How ready is your email for an SEC exam?
Question {n} of {total}
Six questions. About two minutes. No email needed.
We could not work out your result. Get the checklist instead.
Your score: {score} of 100
Gaps to close
Several practices aren't in place yet. That's a starting point, not a verdict.
Where to start: {area}
Partly in place
Some of this is in place; some is informal or unchecked.
Your score is {score}, but your answer on {area} keeps you in Partly in place. The top band needs 70 or more and no answer in the bottom two options.
Where to start: {area}
Well documented
Mostly in place as you describe it, and a simple firm may not need a vendor to keep it that way.
The one area to tighten: {area}
Rule 204-2(a)(7): keep sent and received mail relating to advice, funds, orders and performance. First step, free: list every mailbox that talks to clients and check each is covered. Turret archives sent and received mail for each monitored mailbox, Google or Microsoft, Trash included. Spam, drafts and chats aren't captured.
Rule 204-2(e)(1): at least five years from fiscal year-end; (g)(2)(i): records you can find. First step, free: find a four-year-old client email. Turret's retention policy is seven years while you subscribe, with full-text search, SHA-256 hashes on archived messages, and a read-only Viewer role for an outside CCO.
Rule 204-2(g)(2)(ii): provide a complete copy promptly when examiners ask. First step, free: time pulling one client's email for one quarter. Turret lets you search a client's mail and includes Supervision Activity and Archive Integrity reports. A full export is built by Turret on request; talk to us about timing.
Rule 206(4)-7(a) requires written policies. First step, free: write down how often outbound mail is reviewed, and by whom. Turret scans outbound mail hourly, triages each hit with AI and a written reason, and queues it for a reviewer. Inbound is archived, not reviewed; attachment text isn't scanned.
The SEC's 2023 request list asks for a "Record of compliance exceptions." First step, free: note who decided what on each flagged email. Turret keeps an append-only history of each reviewer action on an alert, with who and when, and a Supervision Activity Report summarizes it.
Rule 204-2(a)(11) requires a copy of each advertisement, with limited exceptions; the SEC's April 2024 alert cited advisers that "did not maintain copies of information posted to social media." First step, free: list where you publish. Turret's separate Marketing product adds AI pre-screen, named-reviewer approval and website archiving.
Every answer is in the top option. These answers describe your practices; they don't test them. Try question 3 as a dry run: pull one client's email for one quarter.
Your six areas
-
Archive coverage
In place, as you describe it.
Mostly in place, but something is informal, slow or unchecked.
Only partly in place.
Not in place, or not known yet.
First step, free: list every mailbox that talks to clients and check each is covered.
-
Retention and search
In place, as you describe it.
Mostly in place, but something is informal, slow or unchecked.
Only partly in place.
Not in place, or not known yet.
First step, free: find a four-year-old client email.
-
Exam export
In place, as you describe it.
Mostly in place, but something is informal, slow or unchecked.
Only partly in place.
Not in place, or not known yet.
First step, free: time pulling one client's email for one quarter.
-
Outbound review
In place, as you describe it.
Mostly in place, but something is informal, slow or unchecked.
Only partly in place.
Not in place, or not known yet.
First step, free: write down how often outbound mail is reviewed, and by whom.
-
Documented review
In place, as you describe it.
Mostly in place, but something is informal, slow or unchecked.
Only partly in place.
Not in place, or not known yet.
First step, free: note who decided what on each flagged email.
-
Marketing records
In place, as you describe it.
Mostly in place, but something is informal, slow or unchecked.
Only partly in place.
Not in place, or not known yet.
First step, free: list where you publish.
Try the Email product free for 15 days.
Try the Marketing product free for 15 days.
Turret, if you ever want this done for you.
Start with the free step above. When you want a tool for the archiving and review parts, the trial lets you try Turret before you pay.
You have a base to build on. The trial lets you check where Turret would replace a manual step and where you'd rather keep your own.
If your process already holds up, the trial is a way to compare it with what you do now.
Email is $99 a month for 5 mailboxes, then $25 for each more. No setup fee. Card asked at the end of setup. Billed monthly, cancel anytime. Prices exclude tax.
- Connect Google Workspace or Microsoft 365 in the setup steps, with read-only access to the mailboxes.
- Outbound mail is reviewed; inbound is archived.
- Each flagged email comes with a written reason from the AI triage.
Marketing is $99 a month for 5 submitters, then $15 for each more. Reviewers and approvers are free. No setup fee. Card asked at the end of setup. Billed monthly, cancel anytime. Prices exclude tax.
- Marketing needs no email connection.
- Each piece gets an AI pre-screen, then a named reviewer approves it.
- It covers marketing pieces and website archiving, not email.
Email is $99 a month for 5 mailboxes, then $25 for each more. No setup fee. Card asked at the end of setup. Billed monthly, cancel anytime. Prices exclude tax.
- Connect Google Workspace or Microsoft 365 in the setup steps, with read-only access to the mailboxes.
- Outbound mail is reviewed; inbound is archived.
- Each flagged email comes with a written reason from the AI triage.
No call is needed to start. If you'd rather speak to a person first, Talk to us.
A self-check, not legal advice. About this check
About this check
A self-check of your practices, not legal advice or a compliance determination.
Not affiliated with the SEC. Our answer options are a judgment of good practice, not a rule requirement; each rule is cited only for what it says. Our server doesn't store your answers with your email or any identity. If you ask us to email your full report, they're used once to write that email.
We keep anonymous totals of answers (no email or identity) to see where firms are strongest and weakest.
Based on 17 CFR 275.204-2 and 275.206(4)-7 (eCFR text as of October 15, 2026), the SEC risk alert "Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents" (September 6, 2023), and the SEC's April 17, 2024 Marketing Rule risk alert.