Notices 10-06 & 11-39
Business communications on social media are subject to recordkeeping and supervision principles — including static profiles, interactive posts and business use of personal devices.
Financial services · FINRA + SEC
Let advisors engage. Keep every business record.
Social media can build client confidence and create regulated communications at the same time. Brolly captures the whole conversation: posts, comments, edits and deletions. Compliance can supervise it and produce a defensible record when asked.
Broker-dealersRIAsBanksInsurers
Read the video transcript
Your firm engages clients and prospects across social media every day.
But in financial services, every post, comment and direct message is a business communication regulators expect you to capture and retain.
Think a screenshot will hold up in an audit? Unfortunately, no. Posts get edited, comments get deleted, and gaps in your records become gaps in your defense.
And incomplete records mean regulatory findings, fines, and reputational risk you can't afford.
Brolly is social media archiving built for banks, insurers and regulated firms.
Every record is captured in real time, with digital signatures, time-stamping and full version history. Tamper-evident, and defensible.
Supervise with keyword monitoring, powerful search, and one-click export, so you respond to any audit or request in minutes.
It's secure, certified to ISO 27001, with data privacy you and your regulators can trust.
Stay compliant. Stay audit-ready. Brolly for financial services.
Continuous captureConnected business accounts
Review trailSupervision actions recorded
Integrity evidenceMetadata + export checksums
Request-readyPDF · CSV · HTML · JSON
The regulatory reality
Three obligations. One social channel.
FINRA and SEC rules shape recordkeeping and supervision. GLBA shapes how covered customer information must be protected.
Rule 17a-4
Broker-dealers must preserve required business communications and be able to produce them promptly. A defensible record needs more than an editable folder of screenshots.
Safeguards Rule
Covered financial institutions must maintain an information-security program designed to protect customer information. Public-channel workflows need controls that reduce exposure without confusing privacy safeguards with books-and-records duties.
Two jobs. One record.
Client engagement and compliance should not compete.
Let the people closest to the client communicate. Give the people accountable for the record everything they need to supervise it.
For advisors & producers
Engage clients with confidence.
Connected business accounts are captured in the background. Advisors keep moving while the record keeps pace.
For compliance teams
See the whole conversation.
Review originals, edits, deletions, context and supervision history from one complete chronology.
From post to proof
One connected path from capture to production.
The film shows the moment. This is the operating model behind it.
Collect the whole conversation
Posts, comments, media, metadata, edits and deletions are retained from connected business accounts.
Review in context
Flag policy-relevant language and record each review action against the communication it belongs to.
Show what changed
Use timestamps, version history and the exported package’s digital checksums to support the integrity of the record.
Prepare the response
Search once and export a chronological package in PDF, CSV, HTML or JSON.
Supervision without the scramble
Compliance sees the risk. Advisors keep moving.
Brolly runs behind connected business accounts, capturing the record while your team works. Reviewers can search the complete chronology instead of chasing screenshots across devices and inboxes.
- Continuous capture across connected business accounts
- Keyword monitoring for policy-relevant language
- Complete supervision trail linked to the underlying record
Supervision queueConnected business accounts · fictional records
MB
M. Brennan · LinkedIn
ReviewedQuarterly outlook webinar — Thursday at noon.
CL
Client comment
CapturedWill the recording be available afterward?
MB
M. Brennan · reply, edited
In reviewFlagged by a keyword rule for reviewer attention.
Keyword rulesReview trail linked to the record
Examination-ready
Find the communication. Defend the record.
When the request arrives, run the search, review the chronology and export the package. Metadata and digital checksums help answer authenticity questions before they become a second project.
- PDF, CSV, HTML & JSON records packages
- Version history for originals, edits and deletions
- Records retained; disposition on your instruction under your books-and-records schedule
Records packageExamination request · fictional record
✓
Posts & comments214 captured records
✓
Version historyOriginals, edits and deletions
✓
Metadata & checksumsIntegrity evidence included
PDFCSVHTMLJSONExport package
Trust
Security your procurement team can sign off on.
Brolly is ISO/IEC 27001:2022 certified and CSA STAR registered, with controls aligned to NIST SP 800-53. Records are encrypted in transit and at rest, stored immutably, and covered by complete audit trails.
ISO/IEC 27001:2022Certified information security management system.
CSA STAR registeredListed on the Cloud Security Alliance STAR registry.
NIST SP 800-53 alignedControls aligned for public-sector security review.
Encrypted everywhereAES-256 at rest, TLS 1.3+ in transit.
99.9% uptime SLAAvailability commitment in the service agreement.
MFA & role-based accessAccess scoped to your team, with complete audit trails.
Straight answers for compliance teams
Asked by CCOs and their auditors.
Do FINRA rules really cover social media?
Yes. FINRA Regulatory Notices 10-06 and 11-39 make clear that business communications through social media are subject to the same recordkeeping, suitability and supervision principles as any other channel — including static profiles and interactive posts.
What does SEC Rule 17a-4 require?
Broker-dealers must preserve business communications for mandated periods in a format that protects records from alteration and must be able to produce them promptly. An editable folder of screenshots does not provide the complete, verifiable record a firm needs.
Can advisors keep their own social accounts?
Advisor and producer accounts used for business are exactly where the risk lives. Brolly captures connected business accounts continuously, so compliance sees the record without standing between advisors and their clients.
How does Brolly help with supervision reviews?
Keyword monitoring flags policy-relevant language, and reviewers work from the preserved record, including original text, edits, deletions and context, with an audit trail of every review action.
What about examinations and audits?
Export complete, chronological records packages in PDF, CSV, HTML or JSON — with metadata and digital checksums that help answer authenticity questions before they are asked.
Let advisors post. Keep every record.
Bring one real supervision or examination scenario. We will show you how Brolly captures, reviews and produces the record.