MirrorWeb

The foundation is capture and immutable retention, which is deterministic infrastructure and the reason firms buy the product at all: getting every channel into a store that cannot be altered. Models arrive above that layer in the supervision engines, which score relevance and surface the highest risk material rather than dumping every lexicon hit on a reviewer.

Apply the removal test and a functioning archive with rule based supervision remains, which is the legacy product this category has always sold. Worth noting that the company itself publishes commentary sceptical of firms racing to describe themselves as artificial intelligence powered, which sits consistently with where the models actually sit in its stack.

The system is built to prioritise rather than to decide. Scenario based detection and relevancy scoring rank communications so a reviewer works the highest risk material first, and because the trigger behind each alert is shown, a supervisor can judge whether the flag is sound instead of accepting a score. The employee also holds a control most surveillance products deny them, deciding which contacts fall inside the compliance boundary.

What is not described is the surrounding process: no documented escalation path, no approval workflow, no sampling or quality assurance over the reviews themselves, and no stated route for an employee to contest an alert that proves unfounded.

Two things put this above the category norm. Alerts carry their trigger, so a reviewer or examiner can trace exactly why a message surfaced rather than arguing with a relevance score, and the company publishes a specific false positive reduction figure alongside a direct comparison to competitors, which is a falsifiable claim rather than an adjective.

The familiar asymmetry remains and is worth stating: a supervision product's regulatory failure mode is the message it did not flag, and suppressing false positives by 98 percent moves a threshold that necessarily trades against detection, with no recall or false negative figure published anywhere.

The clearest named deployment is a national library rather than a financial institution, which speaks to the web archiving heritage more than to the finance business. Financial services customers are described only by shape, from newly registered advisers to large established investment advisers, with no count, no volume figure and no named firm.

Performance claims are specific and include an unusually direct competitive assertion, that rivals promise 90 percent fewer false positives while this platform delivers 98 percent, which is falsifiable in principle and creditable for that reason, but no methodology or independent evaluation supports it.

Supervision output is explainable at the alert level, showing what triggered each item, which is the right instinct for a product whose findings land in an employee's supervisory record. Beyond that the disclosure runs thin. No public material identifies which models are used or supplied by whom, states whether communications content from one firm informs detection serving another, describes retention inside the supervision layer as distinct from the archive, or explains how detection is evaluated against material deliberately written to evade it, which is the realistic threat when the people being supervised know they are being supervised.

The mobile privacy design is the strongest thing here and it is worth understanding precisely. Rather than capturing everything on a handset or forcing employees onto separate numbers, devices or business only applications, the product lets a user classify contacts as personal or corporate and archives only the work conversations, so personal messaging stays out of the compliance record. That is a real answer to the central objection employees raise about mobile surveillance.

Its limitation is equally clear: the boundary is declared by the employee rather than enforced by the channel, so a misclassification either leaks a private conversation into the archive or keeps a business one out of it. No published privacy framework, retention schedule or subprocessor list was located.

This pass located no trust centre, enumerated certification list, attestation scope or audit period. The absence is sharper for this vendor than for most, because the product's core promise is an immutable record that will withstand a regulatory examination, and the natural evidence for that promise is independent attestation of storage immutability, chain of custody and retention controls. A firm relying on the archive to demonstrate compliance is relying on assurance it cannot currently inspect from outside.

MirrorWeb supplies technology and holds no licence, the expected posture, and its regulatory grounding is stated at the level of specific provisions rather than general compliance language. Records are held immutably in write once read many storage explicitly to satisfy the United States securities recordkeeping rule, alongside industry authority requirements, the United Kingdom conduct regime and the European markets directive, with public records access law covered for government users. Immutable storage is not a marketing feature here, it is the precise technical artifact those rules demand, and the enforcement wave over off channel messaging is why the category exists.

The people assessed here are employees, so the exposure is uneven scrutiny rather than denial of a financial product, and language classifiers carry well documented differential error rates across dialect, register and first language, meaning an adviser who writes informally or works in a second language can accumulate flags that others would not.

The company shows genuine awareness of lexicon crudeness, publishing commentary on how a rule written to catch promises of investment returns will flag every ordinary use of the word guarantee. That insight has not been extended into disclosure: no per language or per dialect accuracy, no analysis of differential flagging, and no described contest route.

Capture breadth is wide and covers the channels regulators have actually fined firms over, spanning email, terminal chat, collaboration platforms, consumer messaging applications, voice, social media and mobile, and it includes something no competitor in this lane offers: real time website capture that preserves dynamic interactive pages exactly as a user saw them, which is a distinct discipline inherited from the company's digital preservation origins.

The architectural limit is that this platform is a destination rather than a conduit. It archives conversations that happen in other systems rather than carrying them, so it does not govern a message at the point of sending.

Delivery is cloud hosted, with operations spanning the United States and the United Kingdom and customers subject to both regimes. Residency carries unusual weight for this product because the archive is a legally mandated record that must remain retrievable and unaltered for years, so where it physically sits and under whose jurisdiction it falls are compliance questions rather than preferences. No public material identifies hosting regions, residency options, transfer mechanisms or subprocessors.

Rates are not published, but the commitment made instead lands on the exact pain this market is known for. MirrorWeb states plainly that there are no fees, no complex packages and no surprise charges for exporting data or applying custom policies, and it names legacy competitors' export fees and slow data extraction as the practice it is displacing.

Export charges are the principal lock in mechanism in communications archiving, since a firm that cannot cheaply retrieve its own retained records cannot switch supplier, so removing them is a more consequential disclosure than a headline rate would be.

The range of firm size is the notable part, with material addressed to a single person advisory practice through to a global operation, and solo registered advisers are a segment most compliance vendors will not serve at all. Beyond finance the platform reaches legal, insurance, healthcare and the public sector, and the regulatory span covers the United States securities and industry rules alongside the United Kingdom conduct regime, the European markets directive and public records access law. What it lacks relative to the deepest vendors in this lane is finance specific depth by institution type, with no separate treatment of banks, credit unions or sponsor bank structures.