A regulator asks what your website said about a fund’s fees on a specific date last year. Your team finds a scheduled screenshot from that week and a PDF someone saved to a shared drive. Neither shows who captured it or whether it has changed since, and neither shows what sat below the visible part of the page.
This is where website archiving and preservation part ways. Both keep copies of web content. Preservation adds the controls that let a copy stand up as evidence when a regulator or a court looks closely.
Website archiving keeps copies of web pages over time. Preservation keeps those copies in a form that can be proven authentic: stored so they can’t be altered, and tied to the metadata of the original capture. A scheduled screenshot tool archives. A preservation system can show a regulator when a page was captured and prove that nothing has changed since.
The distinction matters most in regulated industries. Broker-dealers preserving records under SEC Rule 17a-4 must use a system that meets the WORM requirement or the audit-trail alternative the SEC added in 2022. FINRA Rule 2210 treats public websites as communications with the public, with their own recordkeeping requirements.
The five tests below show whether your web archive stores pages or preserves records that will hold up in a regulatory audit.
A defensible web archive lets you revisit the site, replay each page as it appeared, and prove when it was captured. Replay is where many archives fall short. Dropdowns, sliders, expandable text and embedded video often don’t replay, and some archives fill a missing resource from a capture made on a different date. One replayed page can then mix content from several points in time, which can’t show what a visitor saw on the date in question. The proof sits in the capture metadata: the URL, the capture timestamp, and the WARC record holding the page source.
The archive also stores each capture so it can’t be overwritten or deleted. Under the 2022 amendments to Rule 17a-4(f), broker-dealers can meet the requirement with WORM (write once, read many) storage or with an audit-trail alternative that allows the original record to be recreated if it is altered, overwritten, or erased.
Either way, the archive needs two things beyond storage. A cryptographic hash, such as SHA-256, generated at the moment of capture lets anyone confirm later that the file still matches what was collected. An audit trail logs every action taken on the record, from capture through review and export, with who did it and when. Together they form the chain of custody a regulator will ask to see.
Chronicle builds both into every capture. Each page is written to WORM storage with a SHA-256 hash generated on collection, and the audit trail tracks each step through review and export.
Modern websites build pages in the browser. Content loads through JavaScript, menus expand on click, disclosures sit behind tabs, and some elements change by region or device. A crawler that collects only the raw HTML misses much of it, and a screenshot records only the visible part of the page.
Capture quality is often the first thing a regulator tests, even without saying so. If the archived page is missing the fee table due to a filter or a tab added, or due to the risk disclosure below it, the record is incomplete however securely it is stored.
A defensible capture also keeps the original metadata: the URL, the capture timestamp, the HTTP headers the server returned, and every resource the page loaded. That metadata is what proves when and where the content was published.
Chronicle is built to capture dynamic content, including elements loaded by JavaScript and interactive features, and keeps the original capture metadata with every record.
WARC, the Web ARChive format, is the international standard for web preservation, published as ISO 28500 (current version ISO 28500:2017). A WARC file stores the full HTTP request and response for each resource alongside its metadata, and it is the format the Internet Archive and national libraries use.
A standard format helps in an audit in two ways. It gives the regulator a documented structure to rely on, so the firm isn’t defending a proprietary file. It also keeps the record usable if the firm changes vendors, since independent tools can read and replay WARC files.
Records exported to PDF or image files lose the request and response data, and with it much of the evidence of how the page was served.
Chronicle stores every capture natively in WARC, so the full request and response data stays with the record for as long as it is retained.
Reviewers need to see a page the way a visitor did: scroll, click through links, open tabs, and follow the path from a landing page to the disclosure. Replaying the preserved capture lets them do that, and it gives counsel a version of the page they can put in front of a regulator or a court.
A static image answers a narrower question. It shows what appeared in one frame and can’t show what happened when someone clicked.
Chronicle replays preserved captures as working replicas of the original pages, so reviewers and counsel can navigate them the way visitors did.
Scale matters here too. One investment management firm has archived 299.5 million pages with Chronicle over seven years of daily crawls, and any of those captures may be the one a regulator asks about.
When the SEC requests records, Rule 17a-4(f) requires broker-dealers to furnish them in a reasonably usable electronic format. In practice, regulators and outside reviewers usually need to examine a handful of captures from a specific period.
A defensible archive allows limited, read-only access scoped to a matter or date range, with every view logged in the audit trail. The records stay in place and unaltered while the reviewer works. When an export is needed, it should come in a format the regulator accepts, with the hash values and metadata attached so the copy can be checked against the original.
Chronicle lets firms give regulators limited review access to the captures they need, with each view recorded in the audit trail, and exports records in formats suited to regulatory production.
Websites are one of several channels regulators review, and email and chat records face the same questions: can the firm prove the record is unaltered with its original metadata intact, and can it be reviewed where it sits?
Chat data is even more dynamic and constantly changing, therefore harder to keep intact. Edit history, thread structure, and participant details live inside the platform, and exporting or migrating the data can strip them away. Some content can’t be held in place at all. Slack’s legal holds don’t cover Slack Connect channels, the shared channels firms use with clients, vendors, and other outside parties. Those conversations have to be preserved separately and held to the same defensible standard as the rest of the archive. Illuminate preserves Slack and other collaboration data in context, with its metadata intact.
Chronicle preserves websites and social media in WARC format with SHA-256 hash values for every capture.
If your archive can’t pass all five tests, talk to the Hanzo team about closing the gap.
Hanzo
N/a
© Hanzo 2026 | All Rights Reserved.