We’re delighted to share that openDesk now deploys Element Server Suite (ESS) directly from Element. The Element frontend still reflects the openDesk product and branding, but now openDesk deploys Element Server Suite (ESS) directly from Element, the original manufacturer and product owner of the software. It brings hardened Kubernetes deployments, next-generation OIDC-based authentication and the complete ESS feature set to Germany’s sovereign office productivity suite.
We're joining ZenDiS on its openDesk stand (Stand 103 in Hall 27) at Smart Country Convention (SCCON) in Berlin, 13–15 October, so come and see us there!
Straight from the source
openDesk now deploys Element using our official ESS Helm chart, which brings three overarching benefits:
Hardened by default. The ESS Helm chart supports Kubernetes Pod hardening in line with the Restricted profile of the Kubernetes Pod Security Standards. Kubernetes describes this profile as "targeted at operators and developers of security-critical applications, as well as lower-trust users". That is exactly the environment openDesk is built for.
One product, one roadmap. Because openDesk runs the same ESS that Element ships to its own customers, new features and fixes reach openDesk providers faster, with the regular openDesk release cycle.
Next-generation authentication. With this move, openDesk providers can now migrate to the Matrix Authentication Service (MAS). MAS puts openDesk deployments on Matrix's next-generation authentication, defined in MSC3861 and built on the OpenID Connect (OIDC) open standard.
The result is a significant step up in security. Authentication follows a widely reviewed industry standard, and sign-in fits cleanly with the Univention Nubus based identity provider in openDesk.
A year of Element Web improvements
Since last year's Smart Country Convention a lot of updates have found their way into openDesk. The most visible change is the new room list, which is now the default for everyone. Rooms can be organised into custom sections, dragged between them, collapsed and reordered, with built-in sections for people and invites, unread-first sorting and a collapsible side panel that gets out of the way during calls.
Calling has matured alongside Element Call; calls show up as tiles in the timeline, incoming calls trigger regular desktop notifications with a decline button, picture-in-picture has been redesigned, and voice calls in direct messages run on Element Call too. Calling is built natively on Matrix and has end-to-end encryption, so calls get the same protection as messages.
Sharing is safer by default. New rooms and DMs no longer expose history to later joiners unless the admin chooses to, a badge in the room info panel shows who can read what, users are asked to confirm before inviting someone they have never spoken to, public rooms carry a warning that they are open beyond the organisation, and operators can block unwanted invites outright.
Link previews have been rebuilt and now work in end-to-end encrypted rooms without the server ever seeing the link, polls have been partly redesigned, and the whole interface has moved to Element's Compound design system with a long list of accessibility and contrast improvements.
For public-sector deployments in particular, Element Web also improved the module API, so vendor-specific customisations such as openDesk's branding, composer and upload behaviour are now clean plug-ins rather than forks.
What it means for openDesk
Element Server Suite Community enables openDesk to deliver an open source chat function, with enterprise-grade extensions available if required from Element Server Suite Pro. For openDesk providers, the change brings a hardened deployment, and a clear path to next-generation authentication. This goes along with a long list of features improving the value and user experience of chat inside openDesk. For the public servants who use openDesk every day, it means the full Element experience.
Above all, it shows what open standards and open source make possible. A sovereign workplace suite can run the original product, straight from its manufacturer, with nothing held back.
