∞
Versions kept · no truncation, ever
Every document, every version, every signature.
Policies, ADV Part 3, IMA, KYC packets, trust docs, vendor agreements: versioned the moment you save them, hashed before they're delivered, sealed against tampering, and tied to who signed what when.
Form ADV Part 3 · Client Relationship Summary
v 2025.07
current
version history
v 2025.07
Annual update · disciplinary disclosures refreshsealed by M. Tanaka
Aug 03 · 2025
v 2024.07
Annual update · fee schedule expansionsealed by M. Tanaka
Jul 18 · 2024
v 2023.11
Interim · marketing rule alignmentsealed by D. Owens
Nov 02 · 2023
v 2023.07
Annual · CRD ↔ ADV reconciliationsealed by D. Owens
Jul 20 · 2023
v 2022.07
Initial · firm onboardingsealed by D. Owens
Jul 14 · 2022
sha-256 integrity hash · v 2025.07
9f4e · 88a3 · c2d1 · 7b6e · 03f7 · 1942 · 88c0 · be2a
SHA-256
Integrity hash on every sealed version
7+ yr
Retention by default · matches 204-2 minimums
100%
Deliveries proven · acknowledged or unread
Compliance document management for RIAs.
Compliance document management keeps every regulated document (policies, Form ADV, IMAs, KYC packets, trust docs, vendor agreements) versioned, hashed, and stored so an RIA can prove what existed and when. It is not Dropbox or SharePoint. The document itself is a record, held with its versions, deliveries, and signatures. RegFin builds the books-and-records evidence the SEC recordkeeping rule for advisers (Advisers Act Rule 204-2) requires, retaining each version on the tamper-evident write-once-read-many (WORM) storage examiners recognize from Exchange Act Rule 17a-4(f).
Prove what existed, and when.
Authoring, delivery, and sealing each leave their own record, so you can produce the exact version a client signed and show it never changed after.
Authoring & versioning
Draft, route for review, finalize, seal. Every save creates an immutable version with author, timestamp, and diff. The "current" pointer moves; nothing is ever overwritten.
- Draft → review → approval workflows
- Side-by-side version diff
- Required-reviewer rules per doc type
Delivery & acknowledgment
Send the doc through the right channel (portal, email, e-sign) with delivery, read, and acknowledgment captured as separate events. Each event is itself archived.
- Portal · email · e-sign
- Per-version delivery roster & status
- Re-deliver-on-update rules
Sealing & evidence
The moment a version is approved, it gets a SHA-256 hash and a WORM seal scoped to your firm. Producing it in audit shows the same hash: proof the document examiners are reading is the document advisors signed.
- SHA-256 integrity manifest
- WORM storage tier
- Tamper-evidence in every export
Five steps from draft to audit-ready evidence.
01 · Draft
Authoring
CCO drafts the policy update. Auto-save each keystroke; nothing is canonical yet.
draft.v17 · 9:14 am
02 · Review
Routing
Sent to the legal reviewer + CIO. Comments inline, redlines tracked, attribution sealed.
2 reviewers · 11 redlines
03 · Seal
Approval
CCO approves; system computes the SHA-256 and seals the version. Now immutable.
sha 9f4e…be2a sealed
04 · Deliver
Distribution
Affected clients get the new version as a secure link by email. Delivery events archived.
142 delivered · 138 read
05 · Evidence
Audit-ready
Manifest, hashes, version graph, delivery roster, acknowledgments. One export.
exam packet ready
The evidence layer an examiner will trust.
When an examiner asks for a document, you produce the exact sealed version and the proof it has not changed since. Retention, tamper-evidence, and reproducible exports come by default, so you never think about retention tiers, hash schedules, or how to demonstrate immutability. You produce the doc; we produce the proof.
- Write-once-read-many storage for every sealed version
- SHA-256 integrity manifest stamped at seal time, re-verified at every read
- 7-year retention default; configurable longer per firm policy
- Legal hold overrides retention and is itself audit-logged
- Reproducible exports: the same document, the same hash, every time
Integrity
SHA-256 hashing
Every sealed version is hashed at write time and re-verified at every read. Tamper is detected automatically.
Books & records
Rule 204-2
Required document classes mapped to RegFin record types; retention enforced per class.
Storage
WORM tier
Locked so records can't be changed or deleted · every version fingerprinted to prove integrity.
Encryption
AES-256 · KMS
At rest and in transit. Each firm's data is encrypted under its own key. Annual key-rotation audit.
Reports available under NDA on request · trust.regfin.com
The questions a counsel asks first.
For documents that matter to compliance (policies, client agreements, attestations, vendor contracts), RegFin replaces a DMS cleanly. Most firms keep a separate file-share for non-regulated content (HR docs, marketing files, internal memos) and use RegFin as the source of truth for regulated documents. The test: does this document need a version history an examiner could ask to see?
PDF, Word, Excel, PowerPoint, images, and most common formats are versioned and rendered in-app. RegFin stores the canonical file plus an extracted-text index for search. For Word and Markdown, you can edit in place; for PDFs and other static formats, you upload new versions.
When a version is approved, the app computes a SHA-256 hash of the file, signs it with a key unique to your firm, and writes both the file and signed hash to WORM-tiered storage. Reads recompute and verify the hash; if the storage layer drifts, verification fails and an alert fires. Examiners can independently verify the hash on any export.
Historic documents are imported during onboarding. Each is hashed and sealed at import time, with a clear marker that the seal date is the import date, not the original creation date. Provenance metadata (where it came from, when it was created, who signed it) is preserved as imported metadata. This is a real distinction examiners care about, and RegFin makes it explicit.
Yes. From the document admin: filter to a scope (a date range, a class, a client), trigger an export, receive a ZIP file containing the documents, a CSV index, and a JSON manifest with hashes, version history, and delivery events. The export is itself archived as a record of what was produced, when, by whom, and to what specification.
7 years for client-facing documents (Rule 204-2 floor), 7 years for internal policies and procedures, configurable longer per class. You cannot configure shorter than the regulatory floor without an explicit acknowledgment from the CCO that documents the policy decision. Legal hold overrides retention indefinitely.
See how it works with your documents.
See versioning, sealing, and exam production in a demo tailored to your firm.
Book a demo →