Our company is contemplating the benefits of switching from Slack to Mattermost.
One of the arguments is that the 'sensitive information should be more secure because it is stored on our servers'.
But is it so?
Mattermost is open-source and vulnerabilities can be found and exploited any time. Even though Slack stores information on their servers, the probability of attacker exploiting exactly your data is smaller, since they would have to find it, assess it and deem it useful. And in an event of a Slack-wide server hack it would be known and there would be time left to do damage control.
Also Slack has all the incentives to keep security top level to ensure their business success and reputation.
Whereas a private Mattermost server could be less protected and fall pray to a targeted attack in which case the attacker would be able to exploit the information immediately and leave no time for damage control.
P.S. This is not a duplicate per se of the Open Source vs Closed Source Systems question. Quoting from top answer on the said 'duplicate' question: "To reason about this you must limit the discussion to a specific project.". This is a question about two specific projects.