Encrypted messaging

Your team does business on WeChat.

If regulators ask for those records, can you produce them?

WeChat is two products. Consumer WeChat is what people use day-to-day. WeCom (WeChat Work) is the enterprise edition Tencent built for business, and it has a server-side archive API. Comma captures WeCom directly, with consumer WeChat covered through BYOD device archival.

The recordkeeping rules don’t care which app you use. SEC Rule 17a-4, FINRA Rule 4511, and the Advisers Act all turn on the content of the message, not the channel it rode in on. If your team is doing business on WeChat or WeCom, those messages are business records, and your firm is responsible for producing them.

We all watched this play out in the 2021–2024 off-channel sweep. The business activity was happening in WhatsApp, Signal, and iMessage, but the firms hadn’t captured it, and the penalties followed. WeChat and WeCom create the same gap. The regulated firms that think they need WeChat capture almost always need WeCom.

What Comma captures from WeCom

  • 1:1 chats and group chats among enterprise users
  • File and image attachments
  • Reactions and edits where the WeCom API exposes them
  • External (consumer-WeChat) messages routed through the WeCom external contacts feature
  • Full metadata: sender, timestamps, and conversation context

All of it lands in the same tamper-proof archive as your other channels, with a single supervision queue.

How the WeCom integration works

Comma pulls WeCom conversations straight from WeCom’s server-side archive API. No third-party relay, no agent on anyone’s device, no per-user OAuth handshake.

Why the architecture matters

For your compliance team

  • One archive, one review queue

    WeCom activity lands alongside your other 35+ channels. One supervision workflow covers everything, so compliance teams do not need a separate tool for WeChat.

  • Complete metadata

    Sender, timestamps, and conversation context are captured intact, so a date-range or per-person request is searchable and exportable on demand.

For your IT team

  • Server-to-server capture

    Comma reads WeCom's server-side archive API directly. Nothing is installed on employee devices, and the WeCom client is not modified.

  • Per-team scoped keys

    Each Comma tenant has its own encrypted credentials and a versioned RSA key pair. Keys are never shared across tenants, and WeCom-side key rotations don't break historical message decryption.

For your employees

  • WeCom works exactly as it does today

    Capture happens through the API, not on the device. Employees keep using WeCom with no change to their experience.

  • No manual exports

    Users do not need to save or export conversations. The record is created automatically.

FAQ about WeChat and WeCom compliance archiving

How does Comma capture WeCom messages?
Comma pulls WeCom messages directly through WeCom's server-side archive API, without a third-party relay, and no agent on a device. We store your enterprise credentials encrypted, per team, and use a versioned RSA key pair to decrypt WeCom's message envelopes. The records land in the same archive as your other channels.
What exactly gets captured?
1:1 and group chats among enterprise users, file and image attachments, reactions and edits where the WeCom API exposes them, external consumer-WeChat messages routed through WeCom's external contacts feature, and full metadata — sender, timestamps, and conversation context.
Does WeCom activity go into the same archive as our other channels?
Yes. WeCom messages are captured and archived with WORM-grade storage alongside the rest of your 35+ channels, in one archive with a single supervision queue.

Your team is already on WeChat.

Capture WeCom and archive it in the same place as all your other business messages.

Go deeper

Other channels we support