WhatsApp, Telegram and iMessage capture for regulated teams
TL;DR
The off-channel problem is people doing business on their own WhatsApp, iMessage and Telegram. Most compliance tools work around that with a separate business number or a replacement app. Pantheon captures the accounts your people already use (WhatsApp, Telegram, iMessage and X/Twitter) and keeps those conversations as a searchable record. Pantheon is not a certified books-and-records archive; on request, we feed your existing archive and build a reviewer role into your deployment.
On this page
Why the usual answers leave a gap
Firms that must keep business communications (broker-dealers under SEC Rule 17a-4, investment advisers under Advisers Act Rule 204-2, firms under FINRA's rules or MiFID II) have three usual options for messaging apps. Ban them, which staff work around. Issue a separate business identity or business number, which clients do not always use. Or install a modified copy of the app, which changes the app people rely on and adds a new place for messages to leak.
The conversations regulators keep finding are on the personal accounts people already have. That is the gap Pantheon covers.
What Pantheon captures
A person connects the account they already use, once. From then on, their conversations on WhatsApp, Telegram, iMessage and X/Twitter build a searchable record: who said what, when, in which chat, with the files that were shared. Nobody switches apps and nobody forwards messages by hand.
Capture starts from the moment an account is connected. How much earlier history arrives at connection varies by app, so plan on the record being complete from connection onward.
How it fits your compliance stack
Compliance programs are usually built in four steps: capture the communication, keep it in a protected store, supervise it, and produce it when asked. Pantheon's strength is the first step, for the apps the others miss, and it keeps what it captures (see records and retention).
Pantheon is not a certified books-and-records archive. It does not hold a designated-third-party letter for Rule 17a-4. For firms that need one, the right shape is Pantheon as the capture source feeding the archive you already run. That feed is built for your deployment on request, alongside a reviewer role for your compliance team.
Privacy for the person, oversight for the firm
On self-serve Pantheon, a person's conversations are private to them; teammates never read them. That stays true. A firm-wide reviewer role exists only on a dedicated deployment, configured with your compliance team, under the policies you set and disclose to your people.
What is standard and what is on request
Standard means it is part of every Pantheon Enterprise deployment today. On request means we build it for your deployment once you ask, and support it from then on.
| Capability | Availability | What it means |
|---|---|---|
| Capture from staff’s own WhatsApp, Telegram, iMessage and X/Twitter accounts | Standard | No replacement app, no separate business number. |
| Searchable record with files | Standard | Who said what, when, in which chat. |
| Kept under the retention rules | Standard | See records and retention. |
| Compliance reviewer role | On request | Configured on your dedicated deployment under your policy. |
| Feed to your existing archive | On request | Pantheon as the capture source for the archive of record you already run. |
| Signal and other apps | On request | Tell us which apps your people use. |
Is Pantheon a 17a-4 compliant archive?
No. Pantheon does not claim SEC Rule 17a-4 compliance and does not hold a designated-third-party letter. It captures the messaging apps other tools miss and can feed the archive of record you already run, on request.
Does Pantheon need a separate business number?
No. Pantheon captures the account a person already uses. Nobody needs a second number or a different app.
Can our compliance team read employees’ messages?
Not on self-serve Pantheon, where conversations are private to the person. A reviewer role is built on a dedicated deployment on request, under the policy your firm sets and discloses to its people.
Which apps are covered?
WhatsApp, Telegram, iMessage and X/Twitter as standard. Other apps, such as Signal, are on request.