Add docs for experimental mobile watermarking (v11.7) (#8954)

Combs7th · github-actions[bot] · amyblais · web-flow · commit 5a407fa97097 · 2026-07-08T12:28:41.000-04:00
* Add docs for experimental mobile watermarking (v11.7) Documents the new Enterprise, experimental "Enable Mobile Watermark" setting introduced by mattermost/mattermost#36025 and the visible mobile watermark overlay introduced by mattermost/mattermost-mobile#9682: - experimental-configuration-settings.rst: new "Enable Mobile Watermark" entry (Experimental > Features, disabled by default, Enterprise-only, v11.7 onward). - deployment-guide/mobile/mobile-security-features.rst: deep-dive "Mobile watermarking" section describing the username/domain/date/time overlay and its DLP-attribution purpose. - security-guide/mobile-security.rst: short overview section linking to the deep-dive and to the experimental config setting. Refs issue #8953. Co-authored-by: Combs7th <Combs7th@users.noreply.github.com> * Clarify Enterprise plan scope for mobile watermarking Address CodeRabbit review: explicitly state Enterprise and Enterprise Advanced plan availability in the deployment-guide mobile watermarking section to mirror the admin and security pages and avoid misleading self-hosted, non-Enterprise admins. Co-authored-by: Combs7th <Combs7th@users.noreply.github.com> * Update generate_changelog.py * Update generate_changelog.py * Update generate_changelog.py * Update generate_changelog.py * Update experimental-configuration-settings.rst * Update mobile-security-features.rst * Update mobile-security.rst --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Combs7th <Combs7th@users.noreply.github.com> Co-authored-by: Amy Blais <29708087+amyblais@users.noreply.github.com> Co-authored-by: Eric Sethna <14333569+esethna@users.noreply.github.com>
diff --git a/source/administration-guide/configure/experimental-configuration-settings.rst b/source/administration-guide/configure/experimental-configuration-settings.rst
@@ -315,6 +315,34 @@ Changes made when hardened mode is enabled:
 | This feature's ``config.json`` setting is ``"ExperimentalEnableHardenedMode": false`` with options ``true`` and ``false``. |
 +----------------------------------------------------------------------------------------------------------------------------+
 
+.. config:setting:: enable-mobile-watermark
+  :displayname: Enable Mobile Watermark (Experimental)
+  :systemconsole: Experimental > Features
+  :configjson: ExperimentalSettings.EnableMobileWatermark
+  :environment: N/A
+
+  - **true**: Authenticated Mattermost mobile sessions display a watermark overlay showing the user's username, the server domain, the current date (YYYY-MM-DD), and the current time (HH:mm) for data loss prevention (DLP) purposes.
+  - **false**: **(Default)** No watermark overlay is displayed in the Mattermost mobile app.
+
+Enable Mobile Watermark
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Available on `Enterprise Advanced <https://mattermost.com/pricing/>`__ from Mattermost v11.7 onward.
+
+**True**: Authenticated Mattermost mobile sessions display a watermark overlay showing the user's username, the server domain, the current date (YYYY-MM-DD), and the current time (HH:mm). This experimental capability is intended to support data loss prevention (DLP) workflows by helping identify the user, server, and time associated with mobile screenshots or shared screen captures.
+
+**False**: No watermark overlay is displayed in the Mattermost mobile app.
+
+.. note::
+
+  - This is an experimental setting. Behavior, defaults, and visual presentation may change in future releases.
+  - This setting only applies to the Mattermost mobile app. It does not add a watermark to the Mattermost web app or desktop apps.
+  - The watermark overlay is a visual aid and does not, by itself, prevent screenshots, screen recordings, file exports, or other forms of data extraction. Use it in combination with other mobile security controls, such as :ref:`screenshot and screen recording prevention <deployment-guide/mobile/mobile-security-features:screenshot and screen recording prevention>`, where appropriate.
+
++--------------------------------------------------------------------------------------------------------------------------------------+
+| This feature's ``config.json`` setting is ``"ExperimentalSettings.EnableMobileWatermark": false`` with options ``true`` and ``false``. |
++--------------------------------------------------------------------------------------------------------------------------------------+
+
 .. config:setting:: enable-theme-selection
   :displayname: Enable theme selection (Experimental)
   :systemconsole: Experimental > Features
diff --git a/source/deployment-guide/mobile/mobile-security-features.rst b/source/deployment-guide/mobile/mobile-security-features.rst
@@ -53,6 +53,26 @@ Preventing file downloads protects sensitive information from being inadvertentl
 
 See the :ref:`secure file preview <administration-guide/configure/environment-configuration-settings:enable secure file preview on mobile>` and :ref:`managing PDF link navigation <administration-guide/configure/environment-configuration-settings:allow pdf link navigation on mobile>` configuration settings documentation for details on enabling these features.
 
+Mobile watermarking
+-------------------
+
+Mobile watermarking is an experimental Enterprise Advanced capability <https://mattermost.com/pricing/>`__ from Mattermost v11.7 onward, that helps organizations attribute mobile screenshots and shared screen captures to a specific user, server, and point in time. When this setting is enabled by a system admin, authenticated Mattermost mobile sessions display a visible watermark overlay on top of the app interface that includes:
+
+- The user's username.
+- The server domain.
+- The current date in ``YYYY-MM-DD`` format.
+- The current time in ``HH:mm`` format.
+
+The watermark is intended to support data loss prevention (DLP) workflows by making it easier to identify the source and timing of any image taken of the Mattermost mobile app. Mobile watermarking is disabled by default.
+
+See the :ref:`Enable Mobile Watermark <administration-guide/configure/experimental-configuration-settings:enable mobile watermark>` configuration setting documentation for details on enabling this experimental feature.
+
+.. note::
+
+  - The mobile watermark is a visual overlay only. It does not prevent users from taking screenshots, recording the screen, exporting files, or sharing content through other means. For controls that block screen capture on the device itself, see :ref:`screenshot and screen recording prevention <deployment-guide/mobile/mobile-security-features:screenshot and screen recording prevention>`.
+  - This feature applies only to the Mattermost mobile app. It does not add a watermark to the Mattermost web app or desktop apps.
+  - This is an experimental capability. Its behavior, defaults, and visual presentation may change in future releases based on customer feedback.
+
 Microsoft Intune Mobile Application Management (MAM)
 ----------------------------------------------------
 
@@ -137,4 +157,4 @@ Security compliance
 
   - Device Protection Profiles (NIAP Evaluation)
   - Security Dependency & Code Analysis
-  - Code Complexity & Testing Standards
+  - Code Complexity & Testing Standards
diff --git a/source/security-guide/mobile-security.rst b/source/security-guide/mobile-security.rst
@@ -87,11 +87,20 @@ Additionally, administrators can control link navigation within PDF files when s
 
 Learn more about :ref:`enabling secure file preview on mobile <administration-guide/configure/environment-configuration-settings:enable secure file preview on mobile>` and :ref:`allow PDF link navigation on mobile <administration-guide/configure/environment-configuration-settings:allow pdf link navigation on mobile>` in the Mattermost mobile app.
 
+Mobile watermarking
+-------------------
+
+Mobile watermarking is an experimental Enterprise Advanced capability available from Mattermost v11.7 onward that helps organizations identify the source and timing of mobile screenshots or shared screen captures. When enabled by a system admin, authenticated Mattermost mobile sessions display a visible watermark overlay that includes the user's username, the server domain, and the current date and time. This supports data loss prevention (DLP) workflows by attributing any image taken of the Mattermost mobile app to a specific user, server, and point in time.
+
+The mobile watermark is a visual overlay only. It does not prevent screenshots, screen recordings, file exports, or content sharing through other means, and it is not a substitute for screen capture prevention or other mobile security controls. Mobile watermarking is disabled by default.
+
+Learn more about Mattermost :ref:`mobile watermarking <deployment-guide/mobile/mobile-security-features:mobile watermarking>` and how to :ref:`enable the experimental Mobile Watermark setting <administration-guide/configure/experimental-configuration-settings:enable mobile watermark>`.
+
 Burn-on-read messages
 ---------------------
 
 Burn-on-read messages reduce the window of exposure for sensitive content by automatically deleting messages after they are revealed. This approach supports secure, time-bound communication by ensuring that sensitive information doesn't persist on the device longer than necessary.
 
 Administrators can enable burn-on-read messaging and set the burn-on-read duration to align with organizational policies. Learn more about :ref:`sending burn-on-read messages <end-user-guide/collaborate/send-messages:send burn-on-read messages>` and :ref:`enabling burn-on-read messages <administration-guide/configure/site-configuration-settings:enable burn-on-read messages>`.
 
-`Book a live demo <https://mattermost.com/request-demo/>`_  or `talk to a Mattermost expert <https://mattermost.com/contact-sales/>`_ to explore tailored solutions for your organization's secure collaboration needs. Or try Mattermost yourself with a `1-hour preview <https://mattermost.com/sign-up/>`_ for instant access to a live sandbox environment.
+`Book a live demo <https://mattermost.com/request-demo/>`_  or `talk to a Mattermost expert <https://mattermost.com/contact-sales/>`_ to explore tailored solutions for your organization's secure collaboration needs. Or try Mattermost yourself with a `1-hour preview <https://mattermost.com/sign-up/>`_ for instant access to a live sandbox environment.
