# We Open-Sourced the Android App That Archives Employee Texts Comma published the source for its Android SMS, MMS and RCS capture app on GitHub, so security teams can read the code before it goes on a managed fleet. Source: https://commacompliance.com/post/open-sourcing-android-sms-rcs-capture Last updated: 2026-09-10 --- [← Insights](/insights)|September 10, 2026|Jeremiah Church|6 min read # We Open-Sourced the Android App That Archives Employee Texts Comma published the source for its Android SMS, MMS and RCS capture app on GitHub, so security teams can read the code before it goes on a managed fleet. September 10, 2026 - Jeremiah Church Today we published the source code for our Android capture app on GitHub, under Apache 2.0: [github.com/comma-compliance/android-capture](https://github.com/comma-compliance/android-capture). It archives SMS, MMS and RCS on fully managed, company-owned Android phones. Comma captures business communications across 40+ channels, and almost all of that work happens off the device. Android text messaging is the exception. Texts live on the handset, so capture runs there too, and this is the one connector where we ask a company to put our code on an entire fleet of phones. The security team responsible for those phones should be able to read that code before it goes on the first one. Now they can. As far as we can find, this is the only open-source Android compliance archiver on the market. You can also run it and point it at an ingest server of your own; it does not have to send anything to Comma. That is the standard we want to be held to across the whole product, from capture through export: if we say Comma does something, there should be an artifact you can check for yourself. This release is one more piece of that. ## What the app does The app reads messages the phone’s default messaging app has already stored, encrypts them on the device, and sends them to your Comma back end. It does not intercept anything in transit and it does not touch anyone’s transport encryption. Data goes to your organization’s ingest endpoint and nowhere else. Coverage is SMS, including long multipart messages, MMS media, and RCS content: group conversations, attachments and edits. None of it is hidden from the person holding the phone. Before the app asks for message access, it shows a plain-language screen explaining what is captured and who administers the archive. While archiving is active, the phone carries a persistent notification naming the organization doing the archiving. Supported deployments are company-owned devices in device-owner mode under Android Enterprise. Work profiles and personal phones are outside that scope. If a vendor tells you they can archive texts off an employee’s personal Android phone, ask exactly how. ## Why open source, again We published our WhatsApp and Signal capture connectors in 2025, after the TeleMessage breach put plaintext chat logs on the open internet. The reasoning has not changed. Too much of this industry runs on “trust me.” A vendor asserts that capture is complete, that storage is immutable, that deletion is defensible, and backs it with a brochure and an assessment letter. The schemas stay behind an NDA. The buyer signs, and learns whether any of it was true when the examiner shows up or when there is a breach. When a regulator or a CISO asks how a message was captured, encrypted and transmitted, a diagram is an assertion and source code is an answer. Read it, run your static analysis on it, threat-model it, build it and watch what it does. The build is reproducible from a clean checkout, our CI builds it the same way, and commits are signed and checked. What stays private is the processing and archival layer: the analysis tooling and the storage mechanics that hold customer records. Publishing the capture path is what lets you verify what goes onto a device. ## The same rule for the rest of the stack Earlier this year we wrote down a standard for how Comma captures, retains, protects and disposes of records. It is a specification, not a feature list: it says what evidence each step of a record’s life has to leave behind, from the receipt that proves when a record was sealed to the certificate that proves how it was finally disposed. When we reviewed the major archives’ public documentation this summer, we could not find those artifacts documented anywhere, so we are documenting ours. The standard carries one rule that governs everything we publish. A capability goes into public material only after the artifact behind it exists and has been verified. Artifact first, claim second. Our marketing team works from the same claims registry our engineers do, and it tells them what they are not allowed to say yet. It is why this post says less than we would like about the storage layer: that rework is not yet finished, so we are not describing it. Some of the evidence is already in your hands. Every collection export, and every archive delivery into a cloud bucket you own, ships with a manifest listing each data file and attachment it delivered, with its SHA-256 fingerprint and byte size. Re-hash what you received and compare it to the manifest. A matching hash tells you a delivered file is byte-for-byte what we recorded; it does not tell you every source message was captured, and we will not pretend otherwise. With API access enabled, an item’s sealed record and its SHA-256 are one call away. The [export documentation](https://docs.commacompliance.com/guides/archive-export/) describes the format and exactly which files you can check. We are bringing the same evidence onto the screen, so that a compliance officer, an examiner, or an AI agent working on their behalf can open a record and inspect its fingerprint without calling our support desk. As each piece is verified and registered, we will publish what it does, what evidence it produces, and how to check it yourself. That last audience is not hypothetical. More of our customers’ routine compliance work is being handed to agents, and an agent cannot take a sales call or accept an assurance. It needs a documented, checkable path. Verification has to be something you can do, not something you request. ## Read it and tell us what we missed The repo is public. Open an issue for bugs, questions or suggestions. If you find a security vulnerability, do not open a public issue: email [security@commacompliance.com](mailto:security@commacompliance.com), following the repository’s security policy. There is a bug bounty. We would rather hear it from a security engineer this month than from a frustrated firm next year. When you evaluate any Comma claim, ask us for the artifact and how to check it. *Image: Jeremiah Church* Jeremiah Church Jeremiah Church is a compliance nerd with over 20 years in Fintech and Compliance Software who believes complex problems should have simple fixes - and builds tech to make that happen. ## See why compliance teams switch to Comma. A 20-minute walkthrough — real capture, real-time flagging, exam-ready exports across 40+ channels. [Get in Touch](/get-in-touch)[Pricing](/pricing)