Does a solo or small RIA need email archiving?

Yes to records, not necessarily a vendor. Rule 204-2 requires SEC-registered advisers, whatever their size, to keep certain emails at least five years; state-registered firms follow their state's rule. A solo firm may not need a vendor: Google Vault or Microsoft Purview, if configured, may cover it. A vendor helps once others' mail needs supervising.

What this means for your firm

• Test native retention before you buy: confirm a rule covers every mailbox, a license is assigned, and you can produce a three-year-old message.
• With staff, name the reviewer and what happens to a flagged message; alone, say so and how often you look.
• Revisit at your first hire, and decide where the records will live if the firm closes.

Turret keeps a record of review: a queue of flagged outbound mail and a dated Supervision Activity Report.

Six questions about how your firm keeps and reviews email: take the SEC email-readiness self-check. A self-check of your own practices, not legal advice.

No setup fee

$99 a month covers 5 mailboxes, then $25 a month for each extra mailbox, before tax.

Turret email archiving price by number of mailboxes

Mailboxes	Monthly	Annual
3	$99	$990
5	$99	$990
10	$224	$2,240
20	$474	$4,740

Who it covers

Advisers registered or required to be registered under section 203 of the Advisers Act; no size exemption in the text (Rule 204-2(a)).

What must be kept

Written communications received and sent that relate to advice, funds, orders and performance (Rule 204-2(a)(7)).

How long

Not less than five years from the end of the fiscal year of the last entry, the first two in an appropriate office (Rule 204-2(e)(1)).

In what form

Electronic storage is allowed if records are indexed, producible, duplicated and safeguarded (Rule 204-2(g)).

Review

Written policies, reviewed at least annually (Rule 206(4)-7(a) and (b)).

The rule asks for records. It does not ask for an archiving product, and it says nothing about firm size. Rule 204-2 opens:

"Every investment adviser registered or required to be registered under section 203 of the Act (15 U.S.C. 80b-3) shall make and keep true, accurate and current the following books and records relating to its investment advisory business;"

17 CFR 275.204-2(a)

Email enters through paragraph (a)(7):

"(7) Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security..."

17 CFR 275.204-2(a)(7)(i)–(iii); item (iv) covers performance

The test is the subject of the message, not the mailbox. A firm that keeps all its mail need not decide, message by message, which ones relate to advice; that is a practical reason to keep everything, not a requirement. Retention is paragraph (e)(1):

"...shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser."

17 CFR 275.204-2(e)(1)

Nothing in (e)(1) mentions a vendor, write-once storage or a particular system. Some firms keep records longer, such as seven years; that is their choice, not the rule's text. Paragraph (g)(1)(ii) allows "Electronic storage media, including any digital storage medium or system that meets the terms of this section". One of those terms:

"(iii) Separately store, for the time required for preservation of the original record, a duplicate copy of the record on any medium allowed by this section."

17 CFR 275.204-2(g)(2)(iii)

Others: provide a legible, true and complete copy promptly when the Commission asks ((g)(2)(ii)(A)), and keep procedures to "reasonably safeguard them from loss, alteration, or destruction" ((g)(3)). Whether a retention rule inside your own Google or Microsoft account is the duplicate copy that (g)(2)(iii) describes is a judgment for your CCO and counsel.

Rule 204-2 is the federal rule; many small advisers register with their state instead. The Advisers Act bars an adviser regulated by its home state from registering with the SEC unless it has assets under management "of not less than $25,000,000, or such higher amount as the Commission may..." (15 U.S.C. 80b-3a). Generally, smaller advisers sit with their state and larger ones with the SEC; your Form ADV says which you are.

State rules vary, so read yours. As an example, the NASAA model rule, amended May 4, 2026, sets a comparable retention minimum.

For a one-person firm, native tools may cover the retention half of the job. Three things decide it.

A rule has to exist. Google's Vault overview: "Vault doesn't retain data until you set up retention rules." Having the edition is not the same as having retention. Check the rule and test a search.

The license has to cover the mailbox. Google: "Only users with Vault licenses assigned to them are covered by Vault." Of the three Business editions on Google's pricing page (checked October 17, 2026), only Business Plus lists Vault; Business Starter and Business Standard do not. More on this one tool: Is Google Vault enough for SEC Rule 204-2?

On Microsoft the license list is specific. Microsoft's Purview service description lists, among others, Microsoft 365 E3, E5 and Business Premium for retention, plus Exchange Plan 2 or Exchange Online Archiving for an Exchange mailbox.

If you are the only person who sends firm mail, the rule is set and tested, and you can show it meets paragraph (g), Rule 204-2 does not ask you to buy a separate vendor.

Four things native retention does not do for you.

Supervising other people's mail. Rule 206(4)-7(a) requires you to "Adopt and implement written policies and procedures reasonably designed to prevent violation, by you and your supervised persons". Once an employee sends client email, a policy that says it is reviewed needs a way to review it and a record that it happened. Google's Vault overview covers retention; it documents no supervision feature. Microsoft sells supervision as Communication Compliance, which needs a Microsoft Purview Suite license, an Office 365 Enterprise E3 license with the Advanced Compliance add-on, or an Office 365 Enterprise E5 subscription.

Annual review evidence. Rule 206(4)-7(b) requires you to "Review, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation". You need something to show: what was checked, by whom, and what was found. A reviewer queue with a dated report is one way; dated notes are another.

When a mailbox goes away. Vault covers only licensed users, so settle what happens to a leaving employee's mailbox and license before it happens. For a solo firm the larger case is closing the firm: paragraph (f) of Rule 204-2 requires an adviser, before ceasing business, to arrange for and be responsible for preserving its books and records. Where your mail will live then, and who can reach it, is worth answering early.

Deleted mail and other channels. Whether retention holds what a user deletes is its own question: Does email archiving capture deleted email? Texts, WhatsApp and social media are not email, and email retention does not capture them.

A sole owner reviewing their own mail is a weaker control than independent review, and an examiner may probe it. Write down whether it is adequate for your firm, and why.

More than $600 million

The SEC's Division of Examinations publishes yearly priorities. The fiscal year 2026 document, section I.C, page 7, says:

"As with previous years, the Division will prioritize examinations of advisers that have never been examined, with particular emphasis on recently registered advisers."

SEC Division of Examinations, Fiscal Year 2026 Examination Priorities

The same document says: "This statement, like all staff statements, has no legal force or effect: it does not alter or amend applicable law, and it creates no new or additional obligations for any person."

1. Confirm who regulates you; decide the retention period with counsel. Your Form ADV says which regulator you answer to; if you are state-registered, read your state's rule.
2. Test native retention before buying anything. Is a rule set for every mailbox that sends firm mail? Is a Vault or Purview license assigned to each mailbox in your admin console? Can you find a message from three years ago and produce a legible, true and complete copy? If yes, you may already have the retention half.
3. Write down who reviews what. If you are alone, say so and say how often you look. With staff, name the reviewer and what happens to a flagged message. Keep dated notes of each annual review.
4. Revisit at the first hire, and decide where the records will live if the firm closes.

Turret is outbound email supervision and archiving for small RIAs on Google Workspace or Microsoft 365: it archives sent and received mail, Trash included, and reviews outbound mail only. Attachments are archived with their name, type and size, but the text inside them is not scanned. Retention is a policy of 7 years, while you subscribe.

Email is $99 a month and includes 5 mailboxes, then $25 a month for each additional monitored mailbox, with no setup fee. A solo firm still pays the 5-mailbox base price; 4 of the 5 go unused. Turret will not be cheaper than something you already pay for: if Vault or Purview covers you and nobody else sends firm mail, you may not need it, and if a membership or platform includes an archive, check what it retains and reviews first. If you do use Turret, suspend a departing mailbox rather than deleting it.

If a second person sends client mail, or you have no native rule you have tested, the free trial is 15 days, with the card taken at the end of setup. Full figures: What does email archiving cost a small RIA in 2026?

Sources opened October 17, 2026. Rule text is from the eCFR, current as of October 15, 2026.

1. 17 CFR 275.204-2, Books and records to be maintained by investment advisers (eCFR). Quotations of Rule 204-2 on this page are from this text.
2. 17 CFR 275.204-2 (Cornell LII mirror). Paragraph (f) is paraphrased from this text.
3. 17 CFR 275.206(4)-7, Compliance procedures and practices (eCFR). Paragraph (b) is quoted from this text.
4. 17 CFR 275.206(4)-7 (Cornell LII mirror). Paragraph (a) is quoted from this text.
5. 15 U.S.C. 80b-3a, State and Federal responsibilities (Cornell LII)
6. NASAA Recordkeeping Requirements for Investment Advisers, Model Rule 203(a)-2, amended May 4, 2026 (PDF)
7. SEC Division of Examinations, Fiscal Year 2026 Examination Priorities (PDF)
8. Google Workspace Admin Help, Vault overview (page updated October 13, 2026)
9. Google Workspace pricing, used only for which editions list Vault.
10. Microsoft Learn, Microsoft Purview service description
11. Microsoft Learn, Plan for Communication Compliance
12. Google: How retention works in Vault
13. Google: Google Vault FAQ