Message Archiving (Compliance Archiving)

General definition

Message Archiving (Compliance Archiving) is the practice of capturing every message, attachment and relevant event from a communication channel and storing it in a form that cannot be quietly altered or deleted, indexed so that it can be searched and produced on demand. It differs from ordinary chat history, which exists for the user’s convenience: an archive exists for the organisation, its regulators and its lawyers, and it is governed by retention rules rather than by user preference.

The obligations come from several directions:

• Financial services: SEC Rule 17a-4 and FINRA rules in the US, and MiFID II in the EU, require firms to record and retain business communications, including chat, for years and to be able to supervise them. MiFID II sets a minimum of five years for records of client orders and related communications
• Healthcare: HIPAA requires covered entities to retain required documentation for six years, and clinical communications with patients often form part of the medical record under state or national rules
• Litigation and eDiscovery: once a dispute is reasonably foreseeable, relevant electronically stored information must be preserved, and courts expect it to be producible with its metadata
• Internal governance: HR investigations, fraud reviews and complaint handling depend on reconstructing who said what

A compliance archive has a few defining properties. It captures from the server, not from clients, so that nothing is missed. It is immutable or write-once for the retention period, typically enforced with WORM storage such as object lock on cloud buckets. It keeps metadata alongside content: sender, recipients, timestamps, edits, deletions and the room or channel. It is searchable, so supervision and discovery are practical. And every access to it is written to an audit log.

This is also why archiving and end-to-end encryption are alternatives rather than complements. If only the participants’ devices can decrypt a message, the server cannot archive it in readable form, supervise it or search it. Regulated organisations therefore choose messaging that encrypts in transit and at rest but keeps the server able to archive: the compliance-archive model.

In the Ethora ecosystem

Ethora is built on the compliance-archive model. The chat server keeps a read-only message archive separate from the live message store, so the record cannot be modified by ordinary user actions, and the compliance audit trail records administrative and access events alongside it. Both can be exported as immutable logs to an S3 bucket in your own account, where object-lock retention keeps them write-once for as long as your policy requires. Retention periods are configurable per App, and per-user erasure is available for privacy requests where record-keeping rules allow it.

Because the platform runs on a dedicated or self-hosted server, the archive stays inside the customer’s own cloud account or data centre, which matters to the financial and healthcare customers Ethora is designed for. The Trust & Safety system complements the archive by removing sensitive data that should never have been shared, such as a card number in a support chat, before it becomes part of the permanent record, and reporting that event to your systems so the removal itself is documented.