Comma Compliance

Don't trust our claims. Read the code.

How encrypted message capture typically works

Open-Source Capture

Every compliance archiving vendor claims their capture method is secure. After the TeleMessage breach, those claims aren’t enough. Comma publishes its WhatsApp and Signal capture code openly — so your team can verify exactly what happens to a message from the moment it’s sent until it reaches the archive.

Regulators require firms to capture and retain business communications, including messages sent over encrypted apps like WhatsApp and Signal. The challenge is that these apps were designed specifically to prevent third parties from accessing message content. Until recently, the compliance industry has solved this in one of three ways:

Each of these has trade-offs. Modified apps introduce security vulnerabilities and require users to change their behavior. Device agents create IT burden and employee friction. API-based capture can work well where it’s available, but doesn’t cover the channels regulators are most focused on right now.

How Comma Compliance does it differently

Comma operates as an authorized endpoint — a device the user explicitly links to their account. Because the user grants access directly, Comma receives messages the same way any linked device would, without modifying apps, intercepting network traffic, or installing software on employee phones.

We don’t modify apps. We don’t install software on devices. We don’t decrypt messages on an intermediate server and re-encrypt them for storage.

What that means in practice:

And, unlike every other vendor making these claims, we’ve published the code so you can verify it yourself.

What happened with TeleMessage? Does it really matter?

First, yes, it matters. In May 2025, TeleMessage -an Israeli software company acquired by Smarsh in 2024- was breached. It was breached after a hacker accessed a publicly exposed debug endpoint on one of its archive servers. The endpoint returned a memory dump containing plaintext chat logs, user credentials, and encryption keys. The entire breach took roughly 15 to 20 minutes.

The root cause was architectural. TeleMessage’s approach to compliance archiving involved capturing messages after decryption on an intermediate server. While this met the technical requirement of creating an archivable copy, it broke the end-to-end encryption that apps like Signal were built to guarantee. When that intermediate server was compromised, plaintext messages were exposed.

See how Comma compares to Smarsh’s TeleMessage architecture →

After the breach

This incident raised a question that every regulated firm should be asking their archiving vendor: does your capture method introduce new attack surfaces that wouldn’t exist if the messages were never archived?

With a modified-app approach, the answer is almost always yes. A copy of every message passes through infrastructure the vendor controls, in a format the vendor designed, using an app the vendor modified. Each of those layers is a potential point of failure.

Comma’s architecture avoids this by not modifying apps, but we also recognized that saying “trust us, our architecture is different” isn’t enough — especially after an incident like TeleMessage proved that vendor claims about encryption can be false.

Why we open-sourced our capture code

In August 2025, we published the source code for our WhatsApp and Signal capture connectors on GitHub — WhatsApp under Apache 2.0 and Signal under GPL v3. Anyone can inspect, fork, or self-host them.

We did this because transparency is more convincing than marketing. When a compliance officer or CISO asks “how do you capture messages and how do I know it’s secure,” the strongest possible answer is: here’s the code, run your own analysis.

What your security team can do with it:

What your legal and compliance team gets:

FAQ about Open Source Capture

Open-source compliance archiving means the code that captures your business communications is publicly available for inspection. Rather than asking you to trust a vendor’s claims about how their system works, open-source code lets your security team read, audit, and verify the capture logic before you go live.

No. Open-source refers to the capture code: the software logic that handles how messages are collected. Your archived messages are stored in your private archive and are never public. What’s public is the code that does the capturing, so your security team can verify it works the way we say it does.

Yes. Comma’s WhatsApp and Signal capture connectors are published on GitHub under open licenses. Your team can clone the repo, run static analysis, threat-model the data flow, and verify exactly what happens to a message from the moment it’s sent until it hits the archive.

What to ask any archiving vendor

Whether you’re evaluating Comma or anyone else, these are the questions that matter after TeleMessage:

Where to go from here:

Comma Compliance’s WhatsApp and Signal capture connectors are open-source. Neither connector is affiliated with or endorsed by Meta Platforms, Inc. or Signal Messenger, LLC.