Best SEC 17a-4 compliant cloud storage for broker-dealer records
Five object stores and one document vault, read against Rule 17a-4(f) as amended in 2022. No storage product is compliant on its own: the rule binds the broker-dealer, and storage covers only some of it. Each cell says what the provider's own pages state, and where they are silent.
Reviewed October 2026
Best overall
Google Cloud Storage
Its own pages name a Cohasset assessment of the locked retention policy, a signed 17a-4(i) addendum for the undertaking, and locks per bucket or per object.
Read the review of Google Cloud StorageBest for a firm or IT provider building its own store
Amazon S3 Object Lock
Compliance mode stops any user, the root user included, from overwriting or deleting a locked version, with retain-until dates, event holds and legal holds per object.
Read the review of Amazon S3 Object LockBest for an RIA's client documents
FutureVault
A document vault and client portal rather than a bucket to configure, built for advisers and broker-dealers, with time-stamped activity trails and firm-set retention.
Read the review of FutureVault
The comparison table
| Vendor | Audit-trail mode17a-4(f)(2)(i)(A) | Non-rewriteable, non-erasable mode17a-4(f)(2)(i)(B) | Verifies its own storing17a-4(f)(2)(ii) | Serialized media, time-dated retention17a-4(f)(2)(iii) | Retention lock per record class17a-4(a), (b) | Export for an exam17a-4(f)(2)(iv); 17a-4(j) | Third-party undertaking offered17a-4(i)(1) |
|---|---|---|---|---|---|---|---|
Google Cloud StorageObject storage, Bucket Lock | Not stated Assessment excludes this mode | Meets Assessment: locked retention policy | Not stated Page names the WORM finding only | Partial Retention expiration time per object | Meets Per bucket; per object with Object Retention Lock | Not stated Returns the file as stored | Meets SEC 17a-4(i) Addendum; no D3P service |
Amazon S3 Object LockObject storage feature | Not stated WORM model only | Meets Assessment named; compliance mode | Check with vendor Ask which parts the assessment covers | Partial Retain-until date per object version | Meets Bucket default or per object version | Not stated Returns the file as stored | Not stated Not on the Object Lock page |
FutureVaultDocument vault | Partial Time-stamped user activity; re-creation not stated | Check with vendor Claimed in a blog article only | Not stated | Not stated | Partial Firm-set retention; lock not described | Partial Retrieval stated; formats not named | Not stated |
IBM Cloud Object StorageObject storage | Not stated WORM mode assessed | Meets Assessment report linked | Check with vendor Ask which parts the assessment covers | Not stated | Not stated Not on the 17a-4(f) page | Not stated | Meets Alternative Undertaking by support case |
Azure Blob StorageObject storage, immutable policies | Not stated Logs policy commands, not record edits | Meets Assessment: locked time-based policy | Check with vendor Ask which parts the assessment covers | Partial Retention interval per container or version | Meets Per account, container or version | Not stated Returns the file as stored | Check with vendor Attestation letter offered; undertaking not stated |
Wasabi Hot Cloud StorageS3-compatible object storage | Not stated WORM mode assessed | Meets Assessment: object lock, compliance mode | Check with vendor Ask which parts the assessment covers | Not stated | Not stated Granularity not on the pages read | Not stated | Meets Alternate undertaking letter on request |
A storage layer is not an archive
Rule 17a-4(f) lets a broker-dealer keep records on an electronic recordkeeping system, which the rule defines as one that:
A locked bucket is one part of that system. It answers the storage question well: once a retention policy is locked, nobody at the firm can change or erase the object before its date. It does not capture an email or a text, it does not index a message by sender and date, it does not render a record readable for an examiner, and it does not sign the firm's own undertaking. An archive does those jobs and typically brings its own storage, which is why the archives sit on their own pages: email archiving software and text message archiving.
Storage on its own makes sense in three cases: the firm or its IT provider builds its own record store, the firm keeps documents (statements, account forms, minute books) rather than messages, or the firm wants a second copy held apart from its archive. Pick your case below to see which duties the storage covers and which stay with you.
7 of 10 stay with your firm
- Capture each communication as sent and received17a-4(b)(4)Your firm
- Keep records in a non-rewriteable, non-erasable format, or with a complete time-stamped audit trail17a-4(f)(2)(i)Storage provider
- Verify automatically that storing and retaining work completely and accurately17a-4(f)(2)(ii)Your firm
- Time-date the required period of retention17a-4(f)(2)(iii)Storage provider
- Download a record and its audit trail in a human readable and a reasonably usable electronic format17a-4(f)(2)(iv)Your firm
- Run a backup recordkeeping system or other redundancy17a-4(f)(2)(v)Your firm
- Keep an audit system for accountability over inputting records (WORM mode)17a-4(f)(3)(iii)Your firm
- File the undertaking signed by a designated executive officer or designated third party17a-4(f)(3)(v)(A)Your firm
- File the outside provider's undertaking that the records are the firm's and will be surrendered17a-4(i)(1)Storage provider
- Find and furnish copies promptly when an examiner asks17a-4(j)Your firm
By our reading of the rule text. Your contracts and your compliance counsel set the real split.
To match the record types your firm keeps to the right kind of archive, the archiving requirements matcher walks through each channel.
The two modes Rule 17a-4(f) allows
The amendments were published on November 3, 2022, took effect on January 3, 2023, and had a compliance date of May 3, 2023. Since then the system can meet 17a-4(f) in either of two ways. The first:
That trail must hold every modification and deletion, the date and time of each action, the person who took it where that applies, and enough besides to “permit re-creation of the original record if it is modified or deleted.” The second:
Every storage layer in the table is built for the second mode, which vendors call WORM. A locked bucket refuses a change rather than logging it, so the audit-trail mode usually lives in the application above the storage: an archive, a vault or a records system. Google's page says outright that its Cohasset assessments “do not address” the audit-trail alternative. A firm that picks the WORM mode also needs its own “audit system providing for accountability regarding inputting of records” (17a-4(f)(3)(iii)). Both modes are compared at length in Rule 17a-4 and WORM storage, explained.
The lock must actually be on. Microsoft writes that a time-based policy “must be locked for the blob to be in a compliant immutable (write and delete protected) state for SEC 17a-4(f)”. Google ties its assessment to the retention policy “in locked mode”. Amazon S3's governance mode lets users with special permissions alter the lock, so by our reading only its compliance mode is non-erasable.
Verification, dates, locks and exports
Verification and dates
The system must “Verify automatically the completeness and accuracy of the processes for storing and retaining records electronically” and, “If applicable, serialize the original and duplicate units of the storage media, and time-date the required period of retention”. No provider page we read describes the verification, so that column reads Check with vendor where an assessment is named. On dates, Amazon S3 gives each locked version a retain-until date, Google gives each object a retention expiration time, and Azure sets an interval per container or version: Partial, because serialization is not described.
One lock per record class
Broker-dealer records do not share one period, so one bucket rarely fits all of them. Two of the common periods, drawn to scale:
- In an easily accessible place2 years
- Rest of the period4 years
17 CFR 240.17a-4(a)
- In an easily accessible place2 years
- Rest of the period1 year
17 CFR 240.17a-4(b), (b)(4)
Articles, minute books and Forms BD are kept “during the life of the enterprise and of any successor enterprise” (17a-4(d)), which a fixed lock cannot express. Note the clocks, too. Amazon S3 counts a bucket's default period from the object's creation timestamp and Google from the object's age, while the rule states the length and the two-year window but not the event the period runs from. Set each lock no shorter than the period your compliance counsel agrees: a locked period can be lengthened later (Amazon, Google and Azure all say so) but never shortened. The retention calculator works out a keep-until date per record.
Exports for an exam
The system must “readily download and transfer copies of a record and its audit trail (if applicable) in both a human readable format and in a reasonably usable electronic format”, and on request the firm must furnish copies promptly (17a-4(j)). A bucket returns the file exactly as it was stored. If that file is a raw message export, someone still has to make it readable, which is the archive's job or the firm's. FINRA points its own books and records to the same standard (Rule 4511(c), covered in our FINRA Rule 4511 guide).
The undertakings: who signs what
Two different documents carry the word undertaking, and they are easy to mix up. The first is the firm's:
A designated executive officer is “a member of senior management” of the firm who can reach and provide the records; a designated third party is a person “not affiliated with” the firm with the same access. The officer may appoint up to two designated officers and up to three designated specialists in writing, and stays bound by the undertaking. The second document is the outside provider's: a service that owns and operates the servers must file a written undertaking with the Commission that the records “are the property of the member, broker, or dealer” and “will be surrendered promptly on request”. Where the firm keeps independent access, a shorter alternative undertaking may be filed instead (17a-4(i)).
Which undertaking each provider's page offers
| Document | Signed by | What the pages here say |
|---|---|---|
| The firm's undertaking, 17a-4(f)(3)(v)(A) | A designated executive officer or a designated third party | Google says a designated third party “is not a service that Google Cloud provides”; the other pages are silent. |
| The provider's undertaking, 17a-4(i)(1) | The outside service that holds the records | Offered by Google (17a-4(i) Addendum), IBM (Alternative Undertaking) and Wasabi (alternate undertaking letter). Not stated by AWS's Object Lock page, Azure or FutureVault. |
| A letter of attestation | Microsoft, on request through Azure Support | Speaks to WORM immutability. It is not either undertaking above. |
17 CFR 240.17a-4(f)(3)(v)(A); 17 CFR 240.17a-4(i)(1)
Filing the firm's undertaking is one of the jobs a small broker-dealer's compliance calendar has to carry; the wider list is in FINRA compliance for broker-dealers.
Advisers: what Rule 204-2(g) asks instead
Everything in the table is a broker-dealer test. An SEC-registered adviser keeps electronic records under Rule 204-2(g), on “any digital storage medium or system that meets the terms of this section”. Those terms are:
What Rule 204-2(g) asks of adviser storage
- Arrange and index the records for easy location, access and retrieval204-2(g)(2)(i)
- Provide promptly a legible, true and complete copy, a printout, and means to view and print204-2(g)(2)(ii)
- Separately store a duplicate copy for the full retention period204-2(g)(2)(iii)
- Safeguard the records from loss, alteration, or destruction204-2(g)(3)
- Limit access to properly authorized personnel and the Commission204-2(g)(3)
The rule names no audit trail, no non-rewriteable format and no third-party undertaking. Those are 17a-4(f) conditions, so an adviser does not need WORM storage. A locked bucket or a vault can still be a tidy way to show records are safe from alteration, and, by our reading, a copy in a second region or with a second provider answers the duplicate-copy line. FutureVault fits here: a vault the firm can index and retrieve from without building anything.
A dual registrant keeps its broker-dealer records to 17a-4(f). Rule 204-2(h)(1) then treats a record kept under 17a-3 or 17a-4 that is “substantially the same” as the adviser record as kept in compliance with 204-2. The full list of adviser records is in Rule 204-2, the adviser books and records rule, and the books and records checklist turns it into a list to work through.
Each vendor, read against the rule
Google Cloud Storage
Object storage, Bucket Lock- What it is
- Object storage with Bucket Lock: a bucket's retention policy can be locked, “permanently preventing the policy from being reduced or removed”, and Object Retention Lock sets retention per object. Its SEC page says Cohasset found it “meets the WORM requirement when properly configured and used with the Retention Policy feature in locked mode”, and states plainly that the assessments “do not address” the audit-trail alternative.
- Who it fits
- A broker-dealer, or the archive or IT provider it hires, that wants WORM storage and the undertaking paperwork from one provider. Its page sets the traditional undertaking, the alternative undertaking and the designated third party side by side, and says a designated third party “is not a service that Google Cloud provides”.
- What the rule requires, and whether it meets it
- Audit-trail modeNot statedAssessment excludes this mode
- Non-rewriteable, non-erasable modeMeetsAssessment: locked retention policy
- Verifies its own storingNot statedPage names the WORM finding only
- Serialized media, time-dated retentionPartialRetention expiration time per object
- Retention lock per record classMeetsPer bucket; per object with Object Retention Lock
- Export for an examNot statedReturns the file as stored
- Third-party undertaking offeredMeetsSEC 17a-4(i) Addendum; no D3P service
- Not verified by us
- The Cohasset report's coverage of 17a-4(f)(2)(ii) to (v) beyond the WORM finding, and the signed 17a-4(i) Addendum for your registrant number before records go in.
Amazon S3 Object Lock
Object storage feature- What it is
- A feature of Amazon S3 that “uses a write-once-read-many (WORM) model” and, per its page, “has been assessed by Cohasset Associates” for SEC 17a-4, CFTC and FINRA environments. In compliance mode a locked version “can't be overwritten or deleted by any user, including the root user”; governance mode lets users with special permissions alter the lock. It needs S3 Versioning.
- Who it fits
- A firm with engineers, or an archive vendor, building its own record store. AWS suggests governance mode for testing retention settings; only compliance mode stops every user. The page also notes that deleting the AWS account is the one way to delete a compliance-mode object early.
- What the rule requires, and whether it meets it
- Audit-trail modeNot statedWORM model only
- Non-rewriteable, non-erasable modeMeetsAssessment named; compliance mode
- Verifies its own storingCheck with vendorAsk which parts the assessment covers
- Serialized media, time-dated retentionPartialRetain-until date per object version
- Retention lock per record classMeetsBucket default or per object version
- Export for an examNot statedReturns the file as stored
- Third-party undertaking offeredNot statedNot on the Object Lock page
- Not verified by us
- AWS's 17a-4(i) undertaking (not on the Object Lock page), the date and scope of the Cohasset assessment it links, and how your exports render records in a human readable format.
FutureVault
Document vault- What it is
- A digital vault and document intelligence platform: documents, a client portal and integrations, not message capture. Its security page lists “Compliance Audit Trails” (“All user activity is tracked and recorded with timestamps”) and document retention; its 17a-4 article says “FutureVault provides both WORM + Audit Trail capability”.
- Who it fits
- An RIA, where Rule 204-2(g) asks for indexed, retrievable, safeguarded records rather than WORM. Its pages name advisory firms and RIAs and FINRA broker-dealers. A broker-dealer should hold the WORM claim to the same proof as the clouds above before filing records there.
- What the rule requires, and whether it meets it
- Audit-trail modePartialTime-stamped user activity; re-creation not stated
- Non-rewriteable, non-erasable modeCheck with vendorClaimed in a blog article only
- Verifies its own storingNot stated
- Serialized media, time-dated retentionNot stated
- Retention lock per record classPartialFirm-set retention; lock not described
- Export for an examPartialRetrieval stated; formats not named
- Third-party undertaking offeredNot stated
- Not verified by us
- A written statement of which 17a-4(f) mode it uses and how (the article's paragraph letters do not match the current rule text), any independent assessment, its 17a-4(i) undertaking, and its export formats.
IBM Cloud Object Storage
Object storage- What it is
- Object storage with immutable object storage features. IBM's 17a-4(f) page says Cohasset assessed that, “when immutable object storage features are appropriately configured and applied”, it “retains records in non-rewriteable, non-erasable format”, and links the assessment report.
- Who it fits
- A broker-dealer or its provider already on IBM Cloud. An Alternative Undertaking letter is requested by support case, and IBM “requires customers to make certain representations” before issuing it.
- What the rule requires, and whether it meets it
- Audit-trail modeNot statedWORM mode assessed
- Non-rewriteable, non-erasable modeMeetsAssessment report linked
- Verifies its own storingCheck with vendorAsk which parts the assessment covers
- Serialized media, time-dated retentionNot stated
- Retention lock per record classNot statedNot on the 17a-4(f) page
- Export for an examNot stated
- Third-party undertaking offeredMeetsAlternative Undertaking by support case
- Not verified by us
- Its retention and legal-hold settings (not on the 17a-4(f) page), the representations IBM asks for before the Alternative Undertaking, and which 17a-4(f)(2) items the Cohasset report maps.
Azure Blob Storage
Object storage, immutable policies- What it is
- Immutable storage for Azure Blob Storage: time-based retention policies and legal holds at the account, container or version level. Microsoft says Cohasset validated it for SEC Rule 17a-4(f) when blobs are kept in a WORM state, and that a policy “must be locked” to be compliant for 17a-4(f).
- Who it fits
- A firm whose systems already run on Microsoft Azure. Its page names “broker-dealer organizations”, and a locked policy keeps an audit log of retention commands for the policy's lifetime.
- What the rule requires, and whether it meets it
- Audit-trail modeNot statedLogs policy commands, not record edits
- Non-rewriteable, non-erasable modeMeetsAssessment: locked time-based policy
- Verifies its own storingCheck with vendorAsk which parts the assessment covers
- Serialized media, time-dated retentionPartialRetention interval per container or version
- Retention lock per record classMeetsPer account, container or version
- Export for an examNot statedReturns the file as stored
- Third-party undertaking offeredCheck with vendorAttestation letter offered; undertaking not stated
- Not verified by us
- Whether Microsoft will file a 17a-4(i) undertaking (the page offers a letter of attestation, which is not the same document), and the Cohasset report from the Service Trust Center.
Wasabi Hot Cloud Storage
S3-compatible object storage- What it is
- S3-compatible object storage. Its documentation says its “object lock with compliance mode” fulfils requirements of 17 CFR 240.17a-4(f) and FINRA Rule 4511(c), and links a Cohasset assessment that “also includes the updated SEC Rules that had a compliance date of 5/3/2023”.
- Who it fits
- A firm or IT provider that wants S3-style object lock outside the three largest clouds. Its compliance page offers an “SEC alternate undertaking letter” on request.
- What the rule requires, and whether it meets it
- Audit-trail modeNot statedWORM mode assessed
- Non-rewriteable, non-erasable modeMeetsAssessment: object lock, compliance mode
- Verifies its own storingCheck with vendorAsk which parts the assessment covers
- Serialized media, time-dated retentionNot stated
- Retention lock per record classNot statedGranularity not on the pages read
- Export for an examNot stated
- Third-party undertaking offeredMeetsAlternate undertaking letter on request
- Not verified by us
- Whether retention can be set per bucket and per object (not on the pages read), and the signed alternate undertaking for your firm.
How we read these vendors
Questions firms ask
Is any cloud storage FINRA approved or SEC certified?
No. Neither the SEC nor FINRA approves storage vendors, and FINRA retired its Compliance Vendor Directory effective March 19, 2024. FINRA Rule 4511(c) asks that its members' books and records be preserved “in a format and media that complies with SEA Rule 17a-4”, and the 17a-4(f) duties stay with the broker-dealer. A Cohasset assessment is the vendor's evidence for one part of that, not an approval.
FINRA Rule 4511(c); finra.org/industry/cvd; 17 CFR 240.17a-4(f)
Does an RIA need WORM storage?
No. Rule 204-2(g) lets an adviser use any digital storage that meets its terms: records indexed for retrieval, produced promptly, duplicated, and safeguarded “from loss, alteration, or destruction”. WORM and the audit-trail alternative are 17a-4(f) conditions for broker-dealers.
17 CFR 275.204-2(g)(1)-(3)
Is the audit-trail mode easier than WORM?
Either one satisfies the rule. Google's page calls the audit trail the “less stringent” alternative, but the trail must capture every change and deletion and let the original be re-created, which is work for the application, not the bucket. Every storage layer on this page is assessed or built for the non-rewriteable mode.
17 CFR 240.17a-4(f)(2)(i)(A), (B)
Is an unlocked policy or S3 governance mode enough?
By our reading, no. Records must be kept “exclusively in a non-rewriteable, non-erasable format”, and a setting that some users can lift is erasable. Microsoft says a policy must be locked for 17a-4(f); Google's assessment covers the policy in locked mode; Wasabi's covers object lock in compliance mode.
17 CFR 240.17a-4(f)(2)(i)(B)
Who files the undertaking?
Two parties. The firm files its own with its designated examining authority, signed by a designated executive officer or a designated third party. A provider that runs the servers files its own with the Commission, saying the records belong to the firm and will be surrendered promptly on request.
17 CFR 240.17a-4(f)(3)(v)(A); 17 CFR 240.17a-4(i)(1)
When did the amended 17a-4(f) apply?
The amendments were published in the Federal Register on November 3, 2022. They took effect on January 3, 2023, and the compliance date for the 17a-4 changes was May 3, 2023.
87 FR 66412