Global Relay: communications archiving, surveillance and data lifecycle

Global Relay addresses the records created when staff communicate with clients, counterparties and colleagues. Its broker-dealer offering captures channels including email, instant messaging, Bloomberg, LSEG, mobile and social communications, then supports supervisory review and retrieval. The customer configures review queues and escalation: supervisors can approve, reject or escalate items, including through multiple review levels. For an FX broker, this places the service around the evidence of sales, dealing and client-service conversations.[1]

Surveillance rules can suppress repeated flags, approved material and trusted-sender noise, while routing cases by language, geography or business function. Contextual AI and keyword rules can be used separately or together. These choices affect the queue that reviewers actually see: a broker can retain a narrow lexicon control while introducing contextual analysis for a different communication risk. The published capabilities describe detection and workflow tools; they do not supply a customer-specific detection rate.[3]

The developer portal separates Conversation, Event, Voice and Email APIs. This is useful when modelling source systems: a stream of chat events has different structure from an email or recorded call. Open Connector integration supplies the capture route for a source that needs custom integration, rather than making the source application itself part of Global Relay’s operating responsibility.[7]

Conversation API onboarding requires an application and declared source types. Authentication uses OAuth client credentials, with source-appropriate scopes and tokens. Credentials belong on the server, outside client-side code and repositories. The guide directs integrators to reuse a valid token and obtain a new one at expiry; a compromised client secret should be revoked and replaced through support.[8]

AI Assistant’s connected sources include systems such as Jira, Confluence and CRM applications. The product page describes updating CRM notes and triggering workflows, alongside archive search and summarisation. Existing permissions govern access and interactions are logged. This gives the assistant an operational role beyond answering questions, with the actual connected-system permissions determining which actions are available.[6]

An Account is not necessarily one employee. The definitions include individual, shared and resource mailboxes, social profiles or company pages, mobile numbers and other messaging identities; “user” can refer to an Account for billing. A person using several captured channels may therefore map to several contractual units. Administrative users can add, suspend or delete accounts and control archive access, so identity administration and subscription reconciliation are connected tasks.[13]

For a custom Open Connector, the customer is responsible for configuration, authentication and end-to-end testing that verifies source data reaches the archive. Standard delivery excludes project management, QA, custom converters, development beyond the guide and a proof-of-concept environment; advanced work needs a separate arrangement. The specification also excludes the standard connector service from the SLA. Requested user-count reconciliation must normally be completed within 30 days of the request, with throttling or suspension possible for non-compliance.[14]

Migration services cover legacy communications and their chain of custody, with reconciliation and controlled access during the transfer. Global Relay names EVX for extraction from on-premises Veritas Enterprise Vault and SOX for Dell EMC SourceOne. These are specific migration routes, rather than a promise that every legacy repository has a ready-made converter. Historical records, identity mappings and access segregation form part of the migration scope.[15]

Global Relay App was formerly called Global Relay Message. Its service terms allocate third-party usage charges and platform restrictions to the customer. Virtual-number registrations depend on local requirements, and WhatsApp Business onboarding depends on third-party verification and provisioning. Those dependencies can affect activation dates. The App is not designed for emergency calling.[17]

The support directory separates technical problems, user training, data work and commercial account queries. Data Services handles matters such as extractions, legacy imports, retention and legal holds, while Customer Success handles account changes and billing. Using the relevant team matters when an archive-search question is actually a preservation or data-delivery request.[19]

The master terms provide standard support to administrative users during Business Hours. Network, urgent technical, security and operational issues receive 24/7/365 coverage; additional professional work can be charged separately.[12]

These figures belong to the schedule incorporated for applicable DORA-regulated customers, rather than every connector. The calculation excludes specified maintenance and external or customer causes. Unscheduled Downtime is defined by reference to interruption beyond 60 minutes per month; its clock begins when the customer contacts support and a ticket opens, and ends when the service operates. The schedule also provides contractual access to assurance and audit information.[18]

The recordkeeping relationship needs explicit scope. Global Relay’s broker-dealer offering describes appointment as a designated third party, or D3P, for relevant electronic-record obligations. This is a contractual records role attached to the customer and its applicable rules. It should be distinguished from the customer’s own registration and responsibility for supervising business communications.[1]

FINRA’s September 2018 notice explains why the exit and non-payment provisions matter: an electronic-recordkeeping vendor’s undertaking must preserve regulatory access and cannot defeat retention requirements through deletion for unpaid fees. The notice concerns firms and vendors generally, not an approval of Global Relay. The firm remains responsible for compliant records arrangements even where the technology is outsourced.[21]

Global Relay publishes encryption in transit and at rest, hardware security modules, monthly formal privilege reviews and security operations spanning Vancouver and London around the clock. Its security page describes Canadian or US data-residency options and states SOC 2 Type II and ISO 27001 assurance. These are provider-published controls and assurance descriptions. The DORA schedule’s default Canadian Sites, unless otherwise agreed, should be matched to the actual deployment and order.[20][18]

Case access can be narrower than access to the wider archive. The eDiscovery product describes reviewers restricted to the case data, without rights to remove or share it, and separate duties for placing and releasing legal holds. Historical custodian attributes can reflect the department or location when the communication was created, rather than only the employee’s current position. Those controls support investigations spanning organisational changes.[4]

The standard service definitions identify Global Relay Communications Inc. as the company. Its public history dates the business to 1999. The company began with communications archiving and subsequently developed a broader portfolio covering supervision, legal investigations, messaging and AI-assisted work.[13][23]

Global Relay says it grew from serving small broker-dealers to serving larger financial institutions and other regulated industries, without taking outside investment. It also describes building its own technology and data-centre infrastructure, including a facility completed in 2013. Those statements explain the supplier’s published ownership and operating approach; they are not evidence that every customer uses an identical location or service configuration.[22]

Operator

Global Relay Communications Inc.

Service scope

Communications capture, recordkeeping, supervision, eDiscovery and business messaging.

Customer types

Broker-dealers; Banks; Investment firms; Other regulated organisations

Delivery

Hosted; API; Managed service

Pricing publication

Public and quoted pricing

Platforms

Global Relay Archive; Global Relay App; AI Assistant

Integrations

Open Connector APIs; WhatsApp Cloud API; Directory synchronisation; SFTP external delivery

Pricing scope

Core subscription prices are ordered individually; optional Open Connector professional and QA work has a published hourly rate.

Implementation

Source capture, identity and permission configuration, reconciliation, migration and role-based training.

Support

Separate technical, training, data-services and customer-success teams; contracted coverage and service-specific exclusions apply.

Permissions and regulatory scope

Communications technology and contracted recordkeeping services. A D3P appointment and DORA schedule have specific customer and service scope.

Provider metadata checked 20 Oct 2026Source 22Source 13Source 1Source 7Source 14Source 16Source 19Source 18Source 17Source 2Source 5Source 6Source 25

The August 2026 AI terms say that both Global Relay and third-party models run within its own operated infrastructure. Customer Content is not used to train models; testing with that content requires consent and an agreed scope. Qualified human oversight is required, including review before consequential action. Outputs cannot be the sole basis for any decision; solely automated decisions with legal or similarly significant effects are also prohibited.[24]

The SFTP specification puts collection and downstream import on the customer. Data is encrypted with the customer’s PGP public key and delivered in compressed encrypted files; that key must be rotated at least annually. It therefore needs an active collection and reconciliation process. The 90-day delivery-file window is a transfer-system rule and should not be read as the retention period for the communications archive.[25]

Termination ends archive access. Options are paid export, separately ordered prepaid static archiving or written deletion. Without export/static arrangements, data may be deleted 120 days after termination; online access does not continue. A scoped exception preserves FINRA/SEC records for qualifying customers with a valid current recordkeeper appointment despite non-payment, until retention or regulatory-release conditions are met.[12]