A conversation never splits across folders
One person's conversation has one folder, and neither a rename nor a change of key can split it into two.
This page describes the organisational service. For personal messaging, see ComplyChat Free, with its consumer terms and privacy notice.
Bring people together in a familiar chat. On paid plans, the lasting record files into your organisation’s connected Microsoft 365, ready for your people to search and produce.
Work messages live in your care homes and staff rooms, your frontline teams, your fundraising chats, your trustee and council boards. Personal phones, group chats, the back-channel everyone actually uses. Your data protection lead knows. Whoever minds your IT has tried to stop it. The conversations happen anyway – just outside everything you bought to keep the organisation safe.
Then one morning it surfaces. A solicitor's letter asks for "all messages about my mother". A safeguarding review needs a chat that sits on the personal phone of someone who left in March. An inspector asks how handover decisions are recorded, and the only honest answer is "on people's own phones".
You can spend another year fighting the culture. Or you can keep a record of the messaging your people will not give up – and give the board a record that is clean from the very first message.
The chats don't stop; they go quiet. Risk you could at least see becomes risk you can't, and the next incident arrives with "and they knew" attached to it.
Teams, Slack, a "secure messenger". People use it for a fortnight, the night shift never moves, the families never join. Now you run two places: one official and empty, one real and invisible. The lesson isn't that any one app is wrong – it's that forcing a new download never sticks. You need the right one for each group: a channel of your own for the board, work tools for staff, and a channel reached by a plain text for the families who'll never download anything new.
The cheapest option, right up until the morning it isn't. This strategy ends with a Subject Access Request, a tribunal order or an inspection finding – and it picks the date, not you.
One record, from wherever your people talk. Use a channel of your own for the board, so their record is clean from the first message – no other app in the middle, no separate number per group. Bring staff and inter-agency work onto Microsoft Teams – the system you already pay for. And for the families and frontline who'll never move, a channel that opens from a plain text, verified by SMS, with nothing to install. Keep every word, tell people it is on the record, and be ready to answer anything – wherever the conversation actually happens. Same habits, now on the record.
Pick what fits each group. A channel of your own for the board – the record is made in our system, with no number to register and nothing to install. Microsoft Teams for staff and inter-agency work. And for the families and frontline, a published number and a channel verified by text, so they message like any other contact – no app to install.
We set up each channel you've chosen and give you the words to send to staff and families. You manage who is in from one page: add someone in a click, remove them the moment they leave. Staff and inter-agency work answer from Microsoft Teams; families text a published number, verify by SMS, and land straight in the channel.
Each message is on the record the instant it is sent, and files into your own Microsoft 365 continuously – kept, held and easy to search under the same rules as your email, using the Microsoft controls your IT lead already runs. Everyone added to a channel is told it is on the record and can object or leave at any time – never in secret.
Subject Access Requests, safeguarding evidence, keeping records and holding them for a court – the records found in hours, not weeks, from every channel, in a permanent record kept in your own Microsoft 365. We run the channel and hold a working copy to operate it; the system of record you answer from is yours, never ours.
Everyone in ComplyChat is either staff or a guest. Staff see each other in the people list and can call each other. Guests – families, residents, clients, volunteers – never see that list, only the channels you put them in, and whether they can make voice or video calls is set on each channel.
Trustees and governors work in a channel of your own – the record is made in our system and lands in your own Microsoft 365. No other messaging app in the middle, no separate number per group, no risk of being thrown off someone else's platform. The cleanest setup we offer: nothing from Meta touches it.
Safeguarding between staff and across agencies, in a named Microsoft Teams channel – the record made in your own Microsoft 365. One person messages and it reaches your staff in Teams. One-to-one messages and whole-group replies both work from Teams.
One published number takes a plain text from anyone – prospects, families, the frontline. They verify by SMS in seconds and land straight in a channel built around the messaging habits people already have, with nothing to install and no account with anyone else. Every word is kept in your own Microsoft 365.


A channel of your own for the board, Microsoft Teams for staff and inter-agency work, and – for families and the frontline – a published number and a channel verified by text, in your organisation's name, not a volunteer's personal phone. Each one belongs to your organisation, so it lasts through staff coming and going, new phones and awkward exits.
Add and remove people from one easy page. When someone leaves, they're off every channel before they reach the car park. No more "who still has access to that chat".
Texts, photos, voice notes, recorded calls and documents – kept from every channel you run, your published numbers and Microsoft Teams alike – into your own Microsoft 365, not ours. Not a store you rent space in from a supplier: the record sits in the Microsoft 365 you already own, under your own rules for keeping, holding and searching, from day one. If you ever leave, there is nothing to hand back – the records were always yours.
Office staff and managers work from a named conversation inside Microsoft Teams – the record made in your own Microsoft 365, every word kept. Relatives never download anything new: they text your published number, verify by SMS, and land in the channel – and the board has a channel of its own too.
A Microsoft Teams channel carries a whole group, not just one line: a committee of six or a whole home, on the record from day one. And where the board wants a place of its own, a ComplyChat channel carries the whole group with no separate number at all.
If a text can't reach someone, or a message can't be delivered for any reason, the attempt itself is recorded: who didn't receive it, when, and why. Your evidence trail covers what didn't arrive as well as what did.
Start a request and search the record in your own Microsoft 365 with Microsoft Purview. Your own team blacks out what it must, puts it together and sends it within the month the law allows – ours on the call beside you if you want company. Built around ICO guidance, for the person whose name goes on the reply.
Messages are saved the instant they are sent – deleting a message in the app cannot pull it back out of the record – and a Microsoft 365 legal hold keeps them through any attempt to wipe them. An evidence trail your trustees can rely on.
Your permanent record of truth – the SAR-answerable, eDiscovery archive – lives in your own Microsoft 365, behind your own locks. Most products like this pool every client's permanent records in one vendor-owned vault; we never do. We run the channel and hold a working copy to operate it, kept for the life of your subscription unless you set a retention window of your own choosing, or, on Enterprise, held in a dedicated database rather than the shared one. A break-in at our end would expose recent operational conversation data, never a permanent, pooled archive of every client – because your authoritative record is in your own tenant, not on our servers.
Calls happen in the same channel, recorded end to end, with clear on-screen labelling so everyone on the call can see that audio and video are being recorded. The recording and its transcript file into your own Microsoft 365 – SharePoint holds them, and the Teams conversation carries the card that links to them – so a call is as answerable as a message.
Every contact has a person page – job title, team, profile photo – and the same face and name follow them consistently across chat, calls and read receipts. When it matters who said it, who saw it and who was on the call, the record shows a person, not a bare number.
Each channel's chat list folds every contact's messages into their own tidy thread, so a duty line with forty families reads as forty conversations, not one scrolling wall. Staff answer the right person first time, and the record keeps each conversation whole.
Every line can be shared as a link, printed as a QR poster for reception, or issued as an NFC tap-tag for a noticeboard or lanyard. One scan or tap, a quick SMS code, and someone is in the channel – verified, told it's on the record, and free to leave at any time. No app store in sight.
Reactions, replies, voice notes, photos and documents, polls and events, tasks and acknowledgements, location sharing, read ticks, presence – it feels like the messaging app your people already use, not a compliance form. The "+" beside the message bar offers Gallery, File, Location, Contact, Task, Acknowledge, Poll and Event; audio files are sent with File, and voice notes are the microphone in the message bar. Sharing a location is a one-off "here I am" pin, never continuous or background tracking. Use ComplyChat in your browser, or add it to your home screen. Our browser app (PWA) is the launch version. Apps for the App Store, Google Play and Microsoft Teams App Store are coming soon. Your staff can live in it too, or answer from Microsoft Teams if that's where they work – the record lands in your own Microsoft 365 either way.
A task is a message that asks named people in a chat to do something, and records whether they did. The sender chooses who it is for, what needs doing and when it is needed by; each of those people gets a Done button, and nobody else does. Marking it done posts nothing into the chat, so a task given to twelve people doesn't become twelve messages. When the sender seals the record – or the last person finishes – one line naming who did it and when is posted into the chat and filed into your own Microsoft 365. Once somebody has marked it done the task can no longer be edited: a record whose subject can still be rewritten is not evidence. If a time was set, everyone still outstanding is reminded an hour before, and again each day it stays overdue. In Settings, you can turn message and task notifications on or off separately for each organisation, across all your devices. Muting notifications leaves your chats and tasks in the app and does not silence calls. Working hours and priority contacts give you more control over out-of-hours push alerts. Reminders never carry the task's detail – they say only that something needs attention, so "collect Mrs Patel's prescription" never appears on a lock screen. And the person doing it doesn't need a Microsoft 365 licence, so a task can be given to a family member, a bank worker or a volunteer – and the record of who did what still lands in your own archive.
Tasks and acknowledgements live inside chats, and a chat scrolls. Outstanding gathers them across every channel into two halves – what others have asked of you, and what you have asked of others – with anything overdue pinned to the top of both. Each row names the chat, who asked, and how many people have finished; tapping one opens that chat at that exact message. It deliberately carries no buttons of its own: an obligation is discharged in the conversation it belongs to, so the record and the context that produced it stay together. It shows each person only what they can already see, reads records rather than creating any, and moves no data outside your own systems. It is one person’s own view of their own obligations, never a dashboard of a team’s work. Separately, an administrator signed into your portal can see what is still outstanding across the whole organisation – the same records, read-only, from the other side.
On the Governance tier, a compliance report for any completed quarter is a button in your portal – what was captured, how much of it is proven filed into your own Microsoft 365, who looked at what, what changed, what is still outstanding, and whether the tamper-evident access record still verifies end to end. It is drawn entirely from your own evidence trail, it names no message content, and a copy files itself into your own Microsoft 365 each quarter so the record of the report lives where the records do. Written for a trustee or a registered manager to read as it is.
Wellbeing
Choose the days and hours you work for each organisation. Outside those hours, push notifications for messages, tasks, reminders and incoming calls stay quiet across your devices.
You can choose priority contacts whose message and call alerts can still reach you outside those hours. Your other notification settings still apply.
Your conversations and tasks stay available in the app. Calls can still ring while you have the app open on screen.
Set it up: In Settings → Notifications, turn on Working hours only. Choose your working days, start and finish times, and any priority contacts. Times follow UK time (GMT/BST).
Your record, in your Microsoft 365
On paid plans, once your Microsoft 365 is connected and filing, conversations and native attachments land in a restricted SharePoint document library in your tenant. Search and export the lasting record with your own Microsoft Purview tools, under your retention rules.
No one's name or number is in a folder name. Participant folders use keyed pseudonyms; channel folders carry the readable channel name your organisation chose. Identity remains in the file contents so your authorised searches can find it.

We hold a working copy to operate the service. By default it lasts for your subscription, unless your organisation sets a retention window. Replay shows available operational conversation history; it does not replace searching the lasting archive in your Microsoft 365.
Recorded voice and video calls
Recording is required for voice and video calls. If recording has not gone active within about twenty seconds, the call ends for everyone and is filed as failed.
Before the call connects, both people see and accept a recording notice. A recording indicator stays on screen. The spoken announcement is on by default; either colleague can turn it off for a private one-to-one chat, while the on-screen notice and both accepted-recording taps remain.
On paid plans, recordings and transcripts file into your connected Microsoft 365. In Free, call captures are used for transcription and optional AI summaries, then removed under the Free retention policy. Core messaging, call transcription and AI summaries run in UK Azure; live-call routing and supporting services may process elsewhere, as our service-provider list explains.



Pre-call consent screen · Spoken in-call recording announcement
Permission, with a reason attached
Consent, naming recording first
Recording live, and everyone can see it
Afterwards the call card carries a short written summary. The summary is a labelled working aid and is never filed into the record. What files is the recording itself and its transcript.
The awkward cases
None of these is a headline feature. Each one is a decision somebody made about what happens in an awkward case: a message edited after it was sent, a photo that never arrived, a person who asked to be erased, a member of staff who left on Friday. They are the difference between a record and a folder of messages.
One person's conversation has one folder, and neither a rename nor a change of key can split it into two.
When media never arrived, the record says so in a marker file, rather than leaving a silent absence for somebody to find later.
An edited message files with its earlier versions attached, so the record holds the original as well as the correction.
Photos, files, voice notes and call recordings file as real files beside the record, each one verified by size and checksum.
Folder names below the channel level are derived from a phone number by a keyed hash, under a key that never changes, and a mismatch stops filing rather than starting a second folder.
Day chapters while the month is open, then one readable transcript for the whole month and an index CSV once it closes.
If our support team ever opens your message history or a captured file, it lands on your own tamper-evident feed, content-free, for your auditor to verify – and the people you named are emailed as it happens.
An operator access, an export, a change to retention, a break-glass entry or a sign-in anomaly does not wait for you to go looking: it sends an immediate email to the addresses you chose, and posts a card into your compliance channel. Those are the events people ask about first, but they are not the whole set – alerts also cover the administrative changes that decide who can see what: an administrator invited, their role changed or their access removed, calls switched on or off for a channel, a Microsoft Teams tenant connected or disconnected, the archive granted access to a site, a deletion request decided, and a change to the alert recipients themselves. The alert carries the event's one-line summary and never any content.
On the first of each month, a heartbeat naming how many human accesses happened in the month just ended is filed into your own Microsoft 365 and posted to your compliance channel. It is not an email.
Access we cannot otherwise get takes a written reason, and it is written to your own feed as a break-glass event – and your named recipients are told.
Each night, the new events on your feed are mirrored to a second, append-only copy of it, held under a locked immutability policy for 395 days. For the length of that window the copy can only be added to: we cannot edit it, and we cannot delete it. Like the feed itself it carries counts, ids and settings, never message content.
Nothing is ever purged from the working copy until the archiver has confirmed the write into your Microsoft 365, and the month has closed and rolled up.
One switch sets how long the working copy lives for the whole organisation: off by default, or 30, 90 or 180 days, one, two or three years, or a number you choose.
You ask, it is carried out across the working copy in one transaction, the staged media is hard-deleted, and you get a certificate for your DPO or your solicitor.
A message whose content has gone reads as captured and filed, then removed under your retention policy or erased on a request, never as a capture failure.
The portal says plainly that two copies exist: the working copy the app runs on, and the lasting archive in your own Microsoft 365, which retention never touches.
It names the site your record writes to, tells you that exactly one grant remains, and shows you how to revoke it yourself or move to a different site.
Your own administrators are on the record too: creating, renaming or closing a channel, adding or removing people, changing retention, all of it lands on your organisation's audit log and access feed.
Export one row per person for a chosen document or acknowledgement request, straight out of your portal.
One list on a member's own phone answering what is waiting on them and what they have asked of others, with anything overdue pinned above the rest.
A recorded call files with a plain-text transcript beside it, with speaker turns and timestamps, in your own Microsoft 365.
The database engine itself refuses to return or write another organisation's rows, whatever the application above it asks for.
Staff see one another. A guest sees the channels you put them in, never your directory and never another guest.
Every person who reaches a one-to-one line gets their own thread inside it, so guests on a safeguarding or family line never see each other or each other's messages.
In practice · Opening a board pack
A trustee opens a board pack. A Registered Manager opens a rota. A governor opens a safeguarding report. Every one of those, on the old arrangement, means a document landing in a personal Downloads folder and staying there. Here it opens inside the app, rendered on the device, on the same governed route the message came in on: PDF, Word, Excel, PowerPoint, CSV and plain text.
Word and PowerPoint render inside a locked-down frame, so a malformed file cannot reach the session it opened in. A file too large or too broken to preview lands on an honest card that says so and offers the download, rather than freezing the app and leaving somebody guessing.
We are not going to tell you the document can never leave. You can zoom it, share it to another app where the platform allows, and download it under its real filename. The claim is narrower and more useful than that: you do not have to. The default path for reading something is one that keeps it inside the record.
On the portal side, Replay shows photos inline and files as the app's colour-coded document chip, carrying the original filename, the type and the size.
Sandboxed office rendering · Document parse hardening · Document zoom; share and download · Replay media: images; documents and filenames
Word
Excel
PowerPoint
CSV
Plain text
Too large to preview
In practice · Reading a channel back
An administrator opens a read-only replica of the app's own chat screen for any channel, over a date range or across the whole record, closed channels included. Same wallpaper, same bubbles, same day pills, same order. Not an export of rows into a table: what the people in the conversation actually saw, which is what a reviewer is asking about.
Reading it is itself an access. Every time an administrator opens a conversation or one of its media items, that lands on the organisation's own audit log and access feed. Your own people are on the record too, which is the only version of this that survives being asked about.
The record Replay is reading is the same one filed into your own tenant, where Microsoft Purview indexes it, on your own licensing. That is the same tool your IT lead already uses for email, and the reason the record is filed there in the first place.
Replay wallpaper and chat replica skin · Replay access recorded to the client's own transparency feed
In practice · A deletion request
Here is the question every data protection lead asks within ten minutes, and most suppliers answer badly. If the record cannot be altered, how do you honour a deletion request? And if it can be altered, in what sense was it ever a record?
Both, and neither is a fudge. Before any erasure runs, every message of that person still waiting to be filed is force-filed first, including the ones the system deliberately holds back, so nothing escapes into a gap. Then each affected folder receives an append-only amendment: a new document that records the erasure, dated, beside the material it concerns. Nothing already filed is edited. Nothing is quietly removed. The record grows a correction rather than losing a page.
You ask; we carry it out across the working copy in a single transaction and hard-delete the staged media; and you get an erasure certificate, written for the person who has to put their name on the reply to a DPO or a solicitor.
Anywhere the content used to be, the app is honest about what happened: a message whose content has gone reads as captured and filed, then removed, never as a capture failure.
The working copy
The filed record
The amendment
A diagram, not a control. Erasure is a request you make to us and we carry out; there is no button for it in your portal.
The inventory
Everything above makes an argument. This is the inventory behind it, grouped the way the product is built. Nothing on this list is a roadmap item, a beta or a plan. If you are the person who will be asked whether it does a particular thing, this is the list to read, and the answer to anything not on it is that we will tell you plainly.
One honest note rather than a flattering summary. An AI call summary is a labelled working aid and is never filed into the record.
Ten minutes with our team. Bring your hardest case – the group nobody admits to, the leaver with two years of messages. In the first minute or two you'll be messaging in a real channel from your own phone; before we finish, a magic link signs you into your own client portal, where you can see your own record. Then a straight answer on whether we are right for you. Even if that answer is no.
The briefing: one page on the risks in your work messaging, written for boards. No follow-up unless you ask for one.
No pitch deck. We'll show you where the risks are in your work messaging, put a real channel on your own phone so you can message in it yourself, and finish by sending you a magic link that signs you into your own client portal – whether or not you buy.
A real human will reply within one working day with times for your ten-minute demo. If it's urgent, write to enquiries@chat.org.uk.