Records storage and retrieval, stated precisely — including what v1 doesn't do yet.
Open any archived message and you see its full custody trail — the same fields that ship in the regulator export manifest.
Every message is validated, then written once — append-only, never updated.
The record hash binds to the audit log; tampering anywhere breaks the chain detectably.
A derived, read-only full-text index makes the immutable store searchable instantly.
CSV + chain-of-custody manifest: record hashes, head hash, integrity flags.
Google Workspace / Microsoft 365 journaling connector guides provided; every message validated into WORM on receipt.
Webhook receivers for channel capture, with source heartbeats from first message.
Capture API for compliant mobile-capture partners; every record carries its provenance.
Append-only store; SHA-256 hash-chained audit log with verify_chain() tamper detection.
Per-source heartbeat intervals, silence alerts, recovery gap logging, append-only verification history.
SQLite FTS5 index over all records — a derived, read-only view.
One-click CSV + chain-of-custody manifest (record hashes + audit head hash + integrity flags).
Lexicon-based flagging into a reviewer queue — a supervision aid, not a determination.
Source health, silence alerts, and verification history over a key-authenticated HTTP API.
Every source is registered with its type, connector and expected heartbeat interval — the registry is what the verification monitor watches.
Each plan carries a retention period stamped on every record; a disposition report lists records past retention. The WORM store itself never deletes.
One call re-verifies the full audit hash chain and every record hash — the same checks that ship in the export manifest.
We'd rather tell you what's roadmap than let you discover it after signup.
| Area | v1 reality |
|---|---|
| SMS capture | A capture-API stub with partner provenance, not native carrier capture. Partner integration is a flagged gap. |
| WORM enforcement | Application-code-level. DB role permissions, object-lock storage, and off-site replication are roadmap. |
| Compliance review | No independent compliance-attorney review of the 17a-4(f) implementation yet — required before enterprise sales. |
| Live capture connectors | Adapters for mailbox (Microsoft Graph / Gmail API), Slack (Events + Discovery APIs) and Teams (Graph) are built and proven end to end in mock mode. Live capture activates when the workspace app registrations are completed — until then the API reports mock mode honestly and never pretends to be capturing. |
| PST export | Roadmap. CSV + manifest ship in v1. |
| Legal status | VerbaVault stores records; it does not interpret regulations or give legal advice. Ever. |
