DLP (Data Loss Prevention)

A legal hold (or litigation hold) is a directive that suspends the normal deletion or modification of records relevant to anticipated or pending litigation, investigation, or audit. Data under hold is preserved unaltered — overriding retention schedules — until the hold is released.

Chain of custody is the documented, unbroken record of how electronic evidence was captured, stored, accessed, and produced — who handled it, when, and what was done. A defensible chain of custody establishes that archived data is authentic and has not been tampered with.

An audit trail is a chronological, tamper-evident log of actions taken within a system — searches, exports, policy changes, and access. Audit trails demonstrate accountability and are required by many compliance regimes to prove how records and the archive itself were handled.

Supervision is the systematic review of archived communications against policies and lexicons to detect misconduct, conflicts of interest, or regulatory breaches. FINRA and SEC rules require certain firms to supervise employees' business communications.

Personally Identifiable Information (PII) is data that can identify an individual; Protected Health Information (PHI) is health data tied to an individual under HIPAA. Archives detect and govern PII/PHI to apply the right security, retention, and privacy controls.

A privilege log lists documents withheld or redacted from a production, together with the basis for withholding them — most commonly attorney-client privilege or work product. It lets the receiving party test the assertion without seeing the protected content, and is generally required when documents responsive to a request are not produced.