Rocket.Chat 9.0 makes interoperable by design real: a native XMPP server foundation alongside native Matrix, so you and your partners can connect whatever protocol each side runs, without giving up governance or control. Native video completes the real-time comms bundle, and the ABAC-enforced workspace puts every channel inside the access boundary.
Interoperability is no longer a nice-to-have. Coalitions, agencies and allied networks are expected to work together now, on the systems they already run, and control is demanded alongside interoperability, not traded against it. The gap between an interoperability demo and real interoperability is where most programmes stall.
Rocket.Chat 9.0 closes that gap. Messaging, voice, video, federation, Zero Trust access and governed AI now run natively on one platform, in one deployment and one accreditation scope, including on-premises and air-gapped.
Rocket.Chat 9.0 delivers:
- Native XMPP server foundation, to federate natively with partners over XMPP, alongside native Matrix.
- Native video (Beta), completing the real-time comms bundle with WebRTC voice, SIP voice and screen sharing.
- ABAC-enforced workspace, turning attribute-based access control into one boundary that covers every channel and team.
- Hybrid search, strengthening our Governed AI bundle, which assists, retrieves and acts on the model you choose, inside your perimeter.
- Presence visibility controls that let each person choose who sees their status.
Our customers are told to interoperate with partners they don’t control, on networks they can’t compromise. With 9.0, they no longer have to choose between the two. Rocket.Chat speaks the protocols their partners already run, and every channel stays inside a boundary they govern.
01Native XMPP server foundation: connect partners on the protocol they already run
Coalition networks already run on XMPP, and NATO's own conformance standard, the FMN Spiral 5 Standards Profile, specifies XMPP-based text collaboration. Many partner nations and agencies already run Rocket.Chat, but others run XMPP-based platforms like JChat, Prosody, Openfire or ejabberd, and they cannot migrate on someone else's timeline.
When the sanctioned tool can't reach the partner, people route around it: WhatsApp, Signal, SMS. Governance breaks at exactly the point where it is least dispensable.
9.0 introduces the native XMPP server foundation: a purpose-built, server-side federation capability. Rocket.Chat joins the existing XMPP network as a native protocol participant, inside your trust boundary:
- 1:1 chat, persistent group channels and presence, with identities represented in both directions.
- Only pre-authorised, mapped identities can cross the boundary.
- Non-rip-and-replace: the partner's XMPP server and clients keep running untouched.
- Air-gapped and built to be accreditation-ready, inside one accreditation scope with no second server to accredit.
- Alongside native Matrix, so one workspace speaks both dominant federation protocols natively.
The result: the partner doesn't have to move. Federated conversations carry real, authorised identities, and coalition teams can move partners up the interoperability ladder without asking anyone to change systems.
One workspace, federated over native Matrix and native XMPP. Every message keeps its real sender.
Availability: the native XMPP server foundation is part of 9.0, and we can demonstrate it live today, so talk to us.
Our customers don’t get to choose what their partners run. With the native XMPP server foundation in 9.0, Rocket.Chat speaks XMPP natively, alongside Matrix, so a coalition or an agency can connect on day one without forcing anyone to migrate. Every federated message keeps its real sender, inside one boundary our customers govern.
02Native video (Beta): the real-time comms bundle, complete
Buyers are being pushed toward clouds they aren't allowed to use. Skype for Business Server 2015 and 2019 went out of support on 14 October 2025, and the major migration paths lead to each vendor's own cloud. The sanctioned replacement for a retiring on-premises tool can't follow the work into the environments where the work happens.
With 9.0, video conferencing is now native to Rocket.Chat, 1:1 and in groups, started from any channel or direct message. It joins WebRTC voice, SIP voice and screen sharing, which are already generally available.
That means voice, video, screen sharing and messaging in one deployment, one security model and one accreditation scope, including on-premises and air-gapped, where commercial services can't go. It fits deployments where a second, separately accredited platform is out of proportion to the user count: a small forward enclave, a single air-gapped cell, a temporary network. And it keeps the everyday escalation from chat to a call inside the same system boundary.
Escalate from chat to video without leaving the channel, or the accreditation scope.
Native video ships as Beta, built for internal team calls between people in the same workspace. Scheduled meetings, calls across federation and guest access are not part of this release. Native video is available as an add-on on Commercial, Government and Defense plans.
03ABAC-enforced workspace: one boundary for every channel
Enforcement is the difference between having an ABAC feature and having a boundary an accreditation authority can certify. The pressure is real on both sides of the Atlantic: DoD Components must reach target-level Zero Trust by 30 September 2027 under DTM 25-003, and NIS2 makes access control a named legal obligation, with fines up to €10M or 2% of turnover.
Rocket.Chat 8.0 brought ABAC to individual channels. 9.0 makes it mandatory and unbypassable across the whole workspace:
- No attributes, no channel. Every route that creates a channel either carries attributes or is blocked.
- Pre-existing channels without attributes are locked until an authorised member assigns them.
- Channel owners comply without an administrator, because attribute selection lives in the standard create and edit channel flows.
- An external policy decision point, not hardcoded rules, decides which attribute combinations may exist.
- No silent changes: every attribute change shows who gains and who loses access before it is enforced.
One policy boundary around every channel and team.
For security teams, access control stops being a recurring evidence exercise and becomes a property of the system. Administrators come off the critical path of every new classified space, and owners make informed decisions.
Enforcement is opt-in through a workspace setting and changes the state of existing channels the moment it is switched on, so plan a documented rollout. Our professional services team can help. Direct messages and group DMs are outside enforcement and show an awareness banner instead.
Classification banners: everyone sees what the channel is
Marking obligations are real, but too often they live in policy documents instead of on the collaboration surface. Admins define US Government-style classification banners for channels and teams, covering access level, special access programs, releasability and colours. On ABAC-managed channels, the marking comes from the channel's attributes, so marking and access control never drift apart, and every member sees it, all the time.
The banner comes from the channel's attributes, so marking and access never drift apart.
In classified environments, a boundary that can be bypassed isn’t a boundary. 9.0 makes attributes part of how every channel is born, and shows owners exactly who gains and loses access before anything changes. That’s what an accreditor can sign off on.
04Hybrid search strengthens the Governed AI bundle
Operators rarely lack information. They can't find it fast enough, and when they can, it's the exact term (a callsign, a grid reference, a ticket number) or the related meaning that gets missed.
9.0 brings hybrid search to Governed AI: a full-text index and semantic vector similarity, ranked together, so one query finds the exact term and the related conversation, across channels and time. Hybrid search is available as an add-on on Commercial, Government and Defense plans.
Answers from your own records, with sources, inside your perimeter.
With hybrid search in place, Governed AI is a complete bundle: five capabilities in three moves, assist, retrieve and act, in ascending order of autonomy:
| Move | Capability | What it does |
|---|---|---|
| Assist | Summarization and translation | Connect any OpenAI-compatible model, then summarize or translate any conversation in place. |
| Retrieve | Knowledge management | Load your own data into the Rocket.Chat AI pipeline and query it in chat through retrieval-augmented generation. |
| Retrieve | Intelligent search (new in 9.0: hybrid) | Index and retrieve across channels, combining full-text and semantic search in one ranking. |
| Act | Agent Development Kit | Build governed agents and deploy them into selected channels to run the skills you define. |
| Act | Rocket.Chat MCP Server | Expose the workspace as governed tools, so internal and external agents can act inside Rocket.Chat. |
Three commitments hold across all of it:
- Any model: customer-selected, OpenAI-compatible models in customer-controlled infrastructure.
- No egress: with the model inside your perimeter, no conversation or document leaves it.
- Permission-scoped: retrieval and agents respect channel membership and ABAC, request by request.
Combined with the ABAC-enforced workspace, 9.0 is the first release where both are true at once: retrieval can't surface a channel the user couldn't open, and an agent can't act beyond the attributes of the person it acts for. That opens up air-gapped AI in accredited environments, knowledge retrieval across years of operational history, and agent-driven workflows with a human approving every action.
Our customers want AI, but not at the cost of their access model. Everything in Governed AI inherits the platform’s permissions, runs on a model they choose and stays inside their perimeter. Hybrid search makes that knowledge findable on day one.
05Other enhancements
User presence visibility controls
Each person can now choose who sees their status. People in their chosen audience see them as usual; everyone else sees Offline, with no sign that it's hidden. In operational and government settings, that means someone can stay reachable to their team and command staff without broadcasting their availability to the whole workspace. It's off by default, each user manages their own audience, and changes apply live.
The right people see who's online. Nobody else does.
06Identity management changes for Community Edition
With Rocket.Chat 9.0, LDAP, SAML, social logins and Custom OAuth will be available exclusively on Starter, Commercial, Government and Defense plans. Community Edition keeps native local authentication plus OAuth login for Apple, GitHub, GitLab, Google and Nextcloud.
Read the full announcement from our CEO, Gabriel Engel, on the Rocket.Chat forum.
Identity management is the security backbone of any organization, and maintaining integrations with external directories takes continuous engineering, security audits and compliance work. This change funds that work and supports the long-term sustainability of the open-source project.
If your Community Edition workspace uses LDAP, SAML, Custom OAuth or a social login outside the supported five, you have three options before applying 9.0:
- Upgrade, or move to Starter, keeping your current identity setup and gaining background sync and group mapping. Starter is free for up to 50 users, with one workspace per organization.
- Switch authentication: move users to native local authentication or a supported OAuth provider before applying 9.0.
- Stay on your current version until it reaches end of support. Check the dates in the Version Durability Matrix.
Avoid getting locked out. Before you update, make sure at least one admin can sign in with a local Rocket.Chat username and password. Prevent Login Issues When Upgrading to Rocket.Chat 9.0 walks through the steps, and how to recover access if you've already updated and can't sign in.
07Bug fixes
This release includes a number of fixes to improve overall stability, performance and user experience. For the full list, see the official release notes.
08How to update
SaaS workspaces
Cloud workspaces update automatically. Rollout happens gradually and can take a few weeks to reach every workspace; contact support if you need earlier access.
Self-managed workspaces
Follow the update instructions in our documentation to upgrade to 9.0. Community Edition workspaces using external identity integrations should review the options above first.
Want to see the native XMPP server foundation live, or plan an ABAC-enforced rollout? Talk to our team.
