Communication Archiving

Moraph resells, implements and runs Smarsh as a managed service, so email, chat, collaboration and text messages are captured and kept in non-rewriteable, non-erasable storage as SEC Rule 17a-4 and FINRA rules require. We connect each channel, set retention and supervision policies with your compliance team, and watch every day for capture gaps. Your compliance staff review flagged messages and decide; we keep the archive complete and the evidence ready for examiners.

The problem it solves

Firms now communicate across email, Microsoft Teams, Slack, Bloomberg, text messages and more, and each channel has to be captured, retained in compliant storage and supervised. Archiving platforms are capable, but they depend on dozens of connectors that break quietly when a vendor changes an API, a user changes phone or a new channel appears. Compliance teams often learn about a capture gap during an exam or a production request, when it is too late to recover the messages. Retention schedules, legal holds and lexicon policies drift away from written procedures without anyone noticing.

Who it’s for

• Chief compliance officers at broker-dealers, investment advisers and futures firms
• Supervisory principals and compliance analysts who review flagged communications
• Records management and legal teams who handle holds and productions
• IT and messaging teams who own the email and collaboration systems being captured
• Internal audit and examiners, who need evidence that capture and supervision are complete

1. CaptureMoraph connects Smarsh to each approved communication channel, confirms that messages from every in-scope user arrive, and checks capture every day so a broken connector is found and fixed quickly.
2. RetainRetention periods, legal holds and storage settings are configured in Smarsh to match your record retention schedule, and every change goes through a recorded change request approved by your records owner.
3. SuperviseSmarsh applies the lexicon and policy rules your compliance team approves and queues flagged messages for review. Your reviewers decide on each message; Moraph tunes policies on request and reports on review backlog.
4. ProduceWhen a regulator, auditor or counsel asks for communications, your authorized staff search and export from Smarsh, and Moraph helps scope the search, run large exports and document how the production was made.

Managed channel capture

Moraph configures and maintains Smarsh capture for email, Microsoft Teams, Slack, Bloomberg, text messaging and other channels you approve and license.

Daily capture monitoring

Expected and received message volumes are compared every day by channel and user, and drops are investigated as incidents.

Compliant retention

Smarsh retains captured messages in storage configured to support SEC Rule 17a-4(f) and the retention periods in your schedule.

Legal hold management

Holds placed, extended and released on written instruction from your legal team, with each action recorded.

Supervision policies

Your written supervisory procedures are turned into Smarsh lexicons, policies and sampling rules, reviewed with your compliance team before they go live.

Policy tuning

Moraph reports on which policies produce flags that reviewers routinely clear, and proposes changes for your compliance team to approve.

Joiner, mover and leaver handling

New and departing staff are added to or removed from capture and review groups as your HR or identity records change, so coverage follows the population.

New channel intake

When the business asks to use a new messaging tool, Moraph assesses whether Smarsh can capture it and what configuration is needed, so compliance can decide before it is used.

Production support

Help scoping searches, running large exports and documenting how a production was assembled for regulators, auditors and counsel.

Configuration baseline

A documented record of every channel, retention policy, hold and supervision policy, compared each quarter with what is actually configured.

Exam evidence pack

Capture coverage, retention settings, gap incidents and change history assembled for examiners and internal audit on request.

Follow-the-sun service desk

Moraph's service desk across our offices takes requests and incidents around the clock, with escalation to Smarsh support where the platform itself is at fault.

Chief compliance officer

Owns the archiving and supervision program and approves policy changes

Supervisory reviewer

Reviews flagged messages in Smarsh and records decisions

Records and legal

Owns the retention schedule, places holds and runs productions

Client IT administrator

Owns the messaging systems being captured and approves technical access

Moraph service team

Configures, monitors and maintains capture, retention and policies on your behalf

Auditor or examiner (read-only)

Views evidence of capture, retention and supervision without changing anything

Email

Journaling or API capture from Microsoft 365, Google Workspace or on-premises Exchange, configured with your messaging team.

Collaboration tools

Capture from Microsoft Teams, Slack, Zoom chat and other collaboration tools that Smarsh supports and you license.

Financial messaging

Capture from Bloomberg and other financial chat networks used by trading and sales staff.

Mobile and text messaging

Capture of SMS, iMessage and WhatsApp business messages through the mobile capture options Smarsh supports, for firm-managed or approved devices.

Identity provider and HR

User directory data so capture and review groups follow joiners, movers and leavers, and single sign-on for reviewers.

Moraph Voice Recording Compliance

Where you also use Moraph's voice recording service, recorded calls and their metadata can be retained alongside written communications.

Moraph service reporting

Capture checks, incidents and change requests are tracked in Moraph's service tooling and shared in the monthly review.

Single sign-on

Your staff and Moraph's staff sign in through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Reviewers see their review groups, legal sees holds and productions, and Moraph's service team sees configuration rather than content.

Logged content access

Every search and export of message content, by your staff or ours, is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Smarsh's own platform assurance reports are available from Smarsh under its terms.

Data residency

Archive data is held in the Smarsh hosting region selected for your firm, and Moraph's service tooling uses the United States, United Kingdom or Australia region you choose.

Smarsh cloud, managed by Moraph

Smarsh hosts the archive; Moraph configures and runs it for you under a managed service agreement.

Moraph-managed with your existing Smarsh licenses

If you already license Smarsh, Moraph can take over configuration and operations, subject to Smarsh's terms.

Alongside other Moraph services

Run with Moraph's Voice Recording Compliance, Data Loss Prevention or Mobile Device Management services so channels are governed together.

Channel inventory

We list every channel your staff use for business, confirm which are approved, and agree what Smarsh will capture. We need input from compliance, IT and business line heads.

Retention and supervision design

Your retention schedule and written supervisory procedures are mapped to Smarsh retention policies, review groups, lexicons and sampling, and approved by your compliance and records owners.

Connector setup

Connectors are configured with your IT team, test messages are confirmed in the archive, and capture checks are switched on for each channel.

Historical data migration

Where you are moving from another archive, existing records are migrated with Smarsh under a plan that keeps chain of custody and verifies counts. This is scoped in the proposal.

Reviewer onboarding

Reviewers and legal users are set up from your directory and shown how to work review queues and run searches.

Baseline and handover to service

The configuration baseline is documented and signed off, and the service moves into daily monitoring with a first service review.

• Moraph is not Smarsh. The platform belongs to Smarsh, and Smarsh's own service commitments, roadmap, maintenance and outages apply to it.
• Licenses are subject to Smarsh's terms, and the channels that can be captured depend on what Smarsh supports and what you license.
• Capture depends on the source systems. If a channel is used on an unmanaged device or an unapproved app, it may not be captured at all.
• Messages that were never captured, for example during a source-side outage, may not be recoverable. Daily checks find gaps; they cannot always fill them.
• Your firm remains responsible for its books-and-records and supervision obligations, including the Rule 17a-4(f) designations and undertakings that apply to you.
• Moraph does not make supervisory decisions. Your reviewers decide whether a message needs action.
• Smarsh's lexicons and policies flag messages for review; they do not find every problem message, and your sampling and review procedures still apply.
• Legal advice on retention periods, holds and disclosures is not part of the service.

• List every channel your staff use for business and check which ones Smarsh can capture for you
• Ask how a capture gap would be detected, and review a sample incident report
• Review the change request process for retention, holds and policies and who approves each
• Check how Moraph's access to message content is limited and logged
• Walk through the responsibilities table with your compliance, legal and IT leads
• Ask for a sample monthly service review and configuration baseline