Email a regulated firm can prove: delivered into an Amazon S3 bucket that cannot be deleted or overwritten, with AWS KMS protecting each message's fingerprint
A regulated firm that needed to prove what it sent and received, a leader in its segment.
- Scale
- Every inbound and outbound message, 1 Object Lock archive bucket, AWS KMS protecting each message fingerprint
- Engagement
- Design, build and testing in phases
The challenge
The firm's clients, counsel and examiners sometimes asked a simple question that its mail platform could not answer with proof: what exactly did you send or receive, and when? An ordinary mailbox can be edited, a retention setting can be changed by an administrator, and a deleted message leaves no evidence. The firm wanted a record that could not be quietly altered after the fact.
A regulated firm, a leader in its segment, needed to prove the email it sent and received. Clients, counsel and examiners wanted more than a mailbox export: a mailbox can be edited, a retention setting can be changed by an administrator, and a deleted message leaves nothing behind. The firm asked our team for a record that could not be quietly changed after the fact. The client is not named on this page.
The email was delivered into an Amazon S3 bucket configured with S3 Object Lock, so the stored messages could not be deleted or overwritten during the retention period. In compliance mode, a protected object version cannot be overwritten or deleted by any user, including the root user of the AWS account, and its retention period cannot be shortened until it expires. Object Lock also requires bucket versioning.
To show that a stored message was later unchanged, AWS Key Management Service (AWS KMS) was used to cryptographically protect each message's fingerprint. KMS does not produce the fingerprint itself. The fingerprint is a SHA-256 hash computed from the message, and KMS then signs it or computes a message authentication code (MAC) over it with a key that never leaves KMS in plain form. If the message is altered, the hash no longer matches the protected value.
We describe only that outcome here, not the client's internal design. Systems of this kind are typically built with a capture path from the mail platform (for example journaling in Microsoft 365 or a copy taken by a relay or Amazon SES), a bucket with Object Lock and versioning, a hash step, and a KMS key whose use is logged by AWS CloudTrail. The choices that matter, such as a KMS signature versus an HMAC and how to capture mail, are explained in our article "Proving what you sent: immutable email archives with Amazon S3 Object Lock and AWS KMS".
This is technical evidence, not legal advice, and it does not by itself make a firm compliant with any retention rule. Counsel decides what must be kept and for how long. AWS publishes an assessment by Cohasset Associates of S3 Object Lock for SEC Rule 17a-4, CFTC and FINRA environments; that assessment is the vendor's, not a statement about this firm.
What our team delivered
- Email delivered into an Amazon S3 bucket configured with S3 Object Lock, so stored messages could not be deleted or overwritten during the retention period
- AWS Key Management Service (AWS KMS) used to cryptographically protect each message's fingerprint, so a message could later be proven unchanged. The fingerprint is a SHA-256 hash computed from the message; KMS signs it or computes a MAC over it
- How such a design is typically built, and the choices in it (KMS signing versus HMAC, capture paths), are explained in our article rather than stated as this client's design
Result
The firm can answer "what did you send or receive, and can you prove it?" from a record that could not be deleted or overwritten during the retention period, with a protected fingerprint to show a message is unchanged. This is technical evidence, not legal advice, and it does not say the firm is compliant with any rule: counsel decides what the firm must retain and for how long. The client is not named.
Email kept as write-once evidence
Each message is copied as a raw .eml with its headers and DKIM signature, hashed with SHA-256 and stored in an Amazon S3 bucket with Versioning and S3 Object Lock in compliance mode. An AWS KMS customer-managed key encrypts it, with key administrators separated from key users, and AWS CloudTrail logs every key use. A hash chain with a Merkle root receives an RFC 3161 timestamp, so a verifier can recompute the hash and check the timestamp and DKIM later. A delete attempt, even by the root user, is refused until the retention period ends.
One key pattern on every cloud
AWS, Google Cloud, Microsoft Azure and Oracle Cloud Infrastructure all run the same envelope pattern. A workload encrypts data with a data key, asks the provider's key service to wrap that data key, and stores the wrapped key beside the data. The key that wraps it is held in a hardware security module (HSM) and never leaves it.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.