Turnkey company
Opening an office or a new company? Tell our specialist how many people you have. It prepares the one-time setup and the monthly plan for your team.
Email Security, Archiving & Continuity
Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.
Buy online
Fixed prices and a written scope. Add what you need to your cart, then check out.
Start scoping
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
Email archiving, immutable with eDiscovery
A tamper-resistant copy of every email with a web portal for search and eDiscovery.
Live within 7 business days
$6 per mailbox, per month
Email continuity
Mail keeps flowing from a standby system when your mail server or provider is down.
Live within 5 business days
$3 per mailbox, per month
Email archive bundle for regulated firms
Email security, immutable archiving and continuity together, priced below buying them separately.
Live within 10 business days
$14 per mailbox, per month
Messaging archiving: SMS, Teams and WhatsApp
Capture and keep business text and chat messages, so recordkeeping covers more than email.
Live within 10 business days
$8 per user, per month
Show 4 more
Legal hold and eDiscovery export
Preserve and export the mail and messages for one legal matter, with a defensible record of what was done.
Export within 10 business days of the request
$1,800 per matter
Broker-dealer compliance communications
Email archive, messaging archive, call recording and continuity for firms with communications recordkeeping duties.
Live within 15 business days
$23 per user, per month
Healthcare communications
HIPAA-ready e-fax, email security and an email archive for a small practice: one fax number and 10 mailboxes.
Live within 10 business days
$135 per month, 1 fax number and 10 mailboxes
Turnkey company: monthly per employee
Managed IT, Clayton Communicator, email archive bundle and workstation backup for each employee, on one monthly price.
Starts when the employee is set up
$139 per employee, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Email is where most attacks start and where regulated firms keep most of their records. This service puts three protections around it: filtering that stops threats in both directions, an immutable archive that keeps every message, and continuity that keeps mail working when the platform is down.
We attach to the mail platform you already run, Microsoft 365, Exchange or Google Workspace, either through mail routing (MX) or through the platform's API, and we operate the result. We work with technologies such as Mimecast, Proofpoint, Microsoft Purview, Smarsh and Global Relay, which are products of their owners and not partners of ours, and we choose the tools that fit your platform, your regulator and your budget.
At a glance
Email is the main way attackers get in and the main record a regulated firm must keep. This service covers both, plus the day the mail server fails. We add inbound and outbound filtering to Microsoft 365, Exchange and Google Workspace, with AI-assisted detection of phishing and business email compromise, data-loss rules on outgoing mail, and alerts when a mailbox looks compromised. We keep an immutable archive of everything sent and received, with a web portal and eDiscovery, and we provide continuity so staff can send and receive during an outage.
The problem
Most mail platforms ship with basic filtering that determined attackers learn to get around, and almost none protect what leaves. A convincing invoice request from a real vendor's hijacked account passes every simple test. Once a mailbox is taken, an attacker sets a forwarding rule and reads in silence. Meanwhile the mailbox itself is a poor archive: users can delete, retention policies drift and a legal request arrives with a deadline. Regulated firms face written rules about keeping business communications, and the cost of failing at it can be large. Finally, when the platform is down, the business is not just inconvenienced: orders, wires and client messages stop. Security, record-keeping and uptime are one email problem, and we treat them as one.
The hardest messages to catch contain no malware at all. A real vendor's hijacked account asks for a changed bank detail, or an executive's name is faked on a request for a gift-card purchase. Detection has to read context: who normally writes to whom, how, and about what. Once an account is taken, the attacker's first moves are quiet ones, such as a rule that forwards copies to an outside address. We watch for those moves as closely as for the message that started them.
What we deliver
- Inbound and outbound filtering attached to Microsoft 365, Exchange or Google Workspace through MX routing or API, tuned to your mail
- Email authentication with SPF, DKIM and DMARC moved to enforcement without breaking legitimate mail
- AI-assisted detection of phishing, impersonation and business email compromise, with analyst review
- Outbound data-loss rules written with your compliance lead, with a log of every action
- Alerts for impossible travel, new forwarding rules, mass sending and changed sign-in methods, sent to your contact and handled by our team
- An immutable archive of all sent and received mail with a web portal, role-based access, search and eDiscovery export
- Email continuity: a standby service and a documented switchover, tested on a schedule
- Optional archiving of SMS, WhatsApp, Teams chat and recorded calls on the same retention policy
- Written retention and legal-hold procedures mapped to the rules that apply to your firm
- A monthly report of blocked threats, quarantines, alerts and archive health, and a quarterly review
Filtering and AI-assisted detection. Inbound mail is checked for malware, malicious links and spoofing, and by models that look at sender history, writing style and the shape of the request to catch phishing and business email compromise. Hard cases go to an analyst. Outbound mail is checked too, and authentication with SPF, DKIM and DMARC is moved to enforcement so attackers cannot send as you.
Outbound data-loss prevention. We write rules with your compliance lead for the data that should not leave by email: account and card numbers, health information, client lists, deal documents. A rule can warn the sender, ask for approval, encrypt the message or block it, and every decision is logged for review.
Compromised-mailbox signals. We watch for sign-in from an impossible location, a new forwarding or hiding rule, a burst of outgoing mail and a changed multi-factor method. Alerts go to your named contact and to our team, and we can lock the account, revoke sessions and remove the rule while we investigate. Alerting on your side is part of the design, because a signal nobody reads is not a control.
Immutable archiving and eDiscovery. All sent and received mail is copied into storage that cannot be altered or deleted before its retention period ends, with a web portal for search, export and reviewer access, and tools for eDiscovery: search across mailboxes and dates, tagging, legal hold and export in standard formats. Our article "Proving What You Sent" describes how immutable archives are built and why they hold up when a record is challenged.
Regulated firms. For a broker-dealer, SEC Rule 17a-4 sets how required records, including business communications, are preserved: either in a write-once, read-many (WORM) format or, under the 2022 amendments, in an electronic system that keeps a complete, time-stamped audit trail so an altered or deleted record can be recreated. FINRA Rule 4511 requires books and records to be made and kept as FINRA rules and the Exchange Act require, and for six years where no period is set. Investment advisers have their own rule on books and records under the Investment Advisers Act, and healthcare entities must keep HIPAA documentation for six years, with medical-record periods set by state law. We map your retention to the rules that apply and document the design so an examiner can follow it. This is general information, not legal advice.
Off-channel communications and legal hold. Regulators have fined many firms because staff did business over personal text messages and chat applications that the firm did not keep. We bring SMS, WhatsApp and Teams chat on company-managed channels, and recorded calls from the Clayton Communicator, into the same archive and policy as email, and we support legal hold that stops deletion for a matter until counsel releases it.
Continuity. A standby mail service with its own web inbox lets staff send and receive during an outage of Microsoft 365, Exchange or Google Workspace. Mail that arrives meanwhile is kept and delivered back when the platform returns. We rehearse the switchover on a schedule, because a plan nobody has tried is a guess.
Packages
Inbound and outbound filtering
A filtering layer in front of or alongside Microsoft 365, Exchange or Google Workspace, attached through mail routing (MX) or through the platform's API. It blocks spam, malware, malicious links and spoofing, and checks outgoing mail too, with authentication set up through SPF, DKIM and DMARC.
AI-assisted phishing and BEC detection
Models that read the signals around a message, such as sender history, writing style, a changed payment instruction, lookalike domains and an unusual request, and quarantine or flag impersonation and business email compromise that signature filters miss. A human analyst reviews the hard cases.
Outbound data-loss prevention
Rules that watch outgoing mail for data that should not leave: account and card numbers, health information, client lists and confidential documents. Each rule can warn the sender, require approval, encrypt or block, and every decision is logged.
Compromised-mailbox detection
Signals that a mailbox has been taken: sign-in from an impossible location, a new forwarding or hiding rule, mass sending, a changed phone or multi-factor method. When one fires, an alert goes to your named contact and our team, and we can contain the account.
Immutable email archiving
A copy of all sent and received mail, kept in storage that cannot be altered or deleted before its retention ends, with a web portal for search, export and reviewer access, and with eDiscovery tools: search, tagging, legal hold and export in standard formats.
Email continuity
A standby mail service with its own address and a web inbox, so staff can send and receive during a Microsoft 365, Exchange or Google Workspace outage. Mail that arrives meanwhile is kept and delivered back when the platform returns.
Communications archiving for regulated firms
Email, SMS, WhatsApp and Teams chat on company-managed channels captured into the same archive under one retention policy and one search. Built for the off-channel communications risk that broker-dealers and advisers face, where regulators have brought recordkeeping enforcement.
Call recording retention and legal hold
Recordings from Teams, the contact center and managed mobile numbers, taken from the Clayton Communicator, held on the same retention schedule as your written records, with legal hold that suspends deletion for a matter and an audit log of who accessed what.
Regulatory mapping for broker-dealers and advisers
We map your retention to the rules that apply: SEC Rule 17a-4 and FINRA Rule 4511 for broker-dealers, SEC Rule 204-2 for investment advisers, HIPAA documentation retention for healthcare, and state requirements. We document the design so an examiner can follow it.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
DMARC: from watching to rejecting
Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.
Failover in under a second
ISP A fails at 300 ms. BFD (RFC 5880) with a 50 ms interval and multiplier 3 declares the session down 150 ms later, BGP withdraws the routes, and the forwarding table repoints to ISP B. Traffic is back at full rate in well under a second; without BFD the router would wait for the 90 s BGP hold timer. Illustrative figures.
Our process
- 1
Assess
We review your mail platform, current filtering, retention obligations and the communications channels staff really use.
- 2
Design
We choose how filtering attaches, set the retention and legal-hold policy and write the data-loss rules with you.
- 3
Deploy
We cut mail over in stages, import existing mail into the archive and test continuity before you need it.
- 4
Operate
We watch alerts, tune detection, run the archive and rehearse the continuity switchover each year.
Work like yours
Wholesale distribution
Three AI agent bots take invoice keying off a distributor's accounts-payable clerk
In this modeled engagement, keying and matching time fell from about 25 hours a week to about 6, most of it exception review, and the bots…
Read the case
Investment management
Trained finance staff stop a deepfake-backed wire request at a Connecticut investment firm
In this illustrative case, a request supported by a cloned partner voice and a lookalike sender domain reached an operations associate, who…
Read the case
Global industrial conglomerate
Ten years running the U.S. offices of one of South Korea's largest companies
A decade of continuous operation for both offices, with security findings escalated to headquarters ahead of problems.
Read the caseFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDoes this replace Microsoft 365 or Google Workspace?
No. It attaches to the platform you already use. Filtering works through mail routing (MX) or the platform's API, the archive keeps a separate copy of your mail, and continuity gives staff a way to send and receive when the platform is down.
What does SEC Rule 17a-4 require of a broker-dealer?
In general, a broker-dealer must preserve required business records, including communications about its business, for set periods. Records must be kept either in a write-once, read-many (WORM) format or, under the 2022 amendments, in a system that keeps a complete, time-stamped audit trail so the original can be recreated if a record is altered or deleted. The details depend on the firm and the record, so confirm them with your compliance counsel. This is not legal advice.
How does FINRA Rule 4511 relate to email retention?
FINRA Rule 4511 requires member firms to make and preserve books and records as required under FINRA rules and the Exchange Act, and where no period is specified, to keep them for six years. Business email and other communications generally fall under those recordkeeping duties, so an archive has to be complete, searchable and protected from alteration.
What is off-channel communication and why does it matter?
It means business conversations held on channels the firm does not capture, such as personal text messages or WhatsApp. Regulators have brought recordkeeping enforcement against many broker-dealers and advisers over it. The fix is to move business conversations to channels the firm controls and archive them, and to train staff, which we help with.
Can you detect a compromised mailbox?
Yes. We watch for signals such as sign-in from an impossible location, a new forwarding or inbox rule, a burst of outgoing mail and a changed sign-in method. Each raises an alert to your named contact and to our team, and we can contain the account.
What happens to our email if Microsoft 365 or Google goes down?
With email continuity, staff open a web inbox on a standby service and keep sending and receiving. Mail that arrives during the outage is held and delivered back to normal mailboxes when the platform returns. We test the switchover on a schedule.
Does this help with HIPAA?
It helps. HIPAA requires covered entities and business associates to keep certain documentation for six years, and email often contains protected health information, so encryption, access control and a protected archive matter. State law sets how long medical records themselves must be kept. We design retention with your counsel.
What is the difference between email archiving and email backup?
A backup is a copy you restore from after something breaks, such as a deleted mailbox or a ransomware attack, and it is usually kept for a limited time and can be changed or overwritten. An archive is a complete, searchable record of every message sent and received, kept unchanged for a set retention period, so you can prove what was said and produce it for an auditor, a court or a regulator. A backup answers 'can we get our data back'; an archive answers 'can we prove what happened'. Regulated firms generally need the archive, and most firms want both.
Is a Microsoft 365 or Google backup enough for SEC or FINRA recordkeeping?
Usually not by itself. SEC Rule 17a-4 and FINRA Rule 4511 are about preserving required records for set periods in a form that cannot be quietly altered or deleted, with an audit trail and the ability to produce them on request. A backup meant for restoring data does not usually meet that, and a mailbox that a user can delete from is not a preserved record. A purpose-built immutable archive is the usual answer. We map the rules to your firm's retention schedule in writing. This is plain-language information, not legal advice; your compliance counsel decides what your firm must keep.
How do you keep our email working during a Microsoft 365 outage?
We set up email continuity before you need it. Mail for your domain is queued and held by a standby service while Microsoft 365 is unavailable, so senders do not get bounces. Staff sign in to a web inbox on the standby service to read, reply and send. When Microsoft 365 returns, held mail is delivered to the normal mailboxes. We write down the switchover steps and test them on a schedule so nobody learns them in the middle of an outage.
How do compromised-mailbox alerts work?
We watch sign-in and mailbox activity for the signs that an account has been taken over: sign-in from an impossible location, a new forwarding or inbox rule that hides replies, a sudden burst of outgoing mail, or a changed sign-in method. When one of these appears, an alert goes to your named contact and to our team, and an analyst reviews it. Who may disable an account, reset passwords or end sessions without calling first is agreed with you in writing during onboarding, so the response is quick and nobody is surprised.