Skip to main content

​
Immutable Archival Export (WORM)

This page covers immutable archival — how to keep a tamper-evident copy of your sent and received SMS/MMS and your call recordings in storage you control. If you operate under SEC Rule 17a-4, FINRA 4511, HIPAA, or an internal books-and-records policy, read this before your retention sweeps start deleting records you must still be able to produce.
This page describes Orbit’s platform controls. It is not legal advice. Your retention obligations depend on your industry, your regulators, and your contracts. Confirm the specifics with qualified counsel.

​
Why immutable archival is separate from retention

Orbit’s retention settings are deletion-oriented: they decide how long a record lives in the operational store before it is redacted or purged. That answers “how long must Orbit hold this?” — it does not answer “how do I hold my own immutable copy for the next seven years?” Regulated tenants typically need both:
  • Retention windows — cap how long records stay in the platform (storage limitation; set under Settings → Compliance → Retention).
  • Immutable archival — copy the records into a tamper-evident bundle you download and pin into your own WORM or S3 compliance store, so a later retention deletion does not erase the only copy.
Archival complement covers three record classes:
Archival copies your stored records to durable export storage. It performs no outbound sending and does not change how records are created.

​
Configure the archival policy

The archival policy is a per-workspace setting. It is disabled by default — no archival runs until you opt in. Workspace owners and admins can change it; every change is recorded in your audit log.

​
From the dashboard

Go to Settings → Compliance → Archival, choose your channels, destination, immutability mode, retention-lock window, and bundle format, then save.

​
From the API

Read the current policy, the full catalog of valid values, and the resolved posture:
Set or update the policy (owner or admin API key required):
Policy fields:

​
WORM requires a real lock window

worm with a zero-day lock window is not write-once, so it is rejected with a 422 — set retention_lock_days to at least 1, or use immutability: "none" for a plain durable copy.

​
An active lock can only be extended

Once the policy holds an active WORM lock, a save that would shorten the lock window or switch immutability back to none is rejected with 409 ARCHIVAL_LOCK_ACTIVE. Extending the window (equal or greater days, staying WORM) is always allowed. This keeps a retention promise from being silently withdrawn after records were archived under it. The response also echoes created_at (set once on the first save) and a version counter that increments on every save, so an auditor can verify when the policy was first established and how many times it has changed.

​
Run an export

An export copies the matching records for one channel and one time window into an immutable bundle and returns a signed download link (owner or admin API key required):
Request and response details:
  • channel must be enabled in your archival policy, otherwise the call returns 409 ARCHIVAL_CHANNEL_NOT_ENABLED.
  • [from, to) is an ISO-8601 window of at most 366 days, with from strictly before to. A single export carries at most 50,000 rows; if more rows match, the result is flagged truncated and you narrow the window to cover the remainder.
  • The download link is a signed URL valid for 7 days — long enough to mirror the bundle into your own store, short enough to revoke quickly. Row count, byte size, bundle checksum, and expiry are all returned in the descriptor so your ingestion job can verify what it fetched.

​
Encryption is on by default

The records file inside the bundle is sealed with AES-256-GCM under a one-time passphrase unless you pass "encrypt": false. The passphrase is returned exactly once, in the export response — Orbit never stores or logs it. If you lose it, the records file cannot be decrypted (the manifest and verification instructions remain readable either way). Store it with the same care you give your archive store’s credentials.

​
What is inside the bundle

Every export is a tamper-evident ZIP: The manifest and checksums let your compliance store — or an auditor — verify independently that the bundle was not altered after Orbit produced it.
Voice exports package the recording audio itself (not just a link). A recording larger than 100 MiB, or beyond the per-export media budget (256 MiB / 500 files), is listed in the manifest as reference-only — narrow the window to package it in a separate export.

​
Mirror into your own WORM / S3 store

The export’s signed URL is a bridge, not the destination. Your compliance store — S3 Object Lock in compliance mode, Azure immutable blob storage, or a GCS bucket with a retention policy — is what actually enforces write-once retention. Record that intent on the policy so the destination is part of the audit trail:
Your mirroring job downloads the bundle while the signed URL is valid, checks bundleSha256 and the manifest signature, uploads the artifact, and applies the same retention lock (Object Lock retain-until-date) in your store.

​
Deliver to a supervised archive vendor

If your obligation is a continuous feed to a supervised archive vendor — Smarsh, Global Relay, or Bloomberg Vault — use archive connectors instead of manual exports. Go to Settings → Compliance → Archive connectors and register the vendor’s delivery destination: transport (SFTP, HTTPS capture API, or SMTP / S3 journaling), endpoint, and a credential reference (a secret-manager alias — never the secret itself). Run the built-in readiness check (“Test connection”) against your draft before saving, then activate the connector. New connectors start pending and cannot be activated until the readiness check passes. Configure connectors via the API as well:
The connector surface is a control plane: it stores the delivery destination, validates endpoint grammar against the transport, and gates activation on the readiness checklist. Set the archival policy for the same record classes so every delivery is backed by an exportable, verifiable source.

​
Scope and limitations

  • Copies, not blocking capture. Archival reads records already stored in your workspace and copies them to export storage; it does not intercept or change live sending, and it never performs outbound voice or SMS.
  • Bounded exports. Up to 366 days per window and 50,000 rows per export (flagged truncated beyond that). Large backfills are a series of narrower exports.
  • Signed URLs expire after 7 days. Mirror the bundle into your own storage promptly; re-run the export to get a fresh link.
  • Encryption passphrase is unrecoverable. It exists in the export response and nowhere else.
  • WORM is enforced at your destination. The policy records your lock intent and stamps it into the export manifest; the actual write-once guarantee is provided by the retention lock you apply in your own store.

​
Your compliance posture stays yours

Archival is a tenant-owned control: Orbit provides the export mechanism, the integrity evidence, and the destination plumbing — under your policy. The regulatory basis, the retention window, the legal hold, and the store the records finally rest in are yours to decide and document. These settings change nothing unless you enable them, and every change is auditable in your audit log.

Voice Data Residency & Retention

Where call recordings live, region pinning, and how long voice data is kept before deletion.

SOC 2 Controls

The broader control environment: backups, logging retention, and access controls.

Evidence Binder

Assemble audit-ready evidence bundles from the controls you already configured.

Data Subject Requests

Access and erasure workflows for records covered by privacy requests.