An open look at how Comma Compliance archives WhatsApp, Signal, and other encrypted channels without modifying apps, touching devices, or breaking encryption, with open source code you can inspect yourself.
Regulators require firms to capture and retain business communications, including messages sent over encrypted apps like WhatsApp and Signal. The challenge is that these apps were designed specifically to prevent third parties from accessing message content.
Until recently, the compliance industry has solved this in one of three ways:
Each of these has trade-offs. Modified apps introduce security vulnerabilities and require users to change their behavior. Device agents create IT burden and employee friction. API-based capture can work well where it's available, but doesn't cover the channels regulators are most focused on right now.
Comma captures messages at the network layer during transmission rather than from the device, a back-up database, or modified application.
We don't modify apps. We don't install software on devices. We don't decrypt messages on an intermediate server and re-encrypt them for storage.
What that means in practice:
And, unlike every other vendor making these claims, we've published the code so you can verify it yourself.
First, yes, it matters. In May 2025, TeleMessage -an Israeli software company acquired by Smarsh in 2024- was breached. It was breached after a hacker accessed a publicly exposed debug endpoint on one of its archive servers. The endpoint returned a memory dump containing plaintext chat logs, user credentials, and encryption keys. The entire breach took roughly 15 to 20 minutes.
The root cause was architectural. TeleMessage's approach to compliance archiving involved capturing messages after decryption on an intermediate server. While this met the technical requirement of creating an archivable copy, it broke the end-to-end encryption that apps like Signal were built to guarantee. When that intermediate server was compromised, plaintext messages were exposed.
After the breach
This incident raised a question that every regulated firm should be asking their archiving vendor: does your capture method introduce new attack surfaces that wouldn't exist if the messages were never archived?
With a modified-app approach, the answer is almost always yes. A copy of every message passes through infrastructure the vendor controls, in a format the vendor designed, using an app the vendor modified. Each of those layers is a potential point of failure.
Comma's architecture avoids this by not modifying apps, but we also recognized that saying "trust us, our architecture is different" isn't enough — especially after an incident like TeleMessage proved that vendor claims about encryption can be false.
In August 2025, we published the source code for our WhatsApp and Signal capture connectors on GitHub — WhatsApp under Apache 2.0 and Signal under GPL v3. Anyone can inspect, fork, or self-host them.
We did this because transparency is more convincing than marketing. When a compliance officer or CISO asks "how do you capture messages and how do I know it's secure," the strongest possible answer is: here's the code, run your own analysis.
What your security team can do with it:
What your legal and compliance team gets:
Whether you're evaluating Comma or anyone else, these are the questions that matter after TeleMessage:
Comma Compliance's WhatsApp and Signal capture connectors are open-source. Neither connector is affiliated with or endorsed by Meta Platforms, Inc. or Signal Messenger, LLC.