It starts with
a conversation.

Every person who reaches a one-to-one line gets their own thread inside it, so guests on a safeguarding or family line never see each other or each other's messages.

A task is a message that asks named people in a chat to do something, and records whether they did. The sender chooses who it is for, what needs doing and when it is needed by; each of those people gets a Done button, and nobody else does. Marking it done posts nothing into the chat, so a task given to twelve people doesn't become twelve messages. When the sender seals the record – or the last person finishes – one line naming who did it and when is posted into the chat and filed into your own Microsoft 365. Once somebody has marked it done the task can no longer be edited: a record whose subject can still be rewritten is not evidence. If a time was set, everyone still outstanding is reminded an hour before, and again each day it stays overdue. In Settings, you can turn message and task notifications on or off separately for each organisation, across all your devices. Muting notifications leaves your chats and tasks in the app and does not silence calls. Working hours and priority contacts give you more control over out-of-hours push alerts. Reminders never carry the task's detail – they say only that something needs attention, so "collect Mrs Patel's prescription" never appears on a lock screen. And the person doing it doesn't need a Microsoft 365 licence, so a task can be given to a family member, a bank worker or a volunteer – and the record of who did what still lands in your own archive.

Tasks and acknowledgements live inside chats, and a chat scrolls. Outstanding gathers them across every channel into two halves – what others have asked of you, and what you have asked of others – with anything overdue pinned to the top of both. Each row names the chat, who asked, and how many people have finished; tapping one opens that chat at that exact message. It deliberately carries no buttons of its own: an obligation is discharged in the conversation it belongs to, so the record and the context that produced it stay together. It shows each person only what they can already see, reads records rather than creating any, and moves no data outside your own systems. It is one person’s own view of their own obligations, never a dashboard of a team’s work. Separately, an administrator signed into your portal can see what is still outstanding across the whole organisation – the same records, read-only, from the other side.

Reactions, replies, voice notes, photos and documents, polls and events, tasks and acknowledgements, location sharing, read ticks, presence – it feels like the messaging app your people already use, not a compliance form. The "+" beside the message bar offers Gallery, File, Location, Contact, Task, Acknowledge, Poll and Event; audio files are sent with File, and voice notes are the microphone in the message bar. Sharing a location is a one-off "here I am" pin, never continuous or background tracking. Use ComplyChat in your browser, or add it to your home screen. Apps are available on the App Store and Google Play. The Microsoft Teams store app is coming soon. Your staff can live in it too, or answer from Microsoft Teams if that's where they work – either way, paid plans meet your retention schedules within your own Microsoft 365 subscription.

No one's name or number is in a folder name. Participant folders use keyed pseudonyms; channel folders carry the readable channel name your organisation chose. Identity remains in the file contents so your authorised searches can find it.

On paid plans, calls are recorded by default. Your organisation can switch recording off for a channel, and for direct one-to-one calls (including those between staff and the people they share a channel with), in the client portal, and both people are told before a call connects whether it is recorded. A call that is not recorded keeps only who took part, when and for how long, and both people's acceptance taps. On a channel that records, recording is required: if recording has not gone active within about twenty seconds, the call ends for everyone and is filed as failed. Free calls are not recorded.

Each night we also append the feed's new events to a separate copy held under a locked immutability policy. For 395 days from when that copy was first created, we cannot edit or delete it. Like the feed itself it carries counts, ids and settings, never message content. It is not a backup of your messages.

An operator access, an export, a change to retention, a break-glass entry or a sign-in anomaly does not wait for you to go looking: it sends an immediate email to the addresses you chose, and posts a card into your compliance channel. Those are the events people ask about first, but they are not the whole set – alerts also cover the administrative changes that decide who can see what: an administrator invited, their role changed or their access removed, calls switched on or off for a channel, call recording switched on or off for a channel or for direct one-to-one calls, a Microsoft Teams tenant connected or disconnected, the archive granted access to a site, a deletion request decided, and a change to the alert recipients themselves. The alert carries the event's one-line summary and never any content.

The text that carries a sign-in code says never to share it, and that nobody from ComplyChat or your organisation will ever ask for it; in the browser app, the sign-in screen says the same. Every new sign-in, and every passkey added, sends an alert to the member's other devices that have notifications turned on, and recent sign-ins are listed in Settings > Devices. Adding a passkey needs a code texted to the member's own number within the last ten minutes. Sign out everywhere signs a member out on every device, removes their passkeys and cancels their sign-in links, and "Someone else may have access to my account" does the same and, on paid plans, tells your organisation. From the client portal, an administrator can sign a member out of all their devices – their passkeys go too – while they stay a member, with the same channels and roles. Removing someone from your organisation also signs them out and removes their passkeys.

Yes. An administrator can review one account over a period you choose – its sign-ins and devices, the conversations it was in and what it sent – and list everyone who shared a channel or direct message with it, with a download so you can contact them. Like Replay, it is open only to administrators with the admin role, and viewing it and exporting the list are both recorded on your access feed.

It depends on the channel. On an open line, anyone a join link is shared with can use it, once a text code confirms their number. On a closed channel, a QR poster or shared link lets in only people your organisation has already added, and anyone else is asked to have the organisation add them; new people come in by invitation instead. A texted invitation works only for the person it was sent to, and a channel admin’s invite link works for whoever uses it until it expires. Someone an administrator or channel admin removes is asked to wait for approval instead of rejoining through a link. Your administrators can see who made the link a person joined through, or who added or approved them, and can withdraw any join link at any time: a withdrawn link stops working at once.

Members can report a message, or a person, and say why: someone asking for a sign-in code, asking for money, or pretending to be someone else. The report reaches your administrators in the Safety pane of your client portal and on your access feed, and, like the other alerts, by email to the addresses you chose and a card in your compliance channel. Only the first few reports in an hour – from one account, or across your organisation – become alerts; every report still reaches the portal. The person reported is not told.

Your organisation chooses, in the client portal: anyone in a shared channel, staff only, or nobody. Conversations already under way carry on, and stay on the record. A call from the people directory takes place in a direct message, so with Nobody chosen it can only reach someone the caller already has one with.

Tapping a link to anywhere outside ComplyChat first shows the site it really opens, and its full address, so you can choose whether to open it. A message from another member that asks for a sign-in code or for money carries a short caution, such as "Never share a sign-in code, even with a colleague." The cautions are checks on the wording, so they will not catch every request. Your phone number stays private from other members. People appear by name, and staff can see a Guest label for people outside the organisation.

We are not going to tell you the document can never leave. You can zoom it, share it to another app where the platform allows, and download it under its real filename. The claim is narrower and more useful than that: you do not have to. The default path for reading something is one that keeps it inside the record.