The recordkeeping duty behind the decision
Broker-dealers, investment firms and many fintechs must keep records of business communications for set periods and produce them to a regulator or in litigation. Since 2021, United States regulators have imposed penalties running into billions of dollars in aggregate on banks and brokers whose staff conducted business over personal messaging apps that were never captured. Similar expectations exist under MiFID II recordkeeping rules in the European Union and under exchange and regulator rules in India. The practical lesson is that a policy forbidding personal apps fails unless the firm provides a sanctioned channel that is as convenient and that captures everything.
Self-hosted and SaaS side by side
| Self-hosted | SaaS | |
|---|---|---|
| Where data lives | Your VPC, your data centre or an air-gapped segment | Vendor's cloud, region chosen from a list |
| Encryption keys | Yours | Vendor's, sometimes with a customer-managed key option at a higher tier |
| Retention and legal hold | Set and enforced by you | Set within the vendor's options; enforcement depends on tier |
| Export for auditors | Direct from your database and audit log | Through the vendor's export tools and API limits |
| Onboarding | Admin-only; no public sign-up | Often open by domain unless locked down |
| Time to start | Days to deploy and configure | Hours |
| Operations | You patch, back up and monitor | Vendor operates |
| Cost model | Licence or one-off plus support; infrastructure you already run | Per user per month, rising with compliance features |
| Vendor risk | None on availability of your data; you own the stack | Outage, pricing change, acquisition or exit affects your records |
What a self-hosted deployment must include
- An immutable audit log of messages, edits, deletions, joins, leaves and admin actions, exportable in a format an auditor can read.
- Admin-only onboarding with roles and permissions, so no one joins by guessing an address.
- Encryption in transit and at rest, with single sign-on and multi-factor authentication for staff.
- Retention and legal-hold settings you control, and deletion that respects them.
- Clients for web, desktop and mobile from one codebase, branded as yours, so people do not drift back to personal apps.
- The features people actually use: group and direct messages, calls and screen sharing, file sharing, search, bots and webhooks from your other systems.
- A deployment path for the strictest case: an air-gapped segment with no outbound dependency.
When SaaS is fine
A firm with no client-facing regulatory duty, no market-sensitive flows and no institutional security questionnaire in its future can run SaaS messaging comfortably, and should, because the operations cost of self-hosting is real. The tipping point arrives with the first regulator, the first institutional client's vendor review or the first subpoena. Firms that expect one of those within two years save money by self-hosting now rather than migrating under pressure later.
A room-by-room migration plan
- 01 Deploy on your network Container images land on your VPC, on-prem hardware or an air-gapped segment, with TLS everywhere and SSO and MFA configured.
- 02 Admins invite the team No public sign-up. Admins create users, roles and rooms, and connect bots from the CRM, ticketing and alerting systems.
- 03 Teams move in by room Start with desks and client-facing teams, then operations and support. Each room's history policy is set before it opens.
- 04 Compliance verifies Auditors read the immutable log, run an export and confirm retention settings before the old channels are closed.
Where EntropyX Labs fits
EntropyX Chat is self-hosted enterprise messaging for financial firms and other regulated organisations. It ships web, desktop and mobile clients from one codebase, with admin-only onboarding, role-based permissions, an immutable audit log, live message translation, speech-to-text, video calls with screen sharing, polls, scheduled messages and webhook bots, and it runs entirely on your private network, VPC or an air-gapped segment with SSO through SAML or OIDC.
Sources and further reading
- US Securities and Exchange Commission press releases on off-channel communications recordkeeping actions
- MiFID II recordkeeping requirements (Directive 2014/65/EU, Article 16)
This guide is engineering and product guidance from EntropyX Labs, a technology provider. It is not legal, regulatory or investment advice.