Running Antimatter for an organisation

A company or organisation workspace needs more control than a hobby community: who can get in, what outsiders see, how long messages are kept and how they are archived. Most of these are server settings: this page says what exists, what you can do yourself, and what to ask your system admin for.

Who decides what

In an organisation, the community admins usually run the workspace day to day, and an IT team runs the server. The split is:

• You, as community admin: the community's settings, channels and categories, roles, onboarding, member attributes, guests' channels, moderation and integrations. All of it is described in this guide.
• The system admin: who can create an account and how people sign in, guest accounts, the server-wide permissions, message retention, compliance exports, privacy settings and the apps. These are in the System Console.

If your server is only for your organisation, ask your system admin to set Kind of new communities to Workspace (System Console › Site Configuration › Users and Teams), so that every new community is a workspace. Set before the upgrade to Antimatter 0.9.0 (with the environment variable AM_TEAMSETTINGS_DEFAULTCOMMUNITYKIND=workplace), it also applies to the communities that already exist; afterwards, each community's admins change its kind themselves.

In a small organisation the same person often does both. If you are a system admin, you'll find the System Console from your avatar menu; the settings themselves are explained in Running a server.

Control who gets in

In the community:

• Make the community private (Private Team in Community settings › Access), so that nobody joins without an invitation.
• Allow only your organisation's email domains to join (see Who can join).
• Regenerate the invitation link when someone leaves who might still have it.

On the server, ask your system admin about:

• Sign-in with your company accounts: Antimatter can sign people in with AD/LDAP, SAML 2.0, OpenID Connect, Google or Office 365, in System Console › Authentication. People then use the account they already have, and leaving the company closes their access.
• Group sync: with AD/LDAP, groups of your directory can manage who is in a community and in its private channels. The community's Access tab then says that its members are added and removed by linked groups.
• Account creation: Enable Account Creation and Restrict new system and team members to specified email domains, in System Console › Authentication › Signup.
• Membership rules based on attributes: with attribute-based access control (System Console › System Attributes › Attribute-Based Access), a community or a channel can be kept for people whose attributes match, such as a department or a clearance level. Once it is on, your community settings show Team Membership and Channel Membership tabs, and channel settings show a Membership Policy tab.

Guests from outside

Guests let you work with clients, contractors and partners in a few channels, without giving them the rest of the workspace (see Guests). Guest accounts are off until a system admin turns them on in System Console › Authentication › Guest Access, where they can also:

• list the email domains guests may come from (Whitelisted Guest Domains);
• require two-factor authentication for guests (Enforce Multi-factor Authentication);
• allow guests to sign in with a link sent by email, without a password.

Good practice: give each partner organisation its own private channel, and look at the guests in your community from time to time. Channels with guests say so in their header, so nobody forgets who is reading.

Channels and structure

• Set Kind of community to Workspace (Community settings › General): the people who create a channel can then archive it, and calls are on in channels. See Kind of community.
• Turn off Members are in every channel (Community settings › General), unless setting the kind to Workspace already did (see below): in a workspace, people join the channels of their work and leave the others.
• Use the Workspace or Hybrid layout, and categories for everyone for the channels that matter to all (announcements, IT help, the office). The Workspace preset sets the kind to Workspace and turns Members are in every channel off by itself; Hybrid sets the kind to Guild instead, so set it back to Workspace afterwards.
• Create teams for your departments, with their tag, lead and channel, and turn on Everyone shows a team badge so that people see at a glance who works where (see Teams inside a community).
• Use member attributes set by admins for details such as the site, the company of a subcontractor or the contract type (see Member attributes).
• Keep sensitive channels private, and if needed keep them for some roles only (see Channel permissions).

Privacy between colleagues

These are server settings, in System Console › Site Configuration › Users and Teams:

• Show Email Address and Show Full Name: whether people see each other's email addresses and full names. Both are shown by default.
• Enable users to open Direct Message channels with: Any user on the Antimatter server, or only Any member of the team, that is people who share a community.
• Enable ignoring, blocking and message requests: on by default. Many workplaces turn it off so that colleagues are always reachable; the choices people made are kept in case it is turned back on.
• Restrict channel export to admins: by default anyone who can read a channel can export its messages to a CSV file. Turn this on to keep exports for channel, community and system admins.

How long messages are kept

By default Antimatter keeps every message and file forever. A system admin can set a data retention policy in System Console › Compliance › Data Retention Policies:

• a Global retention policy, which deletes messages and files after a set time on the whole server;
• Custom retention policies, for specific communities and channels, for example to keep a legal channel longer or a social channel shorter.

Deleted messages are permanently erased. Agree on the durations with your legal or compliance team before asking for a policy.

Archiving and compliance

• Compliance export (System Console › Compliance › Compliance Export): a regular export of all messages to CSV, Actiance XML or Global Relay EML, for an archiving system. It is off by default.
• Channel export: to hand over one channel's history, export it yourself to CSV from its menu (see Export a channel).
• Edit time limit: in the server's permissions, a system admin can limit how long after posting people may edit their own messages.
• Reports of sensitive information: members can report a message that shouldn't be there, for example personal data posted in the wrong channel. It is then hidden while reviewers decide. A system admin turns this on and chooses the reviewers in System Console › Site Configuration › Data Spillage Handling (see Reports).
• Classification markings (System Console › Site Configuration › Classification Markings): a banner with a classification level at the top and bottom of the app, and a level per channel.
• Custom Terms of Service (System Console › Compliance): terms that everyone must accept before using the server.
• Audit log: the server records administrative and moderation actions in its audit log, which system admins can read.

What to ask your system admin