Best WhatsApp and iMessage archiving for financial firms
This is WhatsApp archiving and iMessage archiving for a regulated firm: keeping the client conversations advisers already have in the two consumer apps, as records you can review and produce. We read seven capture tools against the adviser and broker-dealer rules, starting with the question each vendor answers differently: how the messages are captured.
Reviewed October 2026
Best overall
LeapXpert
The fullest account of how both apps are captured: WhatsApp and iMessage in the native apps or in Teams, personal or managed Apple IDs, and every message exported to the archive you keep.
Read the review of LeapXpertBest for a small firm buying capture and archive together
MirrorWeb
Names WhatsApp and iMessage capture on BYOD and corporate phones with no wrapped app and no second number, keeps business messages only, and stores them Write Once, Read Many.
Read the review of MirrorWebBest for a firm whose clients use WhatsApp only
Global Relay
Captures WhatsApp Business in its own app through the official WhatsApp API, with audit trails, optional WORM storage and proof-of-review reports in the same archive.
Read the review of Global Relay
The comparison table
| Vendor | iMessage capture, and how204-2(a)(7); 17a-4(b)(4) | WhatsApp capture, and how204-2(a)(7); 17a-4(b)(4) | Business kept apart from personal | Audit trail or non-rewriteable storage17a-4(f)(2)(i) | Retention set per rule204-2(e)(1); 17a-4(b) | Supervisory review and flagsFINRA 3110(b)(4) | Export for an exam17a-4(f)(2)(iv); 204-2(g) |
|---|---|---|---|---|---|---|---|
LeapXpertCapture layer | Meets Native app or Teams; any Apple ID | Meets Native app or Teams; WABA number | Meets Dedicated app on personal phones | Check with vendor Immutable; your archive's mode | Not stated Set in your archive | Partial Live supervision; no review record | Meets To your archive: API, SMTP, SFTP |
MirrorWebArchive with mobile capture | Partial Named; method not described | Partial Named; method not described | Meets Business conversations only | Meets Write Once, Read Many | Check with vendor Settings not described | Partial Scored alerts; no review record | Meets Formats not named |
Global RelayArchive with its own app | Not stated Not named on its pages | Meets Its App, official WhatsApp API | Meets Its App keeps them separate | Meets Audit trails; WORM optional | Meets Flexible retention terms | Meets Lexicon; proof-of-review reports | Partial Formats not named |
Archive IntelNative-app capture | Meets Native app, no new number | Meets Native app, no new number | Meets Contact whitelist | Meets WORM cloud; access audit trail | Meets By channel and record type | Partial AI review; no review record | Meets Formatted export, no IT needed |
JatheonArchive, app or carrier capture | Partial Named; method not tied to it | Partial Named; method not tied to it | Meets Whitelists and blacklists | Check with vendor Audit trails; WORM not stated | Meets Retention policies | Partial Keyword alerts to supervisors | Meets Exam-ready; formats not named |
ProofpointCapture feeding an archive | Partial Named; method not described | Partial Named; method not described | Not stated | Meets WORM; audit trails (its Archive) | Meets Retention and disposition | Meets Queues, sampling, evidence | Meets For regulatory response |
SmarshCarrier and app capture | Partial “Where supported”, undefined | Meets WhatsApp Business, automatic | Meets BYOD, kept separate | Meets WORM and audit-trail modes | Meets Policy-based retention | Partial Supervision; no review record | Meets PST, EML, HTML, XML |
How WhatsApp and iMessage capture works
WhatsApp archiving and iMessage archiving are harder than text archiving for one reason: neither app is a carrier service. Apple says SMS and MMS are carrier-provided services, while iMessages travel between Apple devices over Wi-Fi or cellular data, encrypted end to end. WhatsApp is an app as well. So capture of these two has to happen at the app, on the device or through a firm-run identity, and a vendor's answer to “how” is the first thing to read. Plain SMS and carrier texting tools are compared on our text message archiving and FINRA-compliant texting pages.
Four ways vendors capture the two apps
| Method | How it works | What the adviser changes | Stated by |
|---|---|---|---|
| Native-app capture | The adviser keeps messaging clients in Messages and WhatsApp on the same number; the vendor captures the business conversations without a second app or number | Nothing day to day | Archive Intel, LeapXpert (Native Mode), MirrorWeb |
| A firm app or business identity | The adviser answers from a firm app (Microsoft Teams, Leap Work, the Global Relay App) or a WhatsApp Business number; the client stays in WhatsApp | Opens a different app for clients | LeapXpert (Governed Mode), Global Relay |
| Carrier capture | The mobile carrier passes copies of the messages it carries to the archive | Nothing, on a supported carrier | Smarsh, Jatheon |
| A capture feed to your archive | A capture service collects the apps and delivers them to whichever archive the firm already keeps | Depends on the capture method | Proofpoint Capture, LeapXpert |
Vendors' own pages, read October 22, 2026
Two vendors here name the apps without describing the method: MirrorWeb says only that there is no wrapped app and no second number, and Proofpoint lists WhatsApp and iMessage among the channels Capture collects. Their capture cells read Partial for that reason, not because the capture is weaker.
Business messages on a personal phone
Neither record rule names a device or an app. The adviser rule describes written communications on four subjects; the broker-dealer rule describes all communications relating to the business. A client conversation on an adviser's own iPhone is the same record as one on a firm phone, so the tool has to catch it without sweeping the adviser's family chats into the archive. Vendors draw that line in three ways.
- A contact list decidesArchive Intel, Jatheon, MirrorWeb
- The firm, or the adviser, marks which contacts are clients, and only those conversations are captured. Archive Intel keeps the list centrally and syncs it with the client database; Jatheon uses whitelists and blacklists; MirrorWeb calls it Trusted Contacts. The risk is a client who is not on the list yet.
- A separate app or identity decidesLeapXpert, Global Relay
- Client conversations happen in a firm app or under a business identity, so everything there is business and nothing else is touched. The cost is a habit: the adviser has to open the firm app, and a client who messages the personal number is outside it.
- The vendor's BYOD capture decidesSmarsh
- Smarsh says its capture on BYOD phones keeps business and personal communications apart, without saying on its mobile page how the line is drawn. Ask before you rely on it.
Whichever line you choose, write it into your policy: which apps advisers may use with clients, on which phones, and what they do when a client writes somewhere else. Our off-channel communications policy builder drafts that section.
Which tools fit your setup
Tick the apps your clients use and how your advisers work. The list reorders by what each vendor's own page states, using the same statuses as the table.
2 of 7 state capture of both apps on personal phones
- LeapXpertiMessage: Native app, Teams or its own appWhatsApp: Native app, Teams or its own appiMessageMeetsWhatsAppMeetsPersonal phonesMeets
- Archive InteliMessage: Native app on the rep's phoneWhatsApp: Native app on the rep's phoneiMessageMeetsWhatsAppMeetsPersonal phonesMeets
- SmarshiMessage: Where supported, not definedWhatsApp: WhatsApp Business, captured automaticallyiMessagePartialWhatsAppMeetsPersonal phonesMeets
- MirrorWebiMessage: Capture stated, method not describedWhatsApp: Capture stated, method not describediMessagePartialWhatsAppPartialPersonal phonesMeets
- JatheoniMessage: App, enterprise number or carrierWhatsApp: App, enterprise number or carrieriMessagePartialWhatsAppPartialPersonal phonesMeets
- ProofpointiMessage: Capture stated, method not describedWhatsApp: Capture stated, method not describediMessagePartialWhatsAppPartialPersonal phonesNot stated
- Global RelayiMessage: Not named on its pagesWhatsApp: Its own app, official WhatsApp APIiMessageNot statedWhatsAppMeetsPersonal phonesNot stated
Why these two apps became exam questions
The SEC's off-channel cases were about messages the firms did not keep, and the apps named in them are the consumer ones. In September 2022 the SEC charged “15 broker-dealers and one affiliated investment adviser” and said “the firms' employees routinely communicated about business matters using text messaging applications on their personal devices.” In a 2023 case it said employees communicated off-channel “on their personal devices, using messaging platforms, such as WhatsApp.” In 2024 an adviser was charged after three senior employees used personal devices “set to automatically delete messages after 30 days.”
That release speaks about the cases, not about the rule text. The record rules quoted below are as they read on October 22, 2026. A firm that wants to relax its capture because of the release should take that to its compliance counsel first. The full history is in our guide to off-channel communications.
What the rules ask of a WhatsApp or iMessage thread
The rules describe the message, not the app, and they say it differently for an investment adviser and a broker-dealer. The adviser rule covers written communications on four listed subjects; the broker-dealer rule covers all communications relating to the business. Detail and worked dates are in our guides to Rule 204-2 adviser books and records and Rule 17a-4 and WORM storage, and the retention calculator gives the keep-until date.
One client thread, read against the rules
- Adviser: kept if it concerns advice, funds or securities moving, orders or performance, from the end of the fiscal year of the last entry5 years17 CFR 275.204-2(a)(7), (e)(1)
- Adviser: of those, the first years in an appropriate office2 years17 CFR 275.204-2(e)(1)
- Broker-dealer: kept if it relates to the business as such3 years17 CFR 240.17a-4(b)(4)
- Broker-dealer: of those, the first years in an easily accessible place2 years17 CFR 240.17a-4(b)
- Broker-dealer storage: a time-stamped audit trail or non-rewriteable, non-erasableEither17 CFR 240.17a-4(f)(2)(i)(A)-(B)
- Broker-dealer review: by a registered principal, evidenced in writingPrincipalFINRA Rule 3110(b)(4), 3110.07
An SEC-registered adviser has no audit-trail or WORM requirement. Rule 204-2(g) asks it to safeguard records from loss, alteration or destruction, keep a duplicate copy and produce records promptly. A dual registrant should read Rule 204-2(h)(1): a record kept under the broker-dealer rules that is substantially the same as the adviser record is deemed kept under the adviser rule. How that applies to your threads is a question for your compliance counsel. Review, for a broker-dealer, is the job described in our guide to FINRA Rule 3110 supervision: the record must name the reviewer, the message, the date and the action taken.
What to ask a vendor before you sign
The table shows what each vendor's page says. These seven questions cover what the pages leave open; ask for the answers in writing, and match them to your own archive if you keep one. Our archiving requirements matcher lists the channels and rules your firm has to cover.
Seven questions for a WhatsApp or iMessage vendor
- Exactly how iMessage is captured on a phone the adviser ownsCapture method
- Whether personal WhatsApp accounts are in scope, or WhatsApp Business onlyCapture method
- How a client missing from the contact list is caughtBusiness and personal
- The storage mode in writing: audit trail or non-rewriteable17a-4(f)(2)(i)
- For a broker-dealer: whether it files the outside recordkeeper's undertaking17a-4(i)(1)
- What a review record shows: reviewer, message, date, actionFINRA Rule 3110.07
- The export format for one full thread, with attachments17a-4(f)(2)(iv)
Each vendor, read against the rule
LeapXpert
Capture layer- What it is
- A messaging capture platform that sits between the firm and the consumer apps. Its iMessage and WhatsApp pages describe two modes: employees use the native app (Native Mode), or answer from Microsoft Teams or the Leap Work app (Governed Mode). It supports personal and managed Apple IDs, can give each employee a WhatsApp Business number as a single professional identity, offers retroactive capture when a device is unlinked, and exports each timestamped message to the firm's archiving, surveillance or eDiscovery system by API, SMTP or SFTP.
- Who it fits
- A firm that already has an archive and wants advisers to keep using WhatsApp and iMessage with clients, especially one that runs on Microsoft Teams. Its pages speak of hundreds of thousands of users, so a small firm should ask about minimums first.
- What the rule requires, and whether it meets it
- iMessage capture, and howMeetsNative app or Teams; any Apple ID
- WhatsApp capture, and howMeetsNative app or Teams; WABA number
- Business kept apart from personalMeetsDedicated app on personal phones
- Audit trail or non-rewriteable storageCheck with vendorImmutable; your archive's mode
- Retention set per ruleNot statedSet in your archive
- Supervisory review and flagsPartialLive supervision; no review record
- Export for an examMeetsTo your archive: API, SMTP, SFTP
- Not verified by us
- Ask for: the archives it has a live export to (its pages show partner logos without stating the role), how Native Mode works on a phone the adviser owns rather than the firm, and how it records who reviewed a flagged message.
MirrorWeb
Archive with mobile capture- What it is
- A communications archive with supervision. Its mobile archiving page names WhatsApp, SMS and iMessage on BYOD and corporate phones, with “No wrapped apps. No second numbers.”, and keeps texts, images, reactions, group messages, voice notes and edited or deleted messages. Its financial-services page says records are stored Write Once, Read Many and that Trusted Contacts separates personal from work contacts.
- Who it fits
- A small RIA or broker-dealer that wants WhatsApp and iMessage capture and the archive from one vendor; its home page addresses firms from a one-person practice to a global operation.
- What the rule requires, and whether it meets it
- iMessage capture, and howPartialNamed; method not described
- WhatsApp capture, and howPartialNamed; method not described
- Business kept apart from personalMeetsBusiness conversations only
- Audit trail or non-rewriteable storageMeetsWrite Once, Read Many
- Retention set per ruleCheck with vendorSettings not described
- Supervisory review and flagsPartialScored alerts; no review record
- Export for an examMeetsFormats not named
- Not verified by us
- Ask for: how iMessage is captured on an iPhone the adviser owns (its pages do not say), the retention settings by record type, and the export format for a WhatsApp thread.
Global Relay
Archive with its own app- What it is
- An archive with its own messaging app. WhatsApp Business flows through the Global Relay App, which uses the official WhatsApp Cloud API rather than scraping, keeps business and personal conversations separate, and runs on iOS, Android, desktop and the web. The WhatsApp connector page names audit trails of all actions, optional WORM-compliant storage, flexible retention terms and AI supervision; its archive pages add lexicon tools and proof-of-review reports.
- Who it fits
- A firm whose clients message on WhatsApp but not iMessage, or one that will move client chats into a firm-run app the adviser opens on purpose.
- What the rule requires, and whether it meets it
- iMessage capture, and howNot statedNot named on its pages
- WhatsApp capture, and howMeetsIts App, official WhatsApp API
- Business kept apart from personalMeetsIts App keeps them separate
- Audit trail or non-rewriteable storageMeetsAudit trails; WORM optional
- Retention set per ruleMeetsFlexible retention terms
- Supervisory review and flagsMeetsLexicon; proof-of-review reports
- Export for an examPartialFormats not named
- Not verified by us
- Ask for: iMessage capture (not named on the pages we read), whether WORM storage is on by default for your account, and the export format for an exam request.
Archive Intel
Native-app capture- What it is
- An archive and supervision platform built for SEC- and FINRA-regulated firms. It captures iMessage, WhatsApp and Android texts in the native apps on the rep's own phone, with no second phone, no external app and no new number. A contact whitelist, kept centrally and synced with the client database, decides which conversations are business. Its FAQ states WORM-compliant cloud storage and an access audit trail.
- Who it fits
- A firm, from a solo RIA up, whose clients already message the rep's personal number and will not change apps.
- What the rule requires, and whether it meets it
- iMessage capture, and howMeetsNative app, no new number
- WhatsApp capture, and howMeetsNative app, no new number
- Business kept apart from personalMeetsContact whitelist
- Audit trail or non-rewriteable storageMeetsWORM cloud; access audit trail
- Retention set per ruleMeetsBy channel and record type
- Supervisory review and flagsPartialAI review; no review record
- Export for an examMeetsFormatted export, no IT needed
- Not verified by us
- Ask for: the export format of a WhatsApp or iMessage thread, which client databases the whitelist syncs with, and the name of the third-party custodian its FAQ mentions.
Jatheon
Archive, app or carrier capture- What it is
- An archive, in the cloud on AWS or on the firm's own hardware. Its text archiving page archives SMS, MMS, iMessage, WhatsApp, WeChat, voicemail and call logs in native formats, through app-based capture, enterprise numbers and carrier integrations (AT&T, Verizon and T-Mobile among them), regardless of who owns the device. Whitelists and blacklists keep personal contacts out; keyword alerts go to supervisors.
- Who it fits
- A firm that wants one archive for texts, iMessage and WhatsApp with carrier capture for firm phones, or one that wants the archive on its own servers.
- What the rule requires, and whether it meets it
- iMessage capture, and howPartialNamed; method not tied to it
- WhatsApp capture, and howPartialNamed; method not tied to it
- Business kept apart from personalMeetsWhitelists and blacklists
- Audit trail or non-rewriteable storageCheck with vendorAudit trails; WORM not stated
- Retention set per ruleMeetsRetention policies
- Supervisory review and flagsPartialKeyword alerts to supervisors
- Export for an examMeetsExam-ready; formats not named
- Not verified by us
- Ask for: which of its three capture methods covers iMessage and which covers WhatsApp, its 17a-4(f) storage mode in writing, and its export formats.
Proofpoint
Capture feeding an archive- What it is
- Capture and archive products from Proofpoint, which also sells email security. Proofpoint Capture names WhatsApp, SMS, iMessage and Signal among the mobile channels it collects, and delivers them to Proofpoint Archive or another repository in a consistent format. Its archive page names WORM-compliant preservation, audit trails, review queues, sampling and evidence of supervision.
- Who it fits
- A firm already on Proofpoint for email security or archiving that wants the mobile apps in the same place, or a firm that needs capture to feed a different archive.
- What the rule requires, and whether it meets it
- iMessage capture, and howPartialNamed; method not described
- WhatsApp capture, and howPartialNamed; method not described
- Business kept apart from personalNot stated
- Audit trail or non-rewriteable storageMeetsWORM; audit trails (its Archive)
- Retention set per ruleMeetsRetention and disposition
- Supervisory review and flagsMeetsQueues, sampling, evidence
- Export for an examMeetsFor regulatory response
- Not verified by us
- Ask for: how WhatsApp and iMessage are captured (an app, a number or a partner), how business messages are kept apart from personal ones, and which phones it covers.
Smarsh
Carrier and app capture- What it is
- Mobile capture from a large archiving vendor. It captures SMS, MMS, WhatsApp Business and iMessage “where supported”, directly from carrier networks and supported platforms, on corporate-owned and BYOD phones, keeping business and personal communications apart. Messages land in the Smarsh archive, which names WORM and audit-trail retention, policy-based retention and PST, EML, HTML and XML export.
- Who it fits
- A broker-dealer or dual registrant already on the Smarsh archive, or a firm that wants capture with nothing for reps to open.
- What the rule requires, and whether it meets it
- iMessage capture, and howPartial“Where supported”, undefined
- WhatsApp capture, and howMeetsWhatsApp Business, automatic
- Business kept apart from personalMeetsBYOD, kept separate
- Audit trail or non-rewriteable storageMeetsWORM and audit-trail modes
- Retention set per ruleMeetsPolicy-based retention
- Supervisory review and flagsPartialSupervision; no review record
- Export for an examMeetsPST, EML, HTML, XML
- Not verified by us
- Ask for: what “where supported” means for iMessage on your reps' phones and carriers, whether personal WhatsApp accounts are in scope, and an independent 17a-4(f) assessment of the archive.
How we read these vendors
Questions firms ask
Can an adviser use WhatsApp with clients?
No SEC or FINRA rule names WhatsApp. The rules require the firm to keep the messages that are records, whatever app carried them, and the SEC's 2023 case against two broker-dealers named WhatsApp on personal devices as the channel that was not kept. A firm can allow WhatsApp if it captures it, and should say in its policy which accounts and phones are allowed.
17 CFR 275.204-2(a)(7); 17 CFR 240.17a-4(b)(4); SEC release 2023-91
Can a firm capture iMessage from an adviser's own iPhone?
Some vendors say so. Archive Intel states capture in the native app with no second phone or new number, LeapXpert supports personal and managed Apple IDs, and MirrorWeb names iMessage on BYOD phones; Smarsh says “where supported”. Carrier capture alone is not the answer, because Apple describes SMS and MMS, not iMessage, as carrier-provided services. Ask each vendor how it captures iMessage on a phone the firm does not own.
support.apple.com/en-us/104972
What about messages set to disappear?
The rules set the keep periods, five years for an adviser's records and three for a broker-dealer's communications, and say nothing about app settings. One of the SEC's 2024 off-channel cases involved personal devices set to delete messages after 30 days. Capture has to happen before deletion; LeapXpert, MirrorWeb and Jatheon say they keep deleted messages.
17 CFR 275.204-2(e)(1); 17 CFR 240.17a-4(b); SEC release 2024-44
Does the client have to install anything?
None of the vendor pages we read asks the client to install anything. With native-app capture nothing changes on either side. With a firm app, the client stays in WhatsApp: LeapXpert says clients connect through WhatsApp while employees use dedicated apps, and the Global Relay App says your contact uses WhatsApp, and so can you.
Is any WhatsApp archiving tool SEC- or FINRA-approved?
No. Neither the SEC nor FINRA approves vendors, and FINRA retired its Compliance Vendor Directory effective March 19, 2024. A vendor's compliance claim describes its product; the duty to keep and review the record stays with the firm.
finra.org/industry/cvd