Element’s multi-tenancy TI-Messenger solution secures ‘Good’ rating in gematik commissioned pentest

Element’s multi-tenancy implementation of Synapse Pro has secured a Good rating in a penetration test commissioned by gematik, Germany’s national digital health agency.

The security analysis rating is an important milestone in the widespread adoption of gematik’s TI-M Pro standard, which creates a sovereign, interoperable and secure messenger for healthcare professionals, by embedding healthcare specific requirements on top of the decentralised Matrix open standard.

Gematik commissioned an external service provider to conduct the pentest. It used active exploitation techniques to assess the security status of Element's Synapse Pro multi-tenancy implementation - as used in Element Server Suite Pro for TI-Messenger - against best practice criteria, validate security mechanisms, and identify application-level vulnerabilities.

The resulting report found that: “The security of the tested application is rated as ‘Good’. Key interfaces of the Synapse Pro server, including both interfaces for Matrix clients and the server-to-server API, behaved in the examined solution in a manner consistent with a deployment scenario in which a dedicated Synapse instance is used for each tenant.”

The successful gematik pentest now brings external security validation to ESS Pro for TI-M, making it a proven and mature solution; ESS Pro for TI-M already being the server-side component in T-Systems’ TI-M ePA compliant communications solution for BARMER, which launched in July 2025.

A catalyst for local healthcare practitioners to adopt TI-Messenger

Multi-tenancy ESS Pro for TI-M is the first solution available to enable hosting providers to deliver a cost efficient TI-M Pro compliant service to family doctors, local clinics and high street pharmacies. 

Total cost of ownership efficiencies are driven by optimisations within Synapse Pro to reduce RAM usage and associated costs by around 90%, and server-side fleet management features to simplify the administration of thousands of multiple deployments.

For the first time, hosting providers now have a professional server-side solution to deliver affordable TI-M Pro compliant services profitably - even to small healthcare organisations with just a few employees.

A competitive marketplace is now ready to explode as healthcare technology providers race to provide TI-M Pro compliant communications to local healthcare providers. The ecosystem can now build their own frontend TI-M Pro clients, knowing that self-hosted ESS Pro for TI-M is a proven, cost efficient and secure solution backend.

The benefits of a professional server-side solution for TI-Messenger

Element Server Suite Pro for TI-Messenger (ESS Pro for TI-M) is the only standalone server-side product available for healthcare technology providers, enabling them to build their TI-Messenger solutions on top of a vendor-backed server built for TI-Messenger. It includes Synapse Pro, a TI-M Messenger Proxy, Push Gateway, dedicated Federation List Service for TI-M and stays aligned with evolving specifications.

Synapse Pro, an enhanced version of community Synapse, dynamically scales to save resources during low demand and automatically cover demand spikes to ensure performance. Resource savings for large single tenant deployments (meeting TI-M ePA standard) are typically in excess of 80%, and for multi-tenant (meeting the TIM Pro standard) are usually in excess of 90%. ESS Pro for TI-M also ensures stable operations with minimal downtime as it enables High Availability deployments, along with Element’s SLA, technical support and regular security updates. Perhaps most important for multi-tenancy deployments, ESS Pro for TI-M includes effective administration features to make it easy for a hosting provider to manage thousands of small hosts individually.

Organisations not using ESS Pro for TI-M have to build their own backend, typically by building from scratch on Element’s community FOSS Synapse implementation and then servicing the associated technical debt and maintenance burden. The community version of Synapse is not designed for commercial use. A host with just five end-users has a memory footprint of around 150MB, which is considerable for a service provider wanting to host 50,000 small hosts (for, say 50,000 local pharmacies) and makes providing such a service uneconomic. A subscription to ESS Pro for TI-M removes all of those challenges in an instant.

Multi-tenancy within ESS Pro for TI-M allows the pooling of resources, keeping costs predictable and performance consistent - while preserving the isolation each tenant requires. Each shard can support up to 50 tenants, with every tenant segregated at a database schema level. The solution is delivered with a Kubernetes controller to manage the shards and their tenants dynamically (via a tenant management API that is provided by Synapse Pro), and enables integration with continuous deployment tooling and GitOps processes for automation.

Similarly Element’s TI-Messenger Proxy is designed for performance, efficiency, and compliance. Built in Rust, it benefits from modern memory safety and concurrency models, reducing operational risk by eliminating data races. With an idle memory footprint of just 10 MB - compared to around 800 MB in the TI-M reference implementation - it is exceptionally resource efficient. The proxy fully complies with the latest TI-M Pro and TI-M ePA specifications, integrates with the FHIR Directory via a dedicated Federation List Service, and supports automatic, load-dependent scaling to ensure high availability and resilience.

A deep dive on multi-tenancy within ESS Pro for TI-M, given at Matrix Conference 2025.

Focus on your own frontend client

The successful pentest signals a game change for secure healthcare communications. With ESS Pro for TI-M providing a state-of-the-art server-side component for a TI-Messenger compliant solution, healthcare technology providers can focus their own development efforts on creating an outstanding frontend client for frontline healthcare professionals such as family doctors, local clinics and high street pharmacies.

Understanding and meeting healthcare professionals’ exact requirements will determine healthcare technology providers’ marketplace success, without having to focus on reinventing TI-Messenger server-side performance and features. Just as laptop and smartphone manufacturers work with semiconductor firms, the TI-Messenger ecosystem is now mature enough for healthcare technology providers to use highly specialised components as a part of their own overall solution.