defense organizations. You control where your workspace runs, who can access it, how your data is stored, and how long it is kept.

This page maps the security and compliance capabilities available in Rocket.Chat and links to the guide for each one. Use it to check what a capability does, which plan includes it, and where it is documented.

> [!NOTE]
> This page is an overview for evaluating Rocket.Chat's security capabilities. To configure them, see [Secure Rocket.Chat](/v1/docs/secure-rocketchat). For security policies, certifications, and advisories, see the [Security Center](/v1/docs/security-center).

## Availability at a glance

Most security capabilities described on this page are available on every plan. The following capabilities depend on your plan or license:

| Capability | Availability |
| --- | --- |
| FIPS 140-3 compliant deployment | Government and Defense plans, with the FIPS license add-on. Available since Rocket.Chat 8.7.0. |
| Air-gapped, SCIF-ready deployment (DoD ATO up to IL6 on NIPR, SIPR, and JWICS) | Defense plan |
| LDAP and SAML authentication | Available on all plans today. From Rocket.Chat 9.0.0, both require a plan that includes the corresponding Premium module. |
| Message Auditor | Premium plans |
| Custom roles | Premium plans |
| Device management for connected user devices | Premium plans |
| Private apps (Apps-Engine) | Starter and premium plans, on self-managed workspaces and Dedicated private cloud workspaces. Not available on Standard cloud or Premium cloud hosting. |

For the full plan comparison, see [Our Plans](/v1/docs/our-plans).

---

## Deployment and hosting

- [Deploy and scale](/v1/docs/deploy-rocketchat) a self-managed workspace with Docker, Podman, or Kubernetes on a MongoDB database. You manage TLS certificates, reverse proxies, and firewall rules, and you can [configure](/v1/docs/setup-and-configure) the workspace to match your own infrastructure standards.
- Choose between self-managed and Rocket.Chat cloud hosting, which offers shared and dedicated infrastructure. See [Choose Your Deployment Model](/v1/docs/choose-your-deployment-model) and the [cloud hosting SLA](/v1/docs/rocketchat-cloud-hosting-service-level-agreement-sla).
- Deploy an [air-gapped workspace](/v1/docs/rocketchat-air-gapped-deployment) in an isolated network with no outbound connectivity. See [Air-Gapped Workspace Configuration](/v1/docs/air-gapped-workspace-configuration) and [Apply License in an Air-Gapped Workspace](/v1/docs/air-gapped-license).
- Run Rocket.Chat in a FIPS 140-3 compliant configuration using the dedicated `-fips` images. Cryptographic operations use FIPS-approved algorithms, and FIPS status is reported in the server logs and workspace statistics. See the [FIPS Compliance Guide](/v1/docs/fips-compliance-guide) and the [FIPS FAQ](/v1/docs/fips-faq).
- Give your users the [desktop and mobile apps](/v1/docs/desktop-mobile-apps), which connect to your own workspace rather than a shared service.

## Identity and authentication

- Connect your [identity provider](/v1/docs/authentication) for centralized authentication through LDAP and Active Directory, SAML, OAuth, OpenID Connect, or CAS. Sync user data, groups, and roles from your directory.
- Enforce [two-factor authentication](/v1/docs/two-factor-authentication-configuration) (2FA/MFA) so users provide a second factor before they access their accounts. Users can manage their own factors in the [Two-Factor Authentication User Guide](/v1/docs/two-factor-authentication-user-guide).
- Enable the [modern OAuth flow](/v1/docs/modern-oauth-flow) for server-side OAuth sign-in with CSRF protection, state validation, and PKCE, which reduces browser exposure to token theft.
- Set [password policies and password history](/v1/docs/set-password-policy-and-history) to block easy-to-guess and reused passwords.
- Control the lifetime of [user sessions](/v1/docs/accounts) so users are asked to verify and log in again based on their activity.
- [Manage users](/v1/docs/manage-workspace-users) and reset their passwords from the admin area, or through the [REST API](https://developer.rocket.chat/apidocs).
- Monitor and revoke access with [Device Management](/v1/docs/device-management). Send login detection emails, review every connected device with its client, OS, last login, device ID, and IP address, and log a device out to end its session immediately.
- Let users create and revoke [personal access tokens](/v1/docs/manage-personal-access-tokens) for API access, and restrict who is allowed to create them.

## Access control

- Restrict who can see and post in a conversation by using private, read-only, or broadcast [rooms](/v1/docs/channels).
- Turn on [end-to-end encryption](/v1/docs/configure-e2e-encryption) (E2EE) for new or existing rooms, so message content is readable only by room members. See the [E2EE User Guide](/v1/docs/end-to-end-encryption-user-guide) for the user-facing workflow and the [E2EE specifications](/v1/docs/end-to-end-encryption-specifications) for the algorithms used.
- Apply role-based access control with [roles and granular permissions](/v1/docs/roles-in-rocketchat), which govern actions such as editing rooms, creating private rooms, and archiving rooms. Define your own [custom roles](/v1/docs/custom-roles) on the premium plans, and assign [room-level roles](/v1/docs/room-roles) such as owner and moderator.
- Apply [attribute-based access control](/v1/docs/attribute-based-access-control-abac) (ABAC) to enforce access policies based on user attributes. See [Configure ABAC](/v1/docs/configure-abac) and the [ABAC FAQs](/v1/docs/abac-faqs).
- Apply [rate limits](/v1/docs/rate-limiter) to the requests your workspace accepts, which limits the impact of denial-of-service attempts and web scraping.
- Enable or disable [CORS requests](/v1/docs/general), and allow only the domains you trust.

## Data protection

- Terminate TLS at a reverse proxy such as Traefik or nginx to encrypt data in transit. The [deployment guides](/v1/docs/deploy-rocketchat) include the proxy configuration.
- Control [file uploads](/v1/docs/file-upload) by restricting file size, file type, and who can access uploaded files. Store files on AWS S3, Google Cloud Storage, a MinIO server, or a local path on your server. See [Recommendations for File Upload](/v1/docs/recommendations-for-file-upload).
- Scan uploads for malware with the open-source [ClamAV app](/v1/docs/clamav-app), which checks a file before it is stored in your workspace.
- Keep message content out of mobile [push notifications](/v1/docs/push) by excluding the channel name and message body from the payload, which supports requirements such as HIPAA.
- Install the [Data Loss Prevention (DLP) app](/v1/docs/data-loss-prevention-dlp-app) and define rules that block or restrict the sharing of sensitive information. See the [DLP User Guide](/v1/docs/data-loss-prevention-user-guide) for what users see when a rule matches.
- Set a [retention policy](/v1/docs/retention-policy) to delete messages and files automatically after a period you define.
- Prevent users from editing or deleting their own [messages](/v1/docs/message) after they are sent.
- Handle data subject requests with [User Data Download](/v1/docs/user-data-download).

## Monitoring and auditing

- Search the contents of any room with the [Message Auditor](/v1/docs/message-auditor) on the premium plans, including [edited, deleted, and encrypted messages](/v1/docs/audit-edits-deletions-and-encrypted-communications). Every audit is itself recorded in the [audit log](/v1/docs/audit-logs), with the user who ran it, the search terms, the filters applied, the results returned, and the timestamp.
- Review security-related activity in your workspace with [Audit Workspace Security Logs](/v1/docs/audit-workspace-security-logs).
- Send workspace logs and metrics to your own tooling, including Prometheus and Grafana. See [Monitor Workspace Logs and Metrics](/v1/docs/access-workspace-logs) and [Configure Workspace Logs](/v1/docs/configure-workspace-logs).
- Let users report messages and give moderators a queue to act on them with [Moderation](/v1/docs/moderation). The Rocket.Chat Marketplace also offers the Mod Assist and Mod Perspective apps for automated moderation.

## Compliance and certifications

- Rocket.Chat runs an information security management system based on the ISO 27001 framework, with documented policies, internal controls, risk assessments, annual internal audits, and vendor assessments. See the [Security Compliance Program](/v1/docs/security-compliance-program) for the program's scope and for where current certifications are published.
- Meet federal cryptographic requirements with FIPS 140-3 compliant deployments. See the [FIPS Compliance Guide](/v1/docs/fips-compliance-guide), which also documents the known limitations, including platform support and password hashing.
- Review the data protection commitments that apply to your workspace: [GDPR](/v1/docs/gdpr), [LGPD](/v1/docs/lgdp), and the current list of [subprocessors](/v1/docs/subprocessors).
- Read the [Security Policy](/v1/docs/security-policy) and [Security Guidelines](/v1/docs/security-guidelines), and track fixed vulnerabilities and the versions they affect in [Rocket.Chat Security Fixes, Updates, and Advisories](/v1/docs/rocketchat-security-fixes-updates-and-advisories).

## Secure integrations and extensibility

- Build private apps with the [Apps-Engine](https://developer.rocket.chat/docs/rocketchat-apps-engine) in TypeScript, so custom functionality runs inside your own workspace instead of a third-party service. Private apps run on self-managed workspaces and on Dedicated private cloud workspaces; see [Manage Private Apps](/v1/docs/rocketchat-private-apps).
- Communicate with people outside your organization through [Omnichannel](/v1/docs/omnichannel), with [contact identity verification](/v1/docs/trusted-contact-management), privacy and permission controls, and a record of every conversation.
- Run AI features against a self-hosted model with the [Rocket.Chat AI app](/v1/docs/rocketchat-ai-app), so prompts and knowledge base content stay within your infrastructure.
- Add audio and video conferencing through the [Pexip app](/v1/docs/pexip-app).

## Related topics

- [Secure Rocket.Chat](/v1/docs/secure-rocketchat): configure each security setting in your workspace.
- [Security Center](/v1/docs/security-center): policies, certifications, encryption specifications, and advisories.
- [Our Plans](/v1/docs/our-plans): what each plan includes, including the Government and Defense plans.
- [Authentication Across Plans](/v1/docs/authentication-across-plans): authentication features compared across plans.
- [Quick Start: Evaluate Rocket.Chat](/v1/docs/evaluate-rocketchat): set up a workspace to test these capabilities.