Best email archiving software for advisers (SEC and FINRA)
Six email archives read against the adviser and broker-dealer record rules rather than against e-discovery feature lists. Three are built for SEC and FINRA firms; three are general business archives that also sell to finance. Each cell says what the vendor's own pages state, and where they are silent.
Reviewed October 2026
Best overall
Smarsh
Its own pages name journal capture from Exchange, Microsoft 365 and Google Workspace, both 17a-4(f) storage modes, letters of undertaking and named export formats.
Read the review of SmarshBest for a one-adviser RIA
Archive Intel
Built for SEC and FINRA firms down to solo RIAs, with API journaling from Microsoft 365 or Google Workspace and retention set by channel and record type.
Read the review of Archive IntelBest for a broker-dealer that must evidence review
Global Relay
Lexicon tools, proof-of-review reports and a time-stamped log of every search and export answer FINRA's evidence-of-review rule most directly.
Read the review of Global Relay
The comparison table
| Vendor | Captures email as sent and received204-2(a)(7); 17a-4(b)(4) | Audit trail or non-rewriteable storage17a-4(f)(2)(i) | Retention set per rule204-2(e)(1); 17a-4(b) | Indexed for location and retrieval204-2(g)(2)(i) | Supervisory review and flagsFINRA 3110(b)(4) | Produces records for an exam204-2(g)(2)(ii); 17a-4(j) | Other channels in the same archive |
|---|---|---|---|---|---|---|---|
SmarshFinancial-services archive | Meets Journal capture: Exchange, Microsoft 365, Google Workspace | Meets WORM and audit-trail methods named | Meets Retention schedules | Meets Saved, shared searches | Partial Review workflows; evidence of review not stated | Meets PST, EML, HTML, XML | Meets 100+ incl. texts, Teams, social |
Archive IntelSEC and FINRA archive | Meets API journaling: Microsoft 365, Google Workspace | Meets WORM cloud storage; access audit trail | Meets By channel and record type | Meets Keyword, user, date, channel | Partial AI surfaces risk; lexicon not stated | Meets Packages for exam requests | Meets iMessage, WhatsApp, LinkedIn, Teams |
Global RelayMulti-industry archive | Meets Exchange Online journal and API; Google Workspace | Meets WORM optional on the Exchange connector | Meets Retention schedules, legal hold | Meets One normalised archive | Meets Lexicon tools; proof-of-review reports | Partial Evidentiary export; no exam named | Meets 100+; iMessage not stated |
JatheonCloud or on-premises archive | Partial Email named; mail systems not named | Check with vendor Audit trails stated; WORM not stated | Meets Retention policies enforced | Meets Keyword and LLM search | Partial AI dashboard, keyword alerts | Meets Exam-ready exports; formats not named | Meets SMS, iMessage, WhatsApp, social |
MirrorWebFinancial-services archive | Partial Email named; mail systems not named | Meets Write Once, Read Many | Check with vendor Retention settings not described | Meets Keyword, sender, recipient | Partial Scored alerts; lexicon not stated | Meets For regulatory requests; formats not named | Meets Texts, Teams, Zoom, social, web |
ProofpointEnterprise governance suite | Partial Email named; mail systems not named | Meets WORM preservation; audit trails | Meets Retention and disposition | Meets Full-text and metadata index | Meets Review queues, sampling, evidence | Meets Export for regulatory response | Meets 80+ incl. WhatsApp, iMessage |
Built for advisers, or a general business archive
Every archive on this page keeps email. The difference that matters to a small firm is whether the vendor has already mapped its product to the adviser and broker-dealer rules, or leaves that mapping to you. Three of the six name RIAs or broker-dealers on their own pages. The other three are general archives that sell to finance among other industries: capable, but your compliance officer does more of the reading.
Who each vendor's own pages say it serves
| Vendor | Named on its own pages | Our reading |
|---|---|---|
| Smarsh | RIAs, broker-dealers, dual BD and RIA firms, banking | Built for financial firms |
| Archive Intel | SEC and FINRA firms, solo RIAs to large broker-dealers | Built for financial firms |
| MirrorWeb | Investment advisors, broker-dealers, hedge funds, PE and VC | Built for financial firms |
| Global Relay | Finance, legal, healthcare, insurance, energy, government | General archive with a finance line |
| Jatheon | Education, government, enterprise, financial services, healthcare | General archive with a finance line |
| Proofpoint | Regulated and small-to-midsized organisations generally | Enterprise governance suite |
Vendor pages read October 22, 2026
A general archive is not the wrong answer. It is the right one when a firm already runs that vendor's security stack, or needs one archive across a parent company. Firms leaving one of the two largest names can start from Smarsh alternatives for small firms or Global Relay alternatives.
Which emails are records
The broker-dealer rule is the wide one. It reaches every communication about the business, sent or received:
The adviser rule is narrower on paper. Rule 204-2(a)(7) covers written communications sent and received about four subjects: advice and recommendations, the receipt or delivery of funds or securities, the placing of orders, and performance. In practice an archive cannot sort an inbox by subject at the moment of capture, so most advisers keep all business email and let retention do the rest. The full list of adviser records is in our guide to Rule 204-2, the adviser books and records rule.
How long each rule keeps them
The two rules set different clocks. A dual registrant answers to both: Rule 204-2(h)(1) lets a record kept under the broker-dealer rules count for the adviser rule when it is substantially the same, and which clock then governs a given message is a setting to agree with your compliance counsel. Both bars below are drawn to scale.
Year 0: the end of the fiscal year of the last entry
- In an appropriate office of the adviser2 years
- In an easily accessible place3 years
17 CFR 275.204-2(e)(1)
- In an easily accessible place2 years
- Rest of the period1 year
17 CFR 240.17a-4(b), (b)(4)
Rule 17a-4(b) states the length and the two-year window but not the event the period runs from, so the start date is a setting to agree with your compliance counsel. FINRA adds that its own books and records are kept “in a format and media that complies with SEA Rule 17a-4” (Rule 4511(c), explained in our FINRA Rule 4511 guide). To work out a keep-until date for a given record, use the books and records retention calculator.
Storage: an audit trail or WORM
Since the 2022 amendments, a broker-dealer's electronic recordkeeping system can meet Rule 17a-4(f) in one of two ways. It can keep a complete time-stamped audit trail of every change and deletion, enough to re-create the original, or it can:
The second is what vendors call WORM. The storage column reads Meets where a vendor's own page names either mode. The same rule also asks the system to verify its own storing, to download a record and its audit trail “in both a human readable format and in a reasonably usable electronic format”, and to keep a backup system. Where a vendor runs the servers, it must also file a written undertaking that the records “are the property of the member, broker, or dealer” and “will be surrendered promptly on request” (17a-4(i)). Of the six, only Smarsh's own pages offer letters of undertaking.
Advisers are held to a different test. Rule 204-2(g) asks for records indexed for retrieval, a separate duplicate copy, and procedures that safeguard records “from loss, alteration, or destruction”. It does not require WORM. The trade-offs between the two modes are in Rule 17a-4 and WORM storage, explained, and storage-only services are compared in the best SEC 17a-4 compliant storage.
Finding, producing and reviewing email
Found and produced
An adviser must “Arrange and index the records in a way that permits easy location, access, and retrieval of any particular record”, and produce a legible, true and complete copy promptly when the SEC asks (204-2(g)(2)). A broker-dealer must furnish copies promptly and, on request, give an electronic record and its audit trail in a reasonably usable electronic format (17a-4(j)). Every archive here searches; the production column reads Meets where the vendor says its exports are made for an exam or a regulator. Only Smarsh also names the file formats.
Reviewed and evidenced
Flags and AI scores help a principal decide what to read; they are not the review. FINRA's supplementary material asks the record to show the reviewer, the message, the date and the action taken, and says “Merely opening a communication is not sufficient review.” The review column reads Meets only where the vendor names both the flags and the evidence: Global Relay's proof-of-review reports and Proofpoint's evidence of supervision. The whole supervision duty is laid out in FINRA Rule 3110 supervision for small firms.
Email is rarely the only channel
The record rules follow the content of a message, not the app it travelled in. A recommendation sent by text is as much a 204-2(a)(7) record as one sent by email. That is why the last column of the table counts the other channels each archive keeps, and why a firm whose people text clients should read the text message archiving comparison before signing for email alone.
In one 2023 order the SEC described employees who “often communicated ‘off-channel’ about securities business matters on their personal devices, using messaging platforms, such as WhatsApp.” What those cases mean for a five-person firm is set out in off-channel communications for small firms, and the archiving requirements matcher lists what each channel a firm uses must keep.
The questions to send a vendor
A demo shows search screens. The record rules turn on documents and settings a demo rarely shows. Pick your firm type, copy the questions into an email to each vendor on your shortlist, and file the answers with your books and records: they are the evidence that the archive was chosen against the rule. None of this is legal advice; check the final setup with your compliance counsel.
7 questions for this firm type
- 01Which mail systems do you capture from, and is every sent and received message kept with its attachments?204-2(a)(7); 17a-4(b)(4)
- 02Can retention run five years from the end of our fiscal year, with the first two years on hand?204-2(e)(1)
- 03How is one message found: by sender, recipient, date range and keyword?204-2(g)(2)(i)
- 04In which formats can you export a message, and its audit trail, for an examiner?204-2(g)(2)(ii); 17a-4(f)(2)(iv); 17a-4(j)
- 05Where is the separate duplicate copy of each record kept?204-2(g)(2)(iii)
- 06Which other channels (texts, Teams, LinkedIn) land in the same archive?204-2(a)(7); 17a-4(b)(4)
- 07If we leave, how do we take every record out, and in what format?Contract terms
Each vendor, read against the rule
Smarsh
Financial-services archive- What it is
- A capture, archive and supervision platform for financial firms. Its email page says business email is collected “through journal capture and other supported integrations as messages are sent and received” from Exchange, Microsoft 365 and Google Workspace. Its 17a-4 page names “WORM and audit-trail retention methods” and offers letters of undertaking.
- Who it fits
- Advisers and broker-dealers alike: its navigation names RIAs, broker-dealers and dual BD and RIA firms, with separate pages for small and scaling firms. The pick when one archive must cover email, texts and social.
- What the rule requires, and whether it meets it
- Captures email as sent and receivedMeetsJournal capture: Exchange, Microsoft 365, Google Workspace
- Audit trail or non-rewriteable storageMeetsWORM and audit-trail methods named
- Retention set per ruleMeetsRetention schedules
- Indexed for location and retrievalMeetsSaved, shared searches
- Supervisory review and flagsPartialReview workflows; evidence of review not stated
- Produces records for an examMeetsPST, EML, HTML, XML
- Other channels in the same archiveMeets100+ incl. texts, Teams, social
- Not verified by us
- Its 17a-4(i) undertaking letter for your designated examining authority, which storage mode your account uses, and whether evidence of each review (reviewer, date, action) is kept with the message.
Archive Intel
SEC and FINRA archive- What it is
- An archive and supervision service “Built for SEC and FINRA Regulated Firms”. Its FAQ says email is connected “through Microsoft 365 or Google Workspace API journaling”, stored in “WORM-compliant cloud infrastructure”, with every access logged in an audit trail.
- Who it fits
- Small RIAs most of all: the FAQ names firms “from solo RIAs and independent advisory practices” up to large broker-dealers. Its FAQ states it offers no self-service free trial.
- What the rule requires, and whether it meets it
- Captures email as sent and receivedMeetsAPI journaling: Microsoft 365, Google Workspace
- Audit trail or non-rewriteable storageMeetsWORM cloud storage; access audit trail
- Retention set per ruleMeetsBy channel and record type
- Indexed for location and retrievalMeetsKeyword, user, date, channel
- Supervisory review and flagsPartialAI surfaces risk; lexicon not stated
- Produces records for an examMeetsPackages for exam requests
- Other channels in the same archiveMeetsiMessage, WhatsApp, LinkedIn, Teams
- Not verified by us
- Its 17a-4(i) undertaking (the FAQ speaks of a third-party custodian arrangement, not an undertaking), its export file formats, and whether lexicon rules sit beside the AI review.
Global Relay
Multi-industry archive- What it is
- A multi-industry archive with connectors for Exchange, Exchange Online, Google Workspace and SMTP mail. Its Exchange Online connector captures mail “via journal reports” and the API, with “optional WORM-compliant storage”; the archive records and time-stamps every access, search and export.
- Who it fits
- A broker-dealer whose principals must show their reviews: it offers lexicon tools and reports on proof of review. Its industry list leads with finance but does not name RIAs or broker-dealers.
- What the rule requires, and whether it meets it
- Captures email as sent and receivedMeetsExchange Online journal and API; Google Workspace
- Audit trail or non-rewriteable storageMeetsWORM optional on the Exchange connector
- Retention set per ruleMeetsRetention schedules, legal hold
- Indexed for location and retrievalMeetsOne normalised archive
- Supervisory review and flagsMeetsLexicon tools; proof-of-review reports
- Produces records for an examPartialEvidentiary export; no exam named
- Other channels in the same archiveMeets100+; iMessage not stated
- Not verified by us
- Whether WORM storage is switched on for your account (the connector calls it optional), its export file formats, and its 17a-4(i) undertaking.
Jatheon
Cloud or on-premises archive- What it is
- A general archive sold as a cloud service on AWS or as an on-premises “hardware appliance or VM”. Its financial page says it captures email “from all major clients and environments”, keeps “full audit trails” and produces “exam-ready records” in one-click exports.
- Who it fits
- A firm that wants its archive behind its own firewall. It serves education, government and healthcare too, citing over 200 financial-services customers; RIAs and broker-dealers are not named.
- What the rule requires, and whether it meets it
- Captures email as sent and receivedPartialEmail named; mail systems not named
- Audit trail or non-rewriteable storageCheck with vendorAudit trails stated; WORM not stated
- Retention set per ruleMeetsRetention policies enforced
- Indexed for location and retrievalMeetsKeyword and LLM search
- Supervisory review and flagsPartialAI dashboard, keyword alerts
- Produces records for an examMeetsExam-ready exports; formats not named
- Other channels in the same archiveMeetsSMS, iMessage, WhatsApp, social
- Not verified by us
- Which 17a-4(f) storage mode it uses (WORM is not stated), the mail systems it journals from, its export formats, and its 17a-4(i) undertaking.
MirrorWeb
Financial-services archive- What it is
- A supervision and archiving platform for financial firms. Its email page says “Every email is captured in real-time”, with the full message, headers and attachments; its financial page says records are stored “immutably (Write Once, Read Many)”. It also archives websites. Its home page says MirrorWeb and Red Oak (advertising review) combine; the pages we read do not say how.
- Who it fits
- Advisers and broker-dealers that also need website and social archiving: it names investment advisors and broker-dealers, and firms from “a one-person powerhouse” up.
- What the rule requires, and whether it meets it
- Captures email as sent and receivedPartialEmail named; mail systems not named
- Audit trail or non-rewriteable storageMeetsWrite Once, Read Many
- Retention set per ruleCheck with vendorRetention settings not described
- Indexed for location and retrievalMeetsKeyword, sender, recipient
- Supervisory review and flagsPartialScored alerts; lexicon not stated
- Produces records for an examMeetsFor regulatory requests; formats not named
- Other channels in the same archiveMeetsTexts, Teams, Zoom, social, web
- Not verified by us
- Its mail-system list (Microsoft 365, Google Workspace), how retention periods are set, its export formats, and its 17a-4(i) undertaking.
Proofpoint
Enterprise governance suite- What it is
- An enterprise communications-governance suite (Archive, Capture, Supervision, Discover). Its archive page offers “WORM-Compliant Preservation”, full-text indexing, and review queues with sampling and “evidence of supervision”.
- Who it fits
- A firm that already buys Proofpoint security and wants governance from the same vendor. Its pages speak to regulated organisations generally and do not name RIAs or broker-dealers.
- What the rule requires, and whether it meets it
- Captures email as sent and receivedPartialEmail named; mail systems not named
- Audit trail or non-rewriteable storageMeetsWORM preservation; audit trails
- Retention set per ruleMeetsRetention and disposition
- Indexed for location and retrievalMeetsFull-text and metadata index
- Supervisory review and flagsMeetsReview queues, sampling, evidence
- Produces records for an examMeetsExport for regulatory response
- Other channels in the same archiveMeets80+ incl. WhatsApp, iMessage
- Not verified by us
- The mail systems its Capture product journals from, its export formats, and its 17a-4(i) undertaking; FINRA rules are not named on the archive page.
How we read these vendors
Questions firms ask
Does an RIA have to keep email in WORM storage?
No. The adviser rule lets records sit on any electronic storage that meets its terms: the adviser must index them for easy retrieval, produce them promptly, keep a separate duplicate copy, and safeguard them “from loss, alteration, or destruction”. It says nothing about WORM or an audit trail.
The two storage modes (a time-stamped audit trail, or a non-rewriteable, non-erasable format) are Rule 17a-4(f) conditions for broker-dealers. A dual registrant's broker-dealer records still meet them.
17 CFR 275.204-2(g)(1)-(3); 17 CFR 240.17a-4(f)(2)(i)
How long must an adviser keep client email?
Written communications covered by Rule 204-2(a)(7) are kept “for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.” By our reading, a message from 2026 at a firm with a December year end is kept until at least December 31, 2031.
17 CFR 275.204-2(a)(7), (e)(1)
How long must a broker-dealer keep email?
Communications under Rule 17a-4(b)(4) are kept “for a period of not less than three years, the first two years in an easily accessible place.” FINRA Rule 3110.09 points correspondence and internal communications to the same period. The rule text states the length and the two-year window, not the event the period runs from, so set that with your compliance counsel.
17 CFR 240.17a-4(b), (b)(4); FINRA Rule 3110.09
Does every email have to be read by a supervisor?
FINRA leaves the depth to the firm: outside the subjects Rule 3110(b)(4) names, a member decides by risk-based principles how far to review correspondence. Whatever is reviewed must be reviewed by a registered principal and “evidenced in writing, either electronically or on paper.”
The evidence must name the reviewer, the message, the date and any action taken. “Merely opening a communication is not sufficient review.” That is why the review column asks for evidence, not just flags.
FINRA Rule 3110(b)(4), 3110.06, 3110.07
Is there an SEC- or FINRA-approved list of email archives?
No. Neither the SEC nor FINRA approves archiving vendors, and FINRA retired its Compliance Vendor Directory effective March 19, 2024. A vendor's “SEC 17a-4” wording is its own claim; under 17a-4(f) the duties stay with the broker-dealer, which is why each card above names the document to ask for.
finra.org/industry/cvd; 17 CFR 240.17a-4(f)(3)(v)