Smarsh: communications capture, archiving and supervision

Smarsh supplies the communications record and review layer used by broker-dealers and other regulated firms. It captures business messages, keeps them searchable and helps compliance or legal staff examine conversations. Its broker-dealer offering addresses investment firms, hedge funds and swap dealers as well as securities brokers. For an FX business, the relevant records include employee discussions with clients and counterparties, internal collaboration and recorded calls.[2]

Professional Archive’s current Intelligent Supervision offering combines three different actions. Noise Reduction classifies routine items and removes them from review queues while preserving the communications in the archive. Misconduct Detection looks for contextual patterns such as complaints, guarantees or attempted channel switching. AI Assistant summarises and translates selected material. Smarsh describes detection in ten languages and translation in more than 75; those are separate capabilities.[8]

The same page places final judgment with the reviewer. Classification explanations and a history of automated and human decisions support an audit trail. An automatically suppressed review item therefore has a different status from a deleted source message, and an AI risk flag remains an input to the firm’s investigation.[8]

Smarsh describes integrations using approved channel APIs and preserving identities, timestamps, attachments and conversation threads. Identity mapping connects a person’s different accounts so reviewers can follow communications across channels. The capture-to-archive connection matters operationally: buying an archive does not by itself configure every employee account or mobile service to send records into it.[12]

For mobile deployments, Smarsh describes separating work and personal communications and retaining supported attachments and participant context. This makes employee identity, device ownership and the particular carrier or application part of the implementation design. A broad mobile-channel catalogue should not be interpreted as one identical capture method for every device.[11]

Cloud Capture is managed SaaS; Capture Server runs on the customer’s infrastructure. Both can deliver into an archive, but the Cloud Capture terms allow only 30 days of temporary storage before deletion. The customer must configure source systems and install channel-specific client software where required. Purchased connections can represent a mailbox, messaging account, social profile or mobile number.[4]

Sales handles commercial scoping rather than publishing a universal per-broker tariff. A deployment may combine archive subscriptions, channel capture, migration, support and other services, so its commercial description needs to identify the particular products being bought.[28][29]

Basic technical support is included; Premium has an additional flat charge rather than a per-user support charge. The published schedule identifies enhanced Enterprise support programmes separately from Professional Archive.[17]

Professional Archive self-exports carry no additional charge within performance limits; importing historical material can require professional-service fees. Those entitlements differ from a supplier-assisted extraction after cancellation.[3]

Smarsh’s adoption service starts with scope, project planning and the organisation’s workflows. It includes role-specific rollout and training, with specialist help for infrastructure decisions and regulatory readiness. Customers can operate deployments themselves or add managed services. The published approach is project-based, so a migration of historical records and a new channel activation should be scoped as different pieces of work.[14]

The migration service describes a managed process with an audit trail and reconciliation at individual-message level. For a brokerage replacing a legacy archive, reconciliation is the useful completion evidence: the migration needs to preserve the records selected for transfer and account for their receipt. The same page offers Enterprise Archive deployment on AWS or Azure; that flexibility should not be substituted for the Professional Archive product’s explicit US-hosting terms.[13]

Data Services also addresses legal holds, retention policies and identity metadata. Its work can preserve holds and policies during migration, repair identity issues and provide assisted exports or custom integrations. These functions matter when employee names, email addresses or business structures have changed: the record may exist while still being difficult to find under the correct person.[15]

In the Enterprise demonstration, administrators assign feature and data entitlements. Legal users can be restricted to cases, compliance users to review queues and selected staff to archive administration. Exports can contain metadata or archived objects and can be scheduled from saved searches for a single run or recurring hourly, daily or weekly delivery, including a configured secure FTP destination.[6]

Archive search supports saved, shared and audited searches. Smarsh lists PST, EML, HTML and XML exports, with optional EDRM support. Format choice affects what the receiving legal or surveillance system can ingest; exporting a search result is a different workflow from migrating the entire archive and its policy configuration.[5]

Smarsh Central is the case and self-service route, with knowledge resources and status information. Premium support adds a more proactive relationship; the contractual schedule supplies the measurable initial-response commitments.[16]

These are commercially reasonable response targets, not fix deadlines. Routine-request prose also says one business day. Report severity 1 by phone, available 24/7; ordinary Professional Archive hours are weekdays 8am–8pm Eastern, excluding holidays.[17]

The July 2026 schedule specifies 99.9% monthly availability for listed production SaaS services, excluding on-premises and test environments. Planned maintenance and defined customer/external causes are excluded. Verified credits use the affected platform fee; claims are due within 30 days after month-end.[17]

Smarsh supplies recordkeeping and review technology. For Professional Archive, an SEC electronic-recordkeeping undertaking is available on written request under specified conditions; a designated-third-party role additionally requires advance notice and Smarsh’s consent. These are specific access and record-production arrangements, not permission for a broker to conduct financial business. The product terms keep the client responsible for configuring retention and review policies.[3]

The main agreement preserves the client’s ownership of Client Data, requires advance notification of applicable privacy jurisdictions and prohibits submitting data subject to PCI DSS.[18]

The Information Security Addendum describes logical data separation and encryption in transit and at rest. It provides for annual independent penetration testing and at least annual continuity-plan testing. Customers can request the specified security packet, subject to confidentiality and frequency limits; the public addendum is not the underlying audit report.[19]

For a Client Data Incident, the addendum requires written notice to the account’s administrative contact promptly and within 72 hours after discovery, unless law prohibits notice. The customer therefore needs a maintained administrative contact, and this clock begins at discovery rather than the occurrence of the event.[19]

CallCabinet Corporation has separate published terms for its recording applications and services. Those terms put recording notices and consent on the customer, require the relevant DPA for direct customers or resellers, and limit API users to 100 requests daily unless increased in writing. They also state no specific uptime guarantee. The applicable order and product contract matter where this differs from the Smarsh SaaS schedule.[22]

The main service agreement contracts through Smarsh Inc. or the affiliate identified in the order.[18]

The current leadership page identifies Stephen Marsh as founder and chairman and Kim Crawford Goodman as chief executive. Smarsh lists offices in Portland, London, Singapore and other locations; these support a geographically distributed business rather than one local broker service desk.[23][28]

The Smarsh and Actiance merger was completed under the Smarsh brand in 2018, following a combination initiated by K1 in 2017. That history explains the breadth of enterprise and professional archiving products without making all legacy deployments interchangeable.[24]

Smarsh completed the TeleMessage acquisition in February 2024, extending its mobile and voice-capture portfolio. In February 2025, K1 announced Smarsh’s acquisition of CallCabinet, adding cloud call recording and voice analytics. These are portfolio components with their own product histories and, in CallCabinet’s case, separately published service terms.[26][25]

Operator

Smarsh Inc. or the affiliate identified in the Order Form

Service scope

Business communications capture, archiving, supervision, surveillance and legal discovery.

Customer types

Broker-dealers; Investment firms; Banks; Hedge funds; Swap dealers; Other regulated organisations

Delivery

SaaS; API; On premises

Pricing publication

Quote only

Platforms

Professional Archive; Enterprise Platform; Cloud Capture; Capture Server

Implementation

Channel and identity configuration, retention policies, role entitlements and optional historical migration.

Support

Smarsh Central and phone support; Basic, Premium and product-specific service levels.

Permissions and regulatory scope

Recordkeeping and communications-review technology; specified archive undertakings and third-party access roles are conditional.

Provider metadata checked 20 Oct 2026Source 14Source 2Source 4Source 28Source 6Source 1Source 3Source 16Source 18

Under the main agreement, access ends at termination. Professional Archive data is deleted as practicable unless otherwise agreed or legally prohibited; paid export requires an SOW and storage/access order. General transition assistance must be requested in writing before termination, with paid access and migration terms, for up to 12 months or longer by agreement.[18]

CISA’s known-exploited-vulnerability catalogue added TM SGNL’s cleartext-archive issue, CVE-2025-47729, on 12 May 2025, and its exposed-heap-dump issues, CVE-2025-48927 and CVE-2025-48928, on 1 July 2025. The entries concern TeleMessage TM SGNL and call for vendor mitigation or discontinuing use when mitigation is unavailable. They do not establish the current remediation state or a flaw in every Smarsh product.[27]