Skip to main content

​
Third-party archive connectors: deliver records to Smarsh, Global Relay, or Bloomberg Vault

If you operate under SEC Rule 17a-4 or FINRA Rule 4511, your books-and-records obligation does not stop at “keep a copy” — the copy has to live with a supervised vendor that holds it under WORM, runs supervision, and answers eDiscovery. Broker-dealers and RIAs contract with Smarsh, Global Relay, or Bloomberg Vault for exactly that. The archive-connector console (Settings → Compliance → Archive Connectors) is where you point Orbit at the vendor you contracted: register the delivery endpoint, activate the feed, and pause or remove it per vendor.
Archive connectors are a tenant-owned control. Orbit provides the control plane that configures your delivery feed; retention obligation, vendor selection, and contract coverage stay yours. This page is not legal advice — confirm what must be archived, and with whom, with your counsel and your archive vendor.

​
When to use a connector, when to use the WORM export

Both live under Compliance, and they answer different questions:
  • Archive connector (this page) — you have a contract with Smarsh, Global Relay, or Bloomberg Vault, and records must flow to that vendor continuously. The connector copies messages, call logs, or recordings to the vendor’s ingest endpoint on the cadence you pick. Self-managed copies are not enough for a supervised retention duty — the vendor performs the supervision.
  • Immutable archival export (WORM) — you hold the copy yourself: a tamper-evident bundle you download and pin into your own WORM or S3 store. That fits when your policy allows self-managed retention, or as the fallback copy while a vendor feed is being set up. See Immutable Archival Export.
If counsel reads “retain with a supervised vendor” from your contract, use the connector. If they read “retain an immutable copy,” the export alone can suffice.

​
Vendor catalog

Three vendors are supported, each with the delivery transports it ingests: Each vendor card shows example endpoints on that vendor’s own host (for example, a smarsh.com ingest URL on the Smarsh card). Match your endpoint to the vendor you selected — a well-formed endpoint that points at a different supported vendor’s host is rejected at registration, so a Smarsh URL pasted into the Global Relay form surfaces a clear error instead of a silent misconfiguration.

​
Where the console lives

Open Settings → Compliance → Archive Connectors. The surface requires the owner or admin role — the backend enforces the same gate on the endpoints, and other roles see a read-only view. It ships on the enterprise tier, alongside the rest of the compliance delivery controls.

​
Register a connector

Work one vendor at a time — each vendor holds its own config.
  1. Pick the vendor and transport. Select the vendor card and the delivery method your vendor assigned you (SFTP, HTTPS capture API, or SMTP journaling — Bloomberg Vault does not ingest HTTPS).
  2. Enter the delivery endpoint. Paste the exact endpoint your vendor provisioned: an sftp://host/path URL for SFTP, an https://host/path URL for a capture API, or a journaling address like acme-journal@archive.smarsh.com. The format and vendor-host checks run inline, so a typo fails there instead of at your first delivery flush.
  3. Reference the credential. Enter the secret-manager alias of the delivery credential (for example, archive/smarsh/acme-sftp-key). The console stores the reference, never the secret material — provision the actual key in your secret manager.
  4. Choose record classes. Check the record classes this vendor must receive: messages, call logs, recordings. Leave all unchecked and the connector delivers everything; for a recordings-only vendor (e.g., your supervision scope covers voice only), check just recordings.
  5. Set the cadence. Continuous, hourly, or daily — match the freshness your vendor contract expects. Daily is the default.
  6. Test connection before registering. Select Test connection. The checklist runs two sections: Configuration checks it can verify now (transport compatibility, endpoint format and vendor host, record classes, credential reference), and Verified when delivery starts — the live stages (endpoint reachability, authentication, write permission, sample-record delivery) that the delivery worker runs once the connector is active. Each live stage shows ready or blocked with the config gap to fix, so you see the full validation path before you commit.
  7. Register. The connector lands in Pending activation state. Nothing delivers until you activate.
The API equivalent — register is also the update path:
Pre-flight the same payload without persisting it by posting it to POST /compliance/archive-connectors/:vendor/readiness/preview; after registration, re-run the checklist any time with GET /compliance/archive-connectors/:vendor/readiness. For the full endpoint reference, see the API reference.

​
Run the lifecycle

A connector moves through four states, each mirrored in the console badge:
  • Pending activation — registered, not delivering. The draft is saved and you can re-run Test connection as often as you like.
  • Active — live. Delivery runs on your cadence and the console stamps the last successful flush (Last delivery timestamp) on the vendor card.
  • Paused — delivery halted, config kept. Use this for vendor maintenance windows, credential rotations, or a contract review — nothing is delivered while paused, and the resume path preserves your endpoint, credential reference, and record classes.
  • Deleted — removed. Deleting a connector drops its configuration; nothing is delivered and the vendor stops receiving new records from Orbit. What the vendor already received stays with the vendor.
A few semantics to internalize:
  • Re-saving over the same endpoint keeps the lifecycle state (an active connector stays active).
  • Changing the delivery method or endpoint flips the connector back to Pending, on purpose: a new destination must be re-tested and re-activated so a live feed is never silently redirected. If you rotate vendors, register the new endpoint, run Test connection, and activate again.
  • Pause vs delete: pause when you will resume; delete when the contract ends or the vendor changes. Deletion is the only way to clear an endpoint/credential you must no longer hold.
Activation over the API:
The controller refuses to activate a connector whose hard readiness checks fail (unsupported transport, malformed or wrong-vendor endpoint, no record classes). So a registration that passed its checklist is not the only gate — activation re-runs it.

​
Verify delivery after activation

Do not report “archiving is in place” to your compliance officer until you have all three:
  1. Vendor confirms ingest. Your vendor’s admin console (or their delivery rep) shows your records landing — most vendors acknowledge an incoming account/test message. Check it the first hour after activation.
  2. The console shows a stamp. The vendor card’s Last delivery timestamp updates after the first successful flush. If it stays empty past one cadence interval, treat the feed as not delivering and re-run Test connection.
  3. Credential rotation path rehearsed. Rotate the delivery credential in your secret manager, pause, re-register with the new alias, and activate again — before the rotation is forced on you. A pause-resume drill is the only way to know the alias update actually propagates.
If the live stages were blocked at registration (e.g., no credential reference set), fix the configuration first — the worker will fail authentication until the alias resolves.

​
Pair connectors with your retention posture

The connector and your deletion policy are two halves of the books-and-records answer:
  • Let delivery run ahead of the sweep. Retention sweeps (Settings → Compliance → Retention) delete on age. A connector delivers the copy out, so once the vendor confirms ingest, Orbit’s copy can expire on schedule without dropping your retention obligation. Do not shorten the sweep below your delivery cadence until the Last delivery stamp is healthy.
  • Legal holds still shield the source. A conversation or recording under an active legal hold is exempt from the sweep, as before. Holds protect the Orbit-side copy; the connector ships the vendor-side copy. Use both — the hold keeps the evidence reviewable in your inbox while the vendor copy accumulates at the supervised destination.
  • Erasure requests. A data-subject erasure routed through your DSAR flow deletes the Orbit-side record. What the archive vendor already incaptured is outside Orbit’s propagation — coordinate surrender-to-vendor requests directly with your vendor, and note that an active legal hold can counsel-override erasure as in the hold guide.

​
Worked example: broker-dealer with Smarsh, recordings only

A broker-dealer runs its supervision scope on voice and contracted Smarsh:
  1. Register. Vendor Smarsh, delivery method HTTPS capture API, endpoint https://capture.smarsh.com/v2/ingest, credential reference archive/smarsh/supervision-hsm-key, record classes recordings only, cadence hourly, label “Voice supervision”. Test connection passes; register.
  2. Activate. The connector starts shipping new call recordings within the hour. The compliance officer confirms ingest on the Smarsh Connected Capture console and the Last delivery stamp in Orbit.
  3. Credential rotation. Six weeks later the vendor rotates the ingest key. The admin pauses the connector, updates the secret-manager alias, re-registers with the new credential_ref (endpoint unchanged, so state stays Active-eligible rather than needing the full loop), and re-activates. The Test connection report confirmed the target was unchanged; the pause window saw no deliveries, and the stamp resumes within the next hourly flush.
  4. Postcheck. Before closing the rotation ticket, the admin verifies (1) Smarsh shows ingest resuming, (2) the Orbit Last delivery stamp updated, (3) Test connection reports all live stages ready.
The surface this guide walks — Settings → Compliance → Archive Connectors — pairs with the WORM export for self-managed copies, the legal hold controls for the source-side exemption from sweeps, and the evidence binder for the attestations that wrap the feed. For the endpoint-level contract and full payload shapes, see the API reference.