∞
— Versions kept · no truncation, ever
Documents · versioned, sealed, evidenced
Every document, every version, every signature.
Policies, ADV Part 3, IMA, KYC packets, trust docs, vendor agreements: versioned the moment you save them, hashed before they're delivered, sealed against tampering, and tied to who signed what when.
Form ADV Part 3 · Client Relationship Summary
v 2025.07
— current
— version history
v 2025.07
Annual update · disciplinary disclosures refresh— sealed by M. Tanaka
Aug 03 · 2025
v 2024.07
Annual update · fee schedule expansion— sealed by M. Tanaka
Jul 18 · 2024
v 2023.11
Interim · marketing rule alignment— sealed by D. Owens
Nov 02 · 2023
v 2023.07
Annual · CRD ↔ ADV reconciliation— sealed by D. Owens
Jul 20 · 2023
v 2022.07
Initial · firm onboarding— sealed by D. Owens
Jul 14 · 2022
— sha-256 integrity hash · v 2025.07
9f4e · 88a3 · c2d1 · 7b6e · 03f7 · 1942 · 88c0 · be2a
SHA-256
— Integrity hash on every sealed version
7+ yr
— Retention by default · matches 204-2 minimums
100%
— Deliveries proven · acknowledged or unread
Compliance document management for RIAs
Compliance document management keeps every regulated document (policies, Form ADV, IMAs, KYC packets, trust docs) versioned, hashed, and stored so an RIA can prove what existed and when. RegFin builds the books-and-records evidence the SEC recordkeeping rule for advisers (Advisers Act Rule 204-2) requires, retaining each version on tamper-evident WORM storage.
Three jobs · one document store
What "documents" means in a compliance system.
Not Dropbox. Not SharePoint. A purpose-built store where the document itself is one of many records: its versions, its deliveries, its signatures, its referencing policies.
Authoring & versioning
Draft, route for review, finalize, seal. Every save creates an immutable version with author, timestamp, and diff. The "current" pointer moves; nothing is ever overwritten.
- Draft → review → approval workflows
- Side-by-side version diff
- Required-reviewer rules per doc type
Delivery & acknowledgment
Send the doc through the right channel (portal, email, e-sign) with delivery, read, and acknowledgment captured as separate events. Each event is itself archived.
- Portal · email · e-sign
- Per-version delivery roster & status
- Re-deliver-on-update rules
Sealing & evidence
The moment a version is approved, it gets a SHA-256 hash and a WORM seal scoped to your firm. Producing it in audit shows the same hash: proof the document examiners are reading is the document advisors signed.
- SHA-256 integrity manifest
- WORM storage tier
- Tamper-evidence in every export
The journey of a single document
Five steps from draft to audit-ready evidence.
— 01 · Draft
Authoring
CCO drafts the policy update. Auto-save each keystroke; nothing is canonical yet.
— draft.v17 · 9:14 am
— 02 · Review
Routing
Sent to the legal reviewer + CIO. Comments inline, redlines tracked, attribution sealed.
— 2 reviewers · 11 redlines
— 03 · Seal
Approval
CCO approves; system computes the SHA-256 and seals the version. Now immutable.
— sha 9f4e…be2a sealed
— 04 · Deliver
Distribution
Affected clients get the new version as a secure link by email. Delivery events archived.
— 142 delivered · 138 read
— 05 · Evidence
Audit-ready
Manifest, hashes, version graph, delivery roster, acknowledgments. One export.
— exam packet ready
WORM · Rule 204-2 books & records
The evidence layer an examiner will trust.
An RIA's records are governed by the Advisers Act books-and-records rule, Rule 204-2, which expects retention, tamper-evidence, and reproducibility. The write-once-read-many (WORM) media standard examiners recognize comes from Exchange Act Rule 17a-4(f). RegFin's document store meets both by default.
You don't have to think about retention tiers, hash schedules, or how to demonstrate immutability. You produce the doc; we produce the proof.
- Write-once-read-many storage for every sealed version
- SHA-256 integrity manifest stamped at seal time, re-verified at every read
- 7-year retention default; configurable longer per firm policy
- Legal hold overrides retention and is itself audit-logged
- Reproducible exports: the same document, the same hash, every time
— Integrity
SHA-256 hashing
Every sealed version is hashed at write time and re-verified at every read. Tamper is detected automatically.
— Books & records
Rule 204-2
Required document classes mapped to RegFin record types; retention enforced per class.
— Storage
WORM tier
Locked so records can't be changed or deleted · every version fingerprinted to prove integrity.
— Encryption
AES-256 · KMS
At rest and in transit. Each firm's data is encrypted under its own key. Annual key-rotation audit.
— Reports available under NDA on request · trust.regfin.com
FAQ
The questions a counsel asks first.
For documents that matter to compliance (policies, client agreements, attestations, vendor contracts), RegFin replaces a DMS cleanly. Most firms keep a separate file-share for non-regulated content (HR docs, marketing source files, internal memos) and use RegFin as the source of truth for regulated documents. The line between the two is the question "does this document need a version history an examiner could ask to see?"
PDF, Word, Excel, PowerPoint, images, and most common formats are versioned and rendered in-app. RegFin stores the canonical file plus an extracted-text index for search. For Word and Markdown, you can edit in place; for PDFs and other static formats, you upload new versions.
At the moment a version is approved, the application computes a SHA-256 hash of the file content, signs it with a key unique to your firm, and writes both the file and the signed hash to WORM-tiered storage. Subsequent reads recompute and verify the hash. If anything in the storage layer were to drift, the verification fails and an alert fires. Examiners can independently verify the hash on any export.
Historic documents are imported during onboarding. Each is hashed and sealed at import time, with a clear marker that the seal date is the import date, not the original creation date. Provenance metadata (where it came from, when it was created, who signed it) is preserved as imported metadata. This is a real distinction examiners care about, and RegFin makes it explicit.
Yes. From the document admin: filter to a scope (a date range, a class, a client), trigger an export, receive a ZIP file containing the documents, a CSV index, and a JSON manifest with hashes, version history, and delivery events. The export is itself archived as a record of what was produced, when, by whom, and to what specification.
7 years for client-facing documents (Rule 204-2 floor), 7 years for internal policies and procedures, configurable longer per class. You cannot configure shorter than the regulatory floor without an explicit acknowledgment from the CCO that documents the policy decision. Legal hold overrides retention indefinitely.
Documents that hold up in exam
See how it works with your documents.
See versioning, sealing, and exam production in a demo tailored to your firm.
Book a demo →