Financial Services · Managed platform (Smarsh)

Communication Archiving

Capture, retain and supervise business communications on Smarsh, run for you by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs Smarsh as a managed service, so email, chat, collaboration and text messages are captured and kept in non-rewriteable, non-erasable storage as SEC Rule 17a-4 and FINRA rules require. We connect each channel, set retention and supervision policies with your compliance team, and watch every day for capture gaps. Your compliance staff review flagged messages and decide; we keep the archive complete and the evidence ready for examiners.

The problem it solves

Firms now communicate across email, Microsoft Teams, Slack, Bloomberg, text messages and more, and each channel has to be captured, retained in compliant storage and supervised. Archiving platforms are capable, but they depend on dozens of connectors that break quietly when a vendor changes an API, a user changes phone or a new channel appears. Compliance teams often learn about a capture gap during an exam or a production request, when it is too late to recover the messages. Retention schedules, legal holds and lexicon policies drift away from written procedures without anyone noticing.

  • Capture connectors fail silently and gaps are found during exams or document requests
  • New channels are adopted by staff before they are approved and captured
  • Retention, legal hold and supervision settings drift from written supervisory procedures
  • Production requests from regulators and counsel are assembled under time pressure

Who uses it

  • Chief compliance officers at broker-dealers, investment advisers and futures firms
  • Supervisory principals and compliance analysts who review flagged communications
  • Records management and legal teams who handle holds and productions
  • IT and messaging teams who own the email and collaboration systems being captured
  • Internal audit and examiners, who need evidence that capture and supervision are complete

Requirements it supports

SEC Rule 17a-4 (17 CFR 240.17a-4), including the electronic recordkeeping requirements of paragraph (f)FINRA Rule 4511 (General Requirements for books and records)FINRA Rule 3110 (Supervision), including review of correspondence and internal communicationsInvestment Advisers Act Rule 204-2 (17 CFR 275.204-2)CFTC Rule 1.31 (17 CFR 1.31) regulatory recordsFINRA Rule 2210 (Communications with the Public)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Smarsh provides and operates the archiving platform, Moraph configures and runs your use of it, and your firm makes the compliance decisions.

AreaMoraphSmarshYour organization
LicensingResells Smarsh licenses and keeps license counts aligned with your captured populationSets license terms and product availabilityAgrees the channels and users to license and pays under the order
Platform availabilityMonitors availability, raises incidents with Smarsh and keeps you informedOperates the platform and its storage under its own service commitmentsTells Moraph about business impact
Capture configurationConfigures and maintains connectors for each approved channelProvides and maintains the connectors and capture methodsGrants the technical access connectors need on your systems
Capture monitoringRuns daily capture checks and investigates gapsInvestigates platform-side causes Moraph escalatesFixes source-side causes on your systems with Moraph
Retention and holdsApplies approved retention policies and holds and documents the baselineEnforces retention and storage controls in the platformOwns the retention schedule and instructs holds and releases
Supervision policiesConfigures and tunes policies and lexicons on approved requestsProvides the policy and review featuresWrites supervisory procedures, approves policies and reviews flagged messages
AccessManages users and review groups from your directory and approvalsProvides platform access controlsApproves who holds which role and reviews access periodically
Platform updatesReviews Smarsh release notes for effects on your configuration and tells you of changesReleases and applies platform updatesTests changes that affect reviewers where needed
IncidentsLeads incident handling for the service and reports cause and fixResolves platform incidents and provides root cause where availableDecides on any regulatory disclosure
Regulatory obligationsProvides evidence of capture, retention and configurationProvides platform attestations under its termsRemains responsible for meeting books-and-records and supervision rules, including Rule 17a-4(f) designations

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Smarsh itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    During onboarding, each channel moves from approval to tested capture, with the owner of each step visible.

    ChannelApproved by complianceAccess grantedTest captureMonitoringStatus
    Email (Microsoft 365)YesYesConfirmedOnLive
    Microsoft TeamsYesYesConfirmedOnLive
    Bloomberg chatYesYesConfirmedOnLive
    Text messaging (firm devices)YesPendingNot startedOffWaiting on client IT
    SlackNot approvedNoNot startedOffOn hold
    During onboarding, each channel moves from approval to tested capture, with the owner of each step visible.

  2. Step 2

    Daily capture check

    Every day, expected and received volumes are compared by channel; a drop opens an incident before it becomes an exam finding.

    ChannelUsers in scopeExpected (7-day average)Received yesterdayVarianceResult
    Email41218,24017,905-2%Within tolerance
    Microsoft Teams3989,6109,488-1%Within tolerance
    Bloomberg chat362,1502,212+3%Within tolerance
    Text messaging1201,840312-83%Incident INC-2291 opened
    Every day, expected and received volumes are compared by channel; a drop opens an incident before it becomes an exam finding.

  3. Step 3

    Working a capture gap

    A gap is worked to cause, recovery and fix, and the record goes to compliance for sign-off.

    Incident INC-2291 · Text messaging capture drop

    1. Volume drop detected by daily checkMoraph service desk
    2. Affected users identified: 94 on a new device buildMoraph service engineer
    3. Cause traced to capture app missing from new buildClient IT with Moraph
    4. Capture app redeployed and test messages confirmedClient IT
    5. Backfill from carrier records requestedMoraph service engineer
    6. Incident report reviewed and signed offChief compliance officer
    A gap is worked to cause, recovery and fix, and the record goes to compliance for sign-off.

  4. Step 4

    A retention change request

    Changes to retention are applied only after the records owner and compliance approve them, and the request stays with the change.

    Change CR-0874 · Retention for advisory client correspondence

    Requested by
    Records manager (Example Securities LLC, fictional)
    Current setting
    6 years
    Requested setting
    7 years
    Reason
    Retention schedule updated
    Affects
    Email and Teams for the advisory business line
    Status
    Approved, scheduled

    Approvals

    • Records owner: approved
    • Chief compliance officer: approved
    • Moraph change review: no conflict with active holds
    Changes to retention are applied only after the records owner and compliance approve them, and the request stays with the change.

  5. Step 5

    Quarterly configuration baseline review

    Each quarter the documented baseline is compared with what is configured, and any difference is explained or corrected.

    Configuration baseline · Q3 review

    Channels in baseline
    6
    Retention policies
    9
    Active legal holds
    3
    Supervision policies
    14
    Differences found
    2

    Differences

    • Lexicon 'Guarantees' edited without change request: reverted, change request raised
    • Departed user still in a review group: removed
    Each quarter the documented baseline is compared with what is configured, and any difference is explained or corrected.

  6. Step 6

    Monthly service review

    Once a month, Moraph and your compliance and IT leads go through capture health, incidents, changes and decisions needed.

    AreaThis monthStatusOwnerDecision needed
    Capture coverageAll approved channels capturedGoodMoraphNone
    Incidents1 gap, recovered in partOpen actionClient ITDevice build checklist
    Changes4 applied, 1 pendingGoodMoraphApprove CR-0881
    Supervision backlog312 items, oldest 6 daysWatchComplianceAdd reviewer to group B
    Smarsh notices1 planned maintenance windowInformationalSmarshNone
    Once a month, Moraph and your compliance and IT leads go through capture health, incidents, changes and decisions needed.

Workflows

The principal workflows

  1. Capture

    Moraph connects Smarsh to each approved communication channel, confirms that messages from every in-scope user arrive, and checks capture every day so a broken connector is found and fixed quickly.

    • Channels and in-scope users agreed with your compliance team
    • Smarsh connectors configured for email, collaboration, chat and mobile channels
    • Test messages sent and confirmed in the archive for each channel
    • Daily capture checks compare expected and received volumes by channel and user
    • Gaps raised as incidents, fixed, and recorded with the period affected

  2. Retain

    Retention periods, legal holds and storage settings are configured in Smarsh to match your record retention schedule, and every change goes through a recorded change request approved by your records owner.

    • Retention schedule mapped to Smarsh retention policies by record type
    • Storage configured to meet the Rule 17a-4(f) electronic recordkeeping requirements
    • Legal holds placed and released only on your legal team's instruction
    • Retention changes approved by your records owner before Moraph applies them
    • Configuration baseline reviewed with you each quarter

  3. Supervise

    Smarsh applies the lexicon and policy rules your compliance team approves and queues flagged messages for review. Your reviewers decide on each message; Moraph tunes policies on request and reports on review backlog.

    • Supervisory procedures translated into Smarsh policies and lexicons
    • Sampling and random review rates set by your compliance team
    • Flagged messages queued to the right reviewer group
    • Reviewers record their decision and escalate where needed
    • Moraph reports on review backlog and policy hit rates for tuning

  4. Produce

    When a regulator, auditor or counsel asks for communications, your authorized staff search and export from Smarsh, and Moraph helps scope the search, run large exports and document how the production was made.

    • Request logged with its scope, custodians and date range
    • Search run in Smarsh by your authorized staff, or by Moraph at your instruction
    • Results reviewed and exported in the requested format
    • Production documented with the search criteria and who ran it
    • Any related legal hold placed or confirmed

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Chief compliance officer

Chief compliance officer, head of compliance, designated supervisory principal

Owns the firm's communication archiving and supervision program and answers for it to regulators.

Sees

  • Capture coverage by channel and user, and every gap incident
  • Supervision policies, review backlog and policy hit rates
  • The configuration baseline and change history
  • Monthly service reviews from Moraph

Does

  • Approves which communication channels may be used for business
  • Approves supervision policies, lexicons and sampling rates
  • Approves changes to supervision configuration requested by the business or proposed by Moraph
  • Assigns reviewers to review groups
  • Receives and signs off gap incident reports
  • Prepares exam and board reporting on the program

Cannot

  • Delete or alter archived messages; retention storage does not allow it
  • Release a legal hold without the legal team's instruction
Approvals
Approves policy and channel changes. Changes that reduce retention also need the records owner.
Notified about
Capture gap incidents, supervision backlog beyond the level your procedures set, change requests awaiting approval, and the monthly service review.

Supervisory reviewer

Registered principal, compliance analyst, supervision analyst

Reviews communications that Smarsh flags or samples, and records whether each needs action.

Sees

  • Flagged and sampled messages for the review groups assigned to them
  • The policy or lexicon term that flagged each message
  • Earlier review decisions on the same conversation

Does

  • Reviews flagged messages and records a decision and comment
  • Escalates messages that need further action
  • Reports false-positive patterns for policy tuning
  • Requests additional searches through compliance

Cannot

  • Review their own communications
  • Change policies, lexicons or review groups
  • Export messages outside a logged production
Approvals
Escalations go to the chief compliance officer or the supervisor your procedures name.
Notified about
New items in their review queue and items returned to them.

Records and legal

Records manager, in-house counsel, legal operations, eDiscovery specialist

Owns retention periods and legal holds, and handles document requests from regulators and litigants.

Sees

  • Retention policies and their mapping to your retention schedule
  • Active legal holds and the custodians they cover
  • Production history with search criteria and exports

Does

  • Approves retention policy changes
  • Instructs Moraph to place, extend or release legal holds
  • Searches the archive and exports productions
  • Requests Moraph help with large or complex productions

Cannot

  • Shorten retention below the period the rules require
  • Delete messages under hold or within their retention period
Approvals
Their retention changes are applied by Moraph only after a recorded approval; reductions also go to the chief compliance officer.
Notified about
Holds placed or released, productions completed, and retention changes awaiting their approval.

Client IT administrator

Messaging administrator, Microsoft 365 or Google Workspace administrator, mobile device administrator

Owns the email, collaboration and mobile systems that Smarsh captures, and grants the technical access capture needs.

Sees

  • Connector status and the technical access each connector uses
  • Capture gap incidents caused by changes on their systems
  • Change requests that touch their systems

Does

  • Grants and maintains the service accounts and permissions connectors need
  • Tells Moraph in advance about changes to messaging systems
  • Fixes source-side causes of capture gaps with Moraph
  • Keeps user directory data accurate so coverage follows the population

Cannot

  • Change retention, holds or supervision policies
  • Read archived messages unless granted a compliance role
Approvals
Technical access requests from Moraph are approved by them; changes to their systems follow your own change process.
Notified about
Connector failures and capture gaps traced to their systems, and planned connector changes.

Moraph service team

Moraph service engineers, service desk analysts and the named service manager

Configures, monitors and maintains Smarsh for you, and reports on how the service is running.

Sees

  • Connector health, capture volumes and platform alerts
  • Configuration of channels, retention, holds and policies
  • Message content only when your compliance team asks them to run a search or production

Does

  • Configures and maintains capture connectors
  • Runs daily capture checks and investigates gaps
  • Applies approved changes to retention, holds and policies
  • Raises and follows platform issues with Smarsh support
  • Prepares the monthly service review and quarterly baseline review
  • Runs searches and exports at your instruction

Cannot

  • Change retention, holds or supervision policies without your recorded approval
  • Make supervisory decisions on messages
  • Read message content outside a request you have logged
Approvals
Every configuration change they make is tied to a change request approved by the owner you name.
Notified about
Platform alerts, connector failures, capture volume drops and new service requests.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Checks that capture, retention and supervision work as the firm's procedures say.

Sees

  • Capture coverage and gap incidents
  • Retention configuration and change history
  • Supervision review records within the scope granted

Does

  • Reads evidence packs and reports
  • Requests specific searches through compliance
  • Leaves review notes where the firm enables them

Cannot

  • Change, approve or delete anything
  • Keep access after it expires
Approvals
Their access is approved by the chief compliance officer, with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionCCOReviewerRecords/legalClient ITMoraph teamAuditor
Approve channels for business useApprovesNo accessView onlyView onlyView onlyView only
Configure capture connectorsView onlyNo accessNo accessApprovesFullNo access
Review flagged messagesFullOwn work onlyNo accessNo accessNo accessView only
Change supervision policiesApprovesNo accessNo accessNo accessFullView only
Change retention policiesApprovesNo accessApprovesNo accessFullView only
Place or release legal holdsView onlyNo accessApprovesNo accessFullNo access
Search and export productionsFullNo accessFullNo accessOwn work onlyNo access
Investigate capture gapsView onlyNo accessView onlyFullFullView only
View configuration baselineView onlyNo accessView onlyView onlyFullView only
Manage review groups and usersApprovesNo accessNo accessView onlyFullNo access
View service reportsView onlyNo accessView onlyView onlyFullView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph applies changes to retention, holds and supervision policies only against a change request approved by the owner you name, and each change is recorded with the request it came from.
  • Moraph staff do not read message content as part of routine operations. They search or export only when your compliance or legal team logs a request, and each search is recorded.
  • Roles and review groups are agreed with you during onboarding and can follow your identity provider's groups. Reviewers are kept out of review groups that would cover their own communications.
  • Auditors and examiners receive temporary read-only access with a defined scope and an end date, approved by your chief compliance officer, rather than shared accounts.

Features

What it does

Managed channel capture

Moraph configures and maintains Smarsh capture for email, Microsoft Teams, Slack, Bloomberg, text messaging and other channels you approve and license.

Daily capture monitoring

Expected and received message volumes are compared every day by channel and user, and drops are investigated as incidents.

Compliant retention

Smarsh retains captured messages in storage configured to meet SEC Rule 17a-4(f) and the retention periods in your schedule.

Legal hold management

Holds placed, extended and released on written instruction from your legal team, with each action recorded.

Supervision policies

Your written supervisory procedures are turned into Smarsh lexicons, policies and sampling rules, reviewed with your compliance team before they go live.

Policy tuning

Moraph reports on which policies produce flags that reviewers routinely clear, and proposes changes for your compliance team to approve.

Joiner, mover and leaver handling

New and departing staff are added to or removed from capture and review groups as your HR or identity records change, so coverage follows the population.

New channel intake

When the business asks to use a new messaging tool, Moraph assesses whether Smarsh can capture it and what configuration is needed, so compliance can decide before it is used.

Production support

Help scoping searches, running large exports and documenting how a production was assembled for regulators, auditors and counsel.

Configuration baseline

A documented record of every channel, retention policy, hold and supervision policy, compared each quarter with what is actually configured.

Exam evidence pack

Capture coverage, retention settings, gap incidents and change history assembled for examiners and internal audit on request.

Follow-the-sun service desk

Moraph's service desk across our offices takes requests and incidents around the clock, with escalation to Smarsh support where the platform itself is at fault.

Integrations

How it connects to your systems

Connects toHowWhat flows
EmailJournaling or API capture from Microsoft 365, Google Workspace or on-premises Exchange, configured with your messaging team.In: email messages and attachments for in-scope users.
Collaboration toolsCapture from Microsoft Teams, Slack, Zoom chat and other collaboration tools that Smarsh supports and you license.In: chat messages, channel posts, edits, deletions and files.
Financial messagingCapture from Bloomberg and other financial chat networks used by trading and sales staff.In: instant messages and chat transcripts.
Mobile and text messagingCapture of SMS, iMessage and WhatsApp business messages through the mobile capture options Smarsh supports, for firm-managed or approved devices.In: text and messaging app conversations for enrolled users.
Identity provider and HRUser directory data so capture and review groups follow joiners, movers and leavers, and single sign-on for reviewers.In: user identity, group membership and employment status.
Moraph Voice Recording ComplianceWhere you also use Moraph's voice recording service, recorded calls and their metadata can be retained alongside written communications.In: call recordings and metadata.
Moraph service reportingCapture checks, incidents and change requests are tracked in Moraph's service tooling and shared in the monthly review.Out: capture coverage, incidents and change history.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your staff and Moraph's staff sign in through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Reviewers see their review groups, legal sees holds and productions, and Moraph's service team sees configuration rather than content.

Logged content access

Every search and export of message content, by your staff or ours, is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Smarsh's own platform assurance reports are available from Smarsh under its terms.

Data residency

Archive data is held in the Smarsh hosting region selected for your firm, and Moraph's service tooling uses the United States, United Kingdom or Australia region you choose.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Service operations

Daily capture check

For moraph service team and the chief compliance officer

Expected and received messages by channel and user for the previous day, with any drops beyond the tolerance you set.

Break down by
Channel, User group, Connector, Variance
Delivered as
Daily email summary; live view for the service team
Used for
Finding capture gaps early, while the cause can still be fixed and the missing period recovered where the source allows.

Capture gap incidents

For chief compliance officer, records and legal, internal audit

Each gap: the channel, users and period affected, the cause, whether messages were recovered, and the fix.

Break down by
Channel, Cause, Recovery outcome, Period
Delivered as
Incident report per gap; monthly summary in PDF
Used for
Deciding whether a gap needs disclosure or remediation, and evidencing how it was handled.

Change request log

For chief compliance officer, records owner, client IT

Every change to channels, retention, holds or policies, with who requested and approved it and when Moraph applied it.

Break down by
Change type, Requester, Approver, Status
Delivered as
Live view; CSV export
Used for
Showing that configuration changes were authorized.

Compliance oversight

Capture coverage

For chief compliance officer and examiners

Every in-scope user and channel, whether capture is active, and users added or removed in the period.

Break down by
Channel, Business line, User status, Period
Delivered as
Monthly PDF; CSV export
Used for
Confirming that everyone who must be captured is captured.

Supervision backlog

For chief compliance officer and review group leads

Flagged and sampled items awaiting review, by age, and items reviewed in the period.

Break down by
Review group, Reviewer, Policy, Age band
Delivered as
Weekly email; monthly service review
Used for
Keeping review within the timeframes your written supervisory procedures set.

Policy hit analysis

For chief compliance officer

Flags produced by each policy and lexicon, and how often reviewers cleared them without action.

Break down by
Policy, Lexicon term, Channel, Decision
Delivered as
Monthly PDF
Used for
Deciding which policies to tune so reviewers spend time on the messages that matter.

Regulatory and audit

Configuration baseline review

For chief compliance officer, records owner, internal audit

The documented baseline of channels, retention, holds and policies compared with what is configured, with any differences explained.

Break down by
Area, Setting, Difference, Resolution
Delivered as
Quarterly PDF
Used for
Evidencing that the archive is configured as your procedures say.

Legal hold register

For records and legal

Active and released holds, their custodians and date ranges, and who instructed each action.

Break down by
Matter, Custodian, Status, Date
Delivered as
Live view; CSV export
Used for
Confirming that holds are in place and that nothing under hold has expired.

Production history

For records and legal, chief compliance officer

Each production: the request, search criteria, custodians, date range, who ran it and what was exported.

Break down by
Requester, Matter, Date, Format
Delivered as
Live view; PDF and CSV export
Used for
Showing how a production was assembled if it is questioned later.

Service review

Monthly service review

For chief compliance officer, client IT, Moraph service manager

Capture health, incidents, changes, open requests, Smarsh platform notices and items needing your decision.

Break down by
Area, Status, Owner
Delivered as
PDF and review meeting
Used for
Keeping both sides accountable for the running of the service.

Content access log

For chief compliance officer and internal audit

Every search and export of message content, by whom, when and for which request.

Break down by
User, Organization, Request, Date range
Delivered as
Monthly CSV; on request
Used for
Checking that message content is accessed only for legitimate requests.

Exports, access and evidence

  • Capture, incident and change reports come from Moraph's service tooling; supervision and production records come from Smarsh. The monthly service review brings both together.
  • Every report can be exported to CSV, and summary and evidence reports to PDF. Scheduled reports go only to the people entitled to see them.
  • Reports describe the service and the configuration, not the content of messages. Content stays in Smarsh and is accessed through logged searches.
  • Evidence packs for examinations and audits are assembled from these reports on request, scoped to the period and channels asked about.
  • The reports Smarsh itself provides remain available to your authorized users alongside Moraph's reporting.

Deployment

Where and how it runs

Smarsh cloud, managed by Moraph

Smarsh hosts the archive; Moraph configures and runs it for you under a managed service agreement.

Moraph-managed with your existing Smarsh licenses

If you already license Smarsh, Moraph can take over configuration and operations, subject to Smarsh's terms.

Alongside other Moraph services

Run with Moraph's Voice Recording Compliance, Data Loss Prevention or Mobile Device Management services so channels are governed together.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Channel inventory

We list every channel your staff use for business, confirm which are approved, and agree what Smarsh will capture. We need input from compliance, IT and business line heads.

Retention and supervision design

Your retention schedule and written supervisory procedures are mapped to Smarsh retention policies, review groups, lexicons and sampling, and approved by your compliance and records owners.

Connector setup

Connectors are configured with your IT team, test messages are confirmed in the archive, and capture checks are switched on for each channel.

Historical data migration

Where you are moving from another archive, existing records are migrated with Smarsh under a plan that keeps chain of custody and verifies counts. This is scoped in the proposal.

Reviewer onboarding

Reviewers and legal users are set up from your directory and shown how to work review queues and run searches.

Baseline and handover to service

The configuration baseline is documented and signed off, and the service moves into daily monitoring with a first service review.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Smarsh. The platform belongs to Smarsh, and Smarsh's own service commitments, roadmap, maintenance and outages apply to it.
  • Licenses are subject to Smarsh's terms, and the channels that can be captured depend on what Smarsh supports and what you license.
  • Capture depends on the source systems. If a channel is used on an unmanaged device or an unapproved app, it may not be captured at all.
  • Messages that were never captured, for example during a source-side outage, may not be recoverable. Daily checks find gaps; they cannot always fill them.
  • Your firm remains responsible for its books-and-records and supervision obligations, including the Rule 17a-4(f) designations and undertakings that apply to you.
  • Moraph does not make supervisory decisions. Your reviewers decide whether a message needs action.
  • Smarsh's lexicons and policies flag messages for review; they do not find every problem message, and your sampling and review procedures still apply.
  • Legal advice on retention periods, holds and disclosures is not part of the service.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. List every channel your staff use for business and check which ones Smarsh can capture for you
  2. Ask how a capture gap would be detected, and review a sample incident report
  3. Review the change request process for retention, holds and policies and who approves each
  4. Check how Moraph's access to message content is limited and logged
  5. Walk through the responsibilities table with your compliance, legal and IT leads
  6. Ask for a sample monthly service review and configuration baseline

Questions

Frequently asked questions

Who owns the archived data?

Your firm does. Smarsh holds it under its agreement, and how it is returned or transferred at the end of the service is set out in the contract and in Smarsh's terms.

Does Moraph read our messages?

Not as part of routine operations. Moraph's team works on configuration and capture health, and searches content only when your compliance or legal team logs a request. Each search is recorded.

Does this make us compliant with Rule 17a-4?

It supports your compliance. Smarsh provides storage designed for the rule and Moraph keeps capture and configuration in order, but your firm remains responsible for its recordkeeping obligations, including the designations and undertakings the rule requires.

We already license Smarsh. Can Moraph take it over?

Usually, subject to Smarsh's terms. We start with a review of your current configuration against your procedures and agree what needs to change.

What happens when Smarsh has an outage?

Moraph raises and follows the incident with Smarsh, keeps you informed and records the effect on capture. Smarsh's own service commitments govern the platform itself.

How is it priced?

Smarsh licenses are priced under Smarsh's terms, usually by captured user and channel, and Moraph's managed service is priced separately. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Communication Archiving

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Communication Archiving guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Communication Archiving support guide.

Related products