Who it’s for / Compliance Officer
Grotabyte for Compliance Officers
An examination does not test your policy. It tests whether you can produce the record your policy says you kept, show who reviewed it, and show what they decided. The gap you discover during an exam is the one that becomes a finding.
Rated 5 out of 5. “70% faster eDiscovery.” — CCPOA
Also for: Chief Compliance Officer · Compliance Manager
What you are accountable for
You are accountable for proving, on demand, that the firm retained the records its rules require, reviewed them against written policy, and can produce any of them inside a deadline.
What makes that hard
The request you cannot answer
An examiner asks for every communication involving one person, across every channel, over a date range. If a channel was never captured, no amount of process makes up for it — and you will find out at the worst possible moment.
A programme is evidenced by dispositions, not dashboards
Showing that alerts fired is not showing that a supervisory programme exists. What has to survive scrutiny is a defined review population, a documented method of selecting it, and a recorded decision on every item surfaced.
Off-channel is the question you get asked
The message that is not in your archive is the one an examiner names. Detecting a conversation moving to an unmonitored channel is a supervision problem before it is an IT problem.
Retention that changes without you
A retention rule that a vendor enables on your behalf is a rule you did not approve and cannot defend. Periods have to be yours, mapped to the statute behind them, and switched on deliberately.
What Grotabyte gives you
Supervision that closes with a reason
Eight review lexicons, each citing the regulation behind it — MNPI, collusion, guarantees, complaints, gifts, harassment, off-channel, and pressure. Every alert closes with a typed reason, so the disposition, not the alert count, is what you hand over.
A review population you can reproduce
Review populations are sampled deterministically by hash: the same document produces the same answer every time the sample is rerun. A sample you cannot reproduce is a sample you cannot defend when asked how it was chosen.
Retention templates that cite their statute
Ten templates, six carrying the citation they implement — SEC 17a-4(a) and (b), FINRA 4511(c), SOX §802, HIPAA, MiFID II. Where two rules touch one record the longest applicable rule wins, and the clock runs from the moment the record enters custody.
One archive across every channel you run
Microsoft 365 mail, OneDrive, SharePoint and Teams 1:1 and group chats; Google Workspace mail and Drive; on-premise Exchange including journal mailboxes; any IMAP or POP3 mailbox; and Claude Enterprise AI conversations through Anthropic's Compliance API. The record you supervise is the record you produce.
An audit trail you can walk someone through
Every record is sealed onto a hash-chained, tamper-evident ledger, and every view, query, export and refusal lands on it. An auditor role can verify the chain of custody without being able to open a single document.
One checkable thing
All ten retention templates ship disabled by design — six of them carrying the statutory citation they implement — so a retention period takes effect when you enable it, not when a vendor decides.
Questions this role asks
An examiner asks how our review population was selected. What do I show them?
The selection method itself, and the fact that it is reproducible. Populations are sampled deterministically by hash, so rerunning the sample returns the same documents rather than a fresh draw — which means coverage can be stated as a percentage of a defined population and then demonstrated, not asserted. Each item in the sample carries the reviewer's typed disposition and the lexicon that surfaced it, with the regulation that lexicon cites.
Our written procedures specify non-rewriteable storage. Where does that leave us?
SEC Rule 17a-4(f) has permitted two routes since the amendments adopted in October 2022: preserving records in non-rewriteable, non-erasable form, or maintaining an audit trail that allows an original record to be recreated if it is altered or deleted. Grotabyte implements the second — sealed, hash-verified records on a tamper-evident ledger with every access recorded — and does not describe its storage as WORM. Storage-level retention locking is available on request if your procedures call for it, and can be applied to an archive you already have. Whichever route you take, your written procedures should say which one it is.
Can I prove a message was not altered after it was archived?
Yes. Each record is sealed with a hash chained to the entry before it, so editing or removing one breaks the chain at that point. Verification walks every entry and reports whether the chain is intact and whether there are gaps or excisions — and it can be run by the auditor role, which verifies custody without the ability to read the documents.