Chatto Self-Hosted: The Privacy Answer to EU Chat Control

On July 9, 2026, the EU Parliament voted to greenlight Chat Control 1.0. The vote was 276 in favor, 314 against, with 17 abstentions. A majority of MEPs actually opposed it, but the motion to reject needed an absolute majority of 361 votes. It didn’t get them.

What this means in practice: US tech companies are once again allowed to scan private messages without a warrant. This affects direct messages on Instagram, Discord, Snapchat, Skype, Xbox, and emails through Gmail and iCloud. The exemption lasts until April 3, 2028, unless a permanent deal is reached first.

Patrick Breyer, former MEP and civil rights activist, put it bluntly: “Our children are the real losers in this undemocratic process.” He’s right. The EU Commission’s own data shows mass scanning accounted for only 36% of abuse reports in 2024. The German Federal Criminal Police (BKA) reports that 48% of alerts aren’t even criminally relevant. And 99% of Meta’s reports are previously known material. (Source)

You can read the full legislative analysis on Patrick Breyer’s site. The political fight over Chat Control 2.0 — the permanent CSAM regulation — resumes in September 2026. But you don’t have to wait for politicians to fix this.

The fastest way to opt out of mass surveillance is to stop using platforms that participate in it. If your team runs on Slack or Discord, your messages sit on US servers subject to scanning. A self-hosted chat server on a VPS you control fixes that in an afternoon.

Enter Chatto.

Why EU Chat Control Changes Everything

Let’s be precise about what just happened.

The EU Parliament didn’t pass a new surveillance law. It extended a temporary derogation that had been in place before, allowing US tech companies to voluntarily scan private messages for child sexual abuse material (CSAM). The key word is voluntarily — these companies chose to implement scanning, and the EU just gave them legal cover to keep doing it.

The numbers tell a different story than the one politicians sell:

• 36% — the share of abuse reports that came from mass scanning of private chats in 2024. The majority came from public posts and cloud storage, which were never affected by this law.
• 48% — alerts from the German BKA that turned out to not be criminally relevant at all.
• 40% — investigations triggered by chat control that ended up targeting minors themselves, not adult predators.
• 99% — Meta’s reports that consisted of previously known material, doing little to stop active abuse.
• Zero — evidence from the EU Commission that suspicionless scanning increased convictions or rescued children.

A symbolic exemption was added for end-to-end encrypted communications. WhatsApp and Signal users aren’t directly affected — by this vote. But here’s what matters for teams: most team chat tools (Slack, Discord, Microsoft Teams) don’t use end-to-end encryption for messages. Your team’s conversations on those platforms are exactly what Chat Control targets.

And Chat Control 2.0 — the permanent regulation — is still in trilogue negotiations. If it passes with scanning mandates, the scope could expand. The precedent is set.

The practical response isn’t to wait and see. It’s to move your team’s communication to infrastructure you own.

What Is Chatto

Chatto is a self-hosted team chat application, open-sourced on July 8, 2026 by developer Hendrik Mans. It’s written in Go (41.7%), TypeScript (40.2%), and Svelte (11.1%), and licensed under AGPL-3.0.

The pitch is simple: a single ~50 MB binary that serves its own web frontend, requires no database, and uses NATS for persistence. It supports voice and video calls through LiveKit, encrypts data at rest with per-user keys, and includes zero third-party tracking or analytics.

Current release is v0.4.4 with ~1,400 GitHub stars. The developer targets 1.0 within 6–12 months. Each server is fully isolated — no federation by design, which is actually a privacy feature. No data leaks between servers because there’s no inter-server communication at all.

Key features:

• No database required — NATS handles all persistence
• Single binary — works on Linux (x86_64 & ARM64), macOS, Windows, FreeBSD
• Voice/video calls — powered by LiveKit, end-to-end encrypted, includes screen sharing
• Encryption at rest — per-user keys with crypto-shredding on account deletion
• SSO support — OIDC, Google, GitHub, Discord
• Roles and permissions — fine-grained, room groups as permission boundaries
• Multiple servers in one client — connect to several Chatto servers at once
• PWA — install on mobile via browser; native apps planned but not available yet
• ConnectRPC + GraphQL APIs — for bots and integrations

Official resources: chatto.run | docs.chatto.run | Community server

Chatto vs Slack and Mattermost

If you’re evaluating Chatto as a self-hosted Slack alternative, here’s how it stacks up against the main competitors.

Feature comparison table

Pricing comparison

Let’s talk money. Here’s what a 50-person team pays annually:

Mattermost’s free tier used to be competitive. In v10/v11 they stripped out SSO and voice calls. If your team needs those features — and most teams do — you’re looking at $10/user/month.

Self-Hosting Chatto With a Standalone Binary

The standalone binary is the fastest way to try Chatto. Five minutes from download to running server. This path uses an embedded NATS instance — no external dependencies.

Step 1: Download the binary

Grab the latest release from GitHub. For Linux x86_64:

# Download latest release (check https://github.com/chattocorp/chatto/releases for the current version)
wget https://github.com/chattocorp/chatto/releases/download/v0.4.4/chatto-linux-amd64.tar.gz
tar xzf chatto-linux-amd64.tar.gz
chmod +x chatto-linux-amd64
sudo mv chatto-linux-amd64 /usr/local/bin/chatto

For ARM64 servers (like Hetzner CAX instances):

wget https://github.com/chattocorp/chatto/releases/download/v0.4.4/chatto-linux-arm64.tar.gz
tar xzf chatto-linux-arm64.tar.gz
chmod +x chatto-linux-arm64
sudo mv chatto-linux-arm64 /usr/local/bin/chatto

Step 2: Initialize the configuration

chatto init

This generates a chatto.toml configuration file in the current directory. Edit it to set your domain, SMTP credentials, and admin email.

Step 3: Start the server

chatto run

Chatto serves its web frontend on the configured port. For production use with TLS, you can enable the built-in Let’s Encrypt support in chatto.toml or put it behind a reverse proxy.

Step 4: Run as a systemd service (optional)

For persistent operation, create a systemd unit:

[Unit]
Description=Chatto Chat Server
After=network.target

[Service]
Type=simple
User=chatto
WorkingDirectory=/opt/chatto
ExecStart=/usr/local/bin/chatto run
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now chatto

If you haven’t set up Docker yet, see our guide on installing Docker on Ubuntu ARM.

Self-Hosting Chatto With Docker Compose

This is the recommended production setup. You get separate NATS for data persistence (survives container restarts), LiveKit for voice/video calls, and Caddy for automatic TLS.

Prerequisites

For VPS providers, check our DigitalOcean vs Vultr vs Hetzner comparison. The Hetzner Cloud review covers why CX22 at €3.99/month is the sweet spot for this kind of workload.

Required ports:

• TCP 80, 443 — web traffic and TLS
• UDP 3478, 50000-50200 — for LiveKit voice/video calls (only needed if you enable calls)

You also need a livekit.* subdomain pointing to the same VPS (e.g., livekit.chat.example.com). Caddy uses this for the LiveKit WebSocket endpoint that browsers connect to for calls.

docker-compose.yml walkthrough

Clone the Docker Compose example from the main Chatto repository:

git clone --depth 1 --filter=blob:none --sparse https://github.com/chattocorp/chatto.git chatto-source
git -C chatto-source sparse-checkout set examples/dockercompose
cp -R chatto-source/examples/dockercompose chatto
rm -rf chatto-source
cd chatto

Run the initialization script to generate your .env file and LiveKit secrets:

chmod +x init-env.sh
./init-env.sh chat.example.com [email protected]

Replace chat.example.com with your domain and [email protected] with the email for the first owner account. The script generates .env and livekit.generated.yaml with matching NATS, Chatto, and LiveKit secrets.

Open .env and configure your SMTP credentials:

# Domain (must have DNS A record pointing to this server)
CHATTO_DOMAIN=chat.example.com

# Admin email (for Let's Encrypt TLS and first owner account)
[email protected]

# SMTP settings (required for user registration)
CHATTO_SMTP_ENABLED=true
CHATTO_SMTP_HOST=smtp.sendgrid.net
CHATTO_SMTP_PORT=587
CHATTO_SMTP_USER=apikey
CHATTO_SMTP_PASSWORD=your-api-key-here
[email protected]

# LiveKit settings (auto-generated by init-env.sh)
CHATTO_LIVEKIT_API_KEY=...
CHATTO_LIVEKIT_API_SECRET=...

The docker-compose.yml defines four services:

services:
  chatto:
    image: ghcr.io/chattocorp/chatto:latest
    restart: unless-stopped
    volumes:
      - chatto_data:/data
    env_file: .env
    depends_on:
      - nats

  nats:
    image: nats:latest
    restart: unless-stopped
    command: "--jetstream --store_dir /data"
    volumes:
      - nats_data:/data

  livekit:
    image: livekit/livekit-server:latest
    restart: unless-stopped
    command: "--config /etc/livekit.yaml"
    volumes:
      - ./livekit.yaml:/etc/livekit.yaml:ro
    ports:
      - "3478:3478/udp"
      - "50000-50200:50000-50200/udp"

  caddy:
    image: caddy:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config

volumes:
  chatto_data:
  nats_data:
  caddy_data:
  caddy_config:

The architecture flows like this:

For more on configuring environment variables in Docker, see our guide on environment variables in Docker.

Starting and updating

Start the stack:

docker compose up -d

Verify everything is running:

docker compose ps

All four services should show as running. Check logs if something isn’t right:

docker compose logs -f chatto

# Pull the latest images
docker compose pull

# Recreate containers with the new images
docker compose up -d

What Does It Cost to Run Chatto

Chatto itself is free. The only cost is the VPS it runs on.

Here’s what real pricing looks like as of July 2026:

The developer’s own benchmarks: Chatto uses tens of MB at idle and roughly 10 MB per additional connected user. A 1 GB VPS handles a small team. A 4 GB VPS (like Hetzner CX22) is comfortable for 20–30 concurrent users with LiveKit calls running.

Now compare annual costs for a 50-person team:

For more VPS pricing details, check the Hetzner Cloud review and our DigitalOcean vs Vultr vs Hetzner benchmarks.

Privacy and Encryption Deep-Dive

“Privacy” is a marketing word until you explain the mechanism. Here’s how Chatto actually protects your data.

Encryption at rest. Every user gets a unique encryption key. Message text and personally identifiable information (PII) are encrypted before being written to NATS. If someone gains raw access to the NATS storage, they can’t read the messages without the per-user keys.

Crypto-shredding. When a user deletes their account, their encryption key is destroyed. The encrypted data remains on disk but is mathematically irrecoverable. This is a GDPR-friendly approach — you can prove data is gone without relying on “we promise we deleted it.”

No third-party tracking. No Google Analytics, no Sentry breadcrumbs, no Mixpanel events. Chatto doesn’t phone home. The only external connections are the ones you configure (SMTP, S3, OIDC providers).

Server isolation. Each Chatto server is fully independent. No federation means no data leaks between organizations. Your server knows nothing about other Chatto servers. This is a deliberate design choice, not a missing feature.

Calls are E2EE. Voice and video calls through LiveKit use end-to-end encryption. Even your own server can’t intercept call content.

GDPR compliance. Host Chatto on a European VPS (Hetzner is in Germany and Finland), and your data never leaves the EU. You are the data processor. You decide retention policies, access controls, and deletion schedules. Compare this to Slack or Discord, where data sits on US servers subject to FISA warrants, National Security Letters, and now Chat Control scanning.

For another privacy-first self-hosted tool, see our guide to install Plausible Analytics — cookie-free analytics you own.

Honest Caveats and Limitations

Chatto is impressive for a project that went open-source three days ago. But it’s not finished, and you should know what you’re signing up for.

Pre-1.0 software. Current version is v0.4.4. Breaking changes are possible until 1.0, which the developer targets in 6–12 months. Configuration formats, APIs, and data structures may change.

Single developer. Hendrik Mans built Chatto himself and is not accepting outside contributions (per the CONTRIBUTING.md). The bus factor is real. AGPL means the code is open forever and can be forked, but the primary development depends on one person.

No native mobile apps. Chatto works as a PWA — you install it from the browser on your phone. It’s decent but not the same as a native app with push notifications. Native iOS and Android apps are planned but not available.

No E2EE for text messages. Calls are end-to-end encrypted via LiveKit. Messages are encrypted at rest but not between clients. This is the same model as Slack and Mattermost, but it’s not Signal-level privacy.

AGPL license. If you modify the Chatto server and offer it as a service to others, you must release your modifications under AGPL. For internal team use, this is a non-issue. For SaaS businesses planning to white-label it, talk to a lawyer.

No content moderation tools yet. Version 0.5 is adding reporting features. If you’re running a public community, moderation is limited for now.

No Slack import. Migration from Slack is planned but not available today. You’d be starting fresh.

Chat Control 1.0 targets unencrypted messages on US platforms. WhatsApp and Signal users are technically unaffected by this specific vote. But the vote sets precedent, and Chat Control 2.0 could change the rules.

Final Verdict: Should You Self-Host Chatto?

The EU just legalized mass scanning of private messages on major US-owned platforms. The stats show this approach doesn’t work — 99% of Meta’s reports are known material, 48% of alerts aren’t criminally relevant, and there’s zero evidence it rescued children. But the law is the law, and it runs until 2028.

You have three options:

1. Do nothing. Keep using Slack/Discord and accept that your team’s messages are subject to scanning.
2. Switch to an E2EE messenger. Signal and WhatsApp protect 1:1 chats, but they’re not team chat tools. No channels, no roles, no file history.
3. Self-host Chatto. Run a lightweight, privacy-first chat server on a VPS for €4/month. Full control, no scanning, no tracking.

Chatto isn’t perfect. It’s pre-1.0, has no native mobile apps, no E2EE for text messages, and depends on a single developer. Those are real limitations.

But the math is hard to argue with: a single ~50 MB binary, no database, tens of MB of RAM, voice/video calls, SSO, encryption at rest — all for $0 in software costs and €4/month in hosting. For a team of 50, that’s €48/year vs. $6,000/year for Mattermost Pro.

If you already self-host other tools on your VPS, Chatto is a natural addition to the stack. You own the server, you own the data, and no parliament vote changes that.

Once Chatto is running, monitor it with Uptime Kuma so you know if it goes down. If you want a simpler deployment experience with a web UI, Coolify as a self-hosted PaaS can manage the Docker stack for you.