Mattermost
Connect Mattermost to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Mattermost to collect communications platforms evidence with automated compliance tests, switched on per workspace.
| Category | Communications Platforms |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Mattermost's guide | docs.mattermost.com |
Connect with an API token
-
In Mattermost:
- As a system admin, go to System Console › Integrations › Integration Management and turn on the personal access token setting.
- If the token will belong to a non-admin account, go to System Console › User Management › Users, find the user and select Manage Roles from the dropdown to allow it to create personal access tokens.
- Sign in as that account and go to Profile › Security › Personal Access Tokens, then click Create Token.
- Enter a description and select Save. Copy the access token now; Mattermost will not show it again.
Where to find the other values:
- Server URL: The https address of your own Mattermost server, the same address you open in a browser to sign in.
Mattermost shows the secret only once, so copy it before you leave the page.
Mattermost's public documentation does not cover every step.
The token carries the permissions of the account that creates it, so create it as a system admin or as a user holding a system read-only admin role. The click path to assign a read-only admin role was not confirmed on the fetched page.
Source: docs.mattermost.com, checked 2026-10-07.
The permissions Safeguard needs:
system admin or system read-only admin. -
On Compliance › Connectors, open Mattermost, click Connect, choose API token and fill in:
Field What to enter Server URL Required. Your own server: an https address reachable from the internet. Access token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Mattermost and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 4 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2, A.8.5 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.4.2 | 4 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Communications Platforms connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks