--- title: "FIPS Compliance Guide" slug: "fips-compliance-guide" updated: 2026-08-03T16:04:06Z published: 2026-08-03T16:04:06Z canonical: "docs.rocket.chat/fips-compliance-guide" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt > Use this file to discover all available pages before exploring further. # FIPS Compliance Guide ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/GOV(1).svg) ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Defense.svg) > [!NOTE] > **Available since**: Rocket.Chat 8.7.0 Rocket.Chat is engineered for high-security environments, offering dedicated FIPS-compliant support to protect sensitive communications. This level of security is essential for government agencies, defense organizations, and heavily regulated industries that must comply with strict federal cryptographic standards. ## What is FIPS ? [Federal Information Processing Standards (FIPS)](https://en.wikipedia.org/wiki/Federal_Information_Processing_Standards) are security standards developed by the U.S. National Institute of Standards and Technology (NIST). They define the mandatory security requirements for cryptographic modules used to protect sensitive data. Rocket.Chat aligns with FIPS 140-3, the current standard for cryptographic module validation across government and enterprise sectors globally. ## How FIPS works in Rocket.Chat Rocket.Chat provides dedicated FIPS-compliant images that enforce FIPS compliance at the runtime layer. The images include FIPS-validated cryptographic modules, so security operations run in a FIPS-compliant configuration by default. **When you deploy a FIPS-compliant Rocket.Chat workspace:** - Cryptographic operations use FIPS-approved algorithms, including AES, RSA, and SHA-256 or stronger. - Non-approved algorithms are excluded from the Rocket.Chat cryptographic boundary. - FIPS compliance is determined entirely by the image tag used during deployment. There is no toggle or configuration setting in the workspace UI to enable FIPS. - The workspace user interface and user experience remain unchanged. ## Deploy a FIPS-compliant Rocket.Chat workspace Rocket.Chat publishes FIPS-compliant images alongside every standard [release](https://github.com/RocketChat/Rocket.Chat/releases), identified by the `-fips` tag suffix (for example, `8.7.0-fips`). Both images follow the same release schedule, ensuring FIPS deployments receive product updates, security patches, and bug fixes simultaneously with the standard release track. Organizations requiring FIPS compliance must deploy the dedicated FIPS image rather than the standard Rocket.Chat image. ### Prerequisites - A [premium plan](/v1/docs/our-plans) license that includes the FIPS add-on. Contact the [Rocket.Chat Sales team](https://www.rocket.chat/sales-contact) to get your license. - The FIPS image tag for the Rocket.Chat version you want to deploy. For example, `8.7.0-fips` is the FIPS image tag for Rocket.Chat 8.7.0. See [Docker Hub](https://hub.docker.com/r/rocketchat/rocket.chat/) for available image tags. ### Configure your deployment for FIPS Deploying a FIPS-compliant Rocket.Chat workspace follows the same deployment process as a standard [self-managed deployment](/v1/docs/deploy-rocketchat). The only required changes are: - Use the Rocket.Chat image tagged with the `-fips` suffix. - Apply a license that includes the FIPS add-on. Choose your deployment method below and continue with the following steps: **Kubernetes** 1. Follow the official [Deploy with Kubernetes guide](/v1/docs/deploy-with-kubernetes), and apply the required changes below during deployment. 2. In your `values.yaml` file: 1. Update the image `tag` to the desired `-fips` release: ```yaml image:  repository: registry.rocket.chat/rocketchat/rocket.chat  tag: ``` 2. Add the license: ```yaml license:"" ``` 3. Install Rocket.Chat with the configurations you defined in `values.yaml`: ```bash helm install rocketchat -f values.yaml rocketchat/rocketchat -n rocketchat ``` For existing deployments, upgrade the deployment: ```bash helm upgrade rocketchat -f values.yaml rocketchat/rocketchat -n rocketchat ``` **Docker** 1. Follow the official [Deploy with Docker and Docker Compose guide](/v1/docs/deploy-with-docker-docker-compose), and apply the required changes below during deployment. 2. In your `.env` file, specify the `-fips` release tag and your license key: ```plaintext RELEASE= ROCKETCHAT_LICENSE= ``` 3. Launch the deployment stack and start the containers: ```bash docker compose \  -f compose.monitoring.yml \  -f compose.traefik.yml \  -f compose.database.yml \  -f compose.yml \  -f compose.nats.yml \  -f docker.yml \  up -d ``` For existing deployments, restart the rocketchat container: ```bash docker compose -f compose.yml up -d ``` **Podman** 1. Follow the official [Deploy with Podman and Podman Compose guide](/v1/docs/deploy-with-podman), and apply the required changes below during deployment. 2. In your `.env` file, specify the `-fips` release tag and your license key: ```plaintext RELEASE= ROCKETCHAT_LICENSE= ``` 3. Launch the deployment stack and start the containers: ```bash podman-compose \  -f compose.monitoring.yml \  -f compose.traefik.yml \  -f compose.database.yml \  -f compose.yml \  -f compose.nats.yml \  -f podman.yml \  up -d ``` For existing deployments, restart the rocketchat container: ```bash docker compose -f compose.yml up -d ``` > [!NOTE] > If you deploy without a valid license, the `rocketchat` container will log a `FIPS LICENSE ERROR` and fail to start. ### Verify FIPS mode After the workspace starts, verify that Rocket.Chat is running in FIPS mode before using it in a production environment. **Kubernetes** View the Rocket.Chat container logs: ```bash kubectl logs deployment/rocketchat-rocketchat -n rocketchat | grep -A 15 "SERVER RUNNING" ``` **Docker** View the Rocket.Chat container logs: ```bash docker compose logs -f rocketchat ``` **Podman** View the Rocket.Chat container logs: ```bash podman-compose logs -f rocketchat ``` A successful FIPS deployment shows `FIPS Provider: Enabled` in the log output. ## Known limitations While core functionality remains unchanged, operating a FIPS-compliant Rocket.Chat workspace has the following limitations: - **Platform support**: FIPS Docker images are currently available only for AMD64 (x86_64) platforms. - **Email direct reply**: Email direct reply using POP3 servers that only support APOP or CRAM-MD5 authentication is not supported in FIPS mode because these authentication mechanisms rely on cryptographic algorithms that are not permitted in a FIPS-compliant deployment. If your organization uses POP3 email direct reply, ensure your mail server supports a compatible authentication method. - **Bcrypt password hashing**: Rocket.Chat continues to use Bcrypt for user password hashing to maintain backwards compatibility across deployments. While Bcrypt is widely recognized as a secure industry-standard hashing algorithm, it is not FIPS-validated. Migration plans are underway to transition password hashing in a future release to a FIPS-approved algorithm, such as PBKDF2. If you have any questions, refer to [**FIPS Compliance FAQ**](/v1/docs/fips-faq) for additional guidance.