Producing the record is easy. Proving nobody touched it is the part that fails.

Integrity here means something narrower than "we have backups". It means being able to show, from system-generated evidence rather than testimony, that a record has not changed since it was committed. Four mechanisms carry most of that weight.

• Write-once commitment at ingest. The retention attribute is set when the record is written, by the application that owns it, not applied later by an administrator running a script. A period applied retrospectively proves nothing about the interval before it was applied.
• Content fixity. A checksum computed at write and re-verified on a schedule, with the verification results themselves retained. Fixity that is calculated only on read tells you the copy you just read is internally consistent, which is a much weaker statement.
• Refused-operation logging. Records of deletion and modification attempts that the platform declined. This is the strongest evidence available, because it shows the control operating rather than merely being configured.
• Configuration history. Proof that the policy was in force across the whole claimed period. A current settings export demonstrates today only.

None of this makes a record impossible to destroy. Media can be physically removed, an entire volume can be decommissioned, and a sufficiently privileged insider with physical access has options. Retention-locked storage is designed to prevent alteration through the data path and to leave a trail when someone tries. It reduces risk. It does not eliminate it, and any supplier claiming otherwise should be pressed on the failure modes.

Transaction records are the well-understood half. The harder half is everything surrounding a trade: voice recordings, chat, email, and increasingly messaging platforms that were adopted by a desk before anyone asked where the archive was.

Communications data has properties that transaction data does not:

The last row is the one that causes incidents. Retention scope is defined against the channels an institution believes it operates. Discovery of an unarchived channel during an investigation is worse than having no policy, because it demonstrates the policy was not enforced.

Voice is also where capacity assumptions break. A trading floor recording continuously produces a steady volume that dwarfs the transaction records generated on the same day, and unlike transactions it compresses poorly if the retention requirement is for the original audio rather than a transcript.

The following arithmetic is constructed to make a point about design, not measured from any institution.

Take a mid-sized bank producing 4.2 million transaction records a day across cards, payments and core banking, on 250 processing days a year, with an average record of 8 KB, retained for seven years.

• Annual record count: 4,200,000 × 250 = 1.05 billion records per year
• Seven-year record count: 1.05bn × 7 = 7.35 billion records
• Annual capacity: 1.05bn × 8 KB = 8,400,000,000 KB ≈ 8.4 TB per year
• Seven-year capacity: 8.4 × 7 = 58.8 TB

Fifty-nine terabytes is not a difficult storage problem. Any of several platforms holds it comfortably. Seven point three five billion individually addressable, individually retention-locked, individually searchable objects is an entirely different problem, and it is a metadata problem.

Work through the consequence. If the archive catalogue carries 400 bytes of metadata per object (identifier, dates, retention class, checksum, hold state, location), that is 7.35bn × 400 bytes ≈ 2.9 TB of index, which now needs its own performance tier, its own backup and its own recovery time objective. If a legal hold has to be applied to a subset defined by counterparty and date range, the query runs against those billions of index rows, not against the 59 TB of data.

This is why financial archive designs that were sized on capacity alone tend to fail at year three or four. The storage kept up. The catalogue did not. Consolidating records into larger container objects with an internal index is the usual mitigation, and it has to be decided before ingest begins, because restructuring 7 billion objects afterwards is a multi-year exercise. How the catalogue is structured is covered under archive management software.

If one administrator can both modify archived data and edit the log that records modifications, the log has no evidential value. That single sentence rules out a surprising number of otherwise reasonable architectures.

Practical separations worth insisting on:

1. The audit trail is written to a retention-locked target that the storage administrator cannot alter, ideally a different system with a different credential set.
2. Retention policy changes require a second authorisation, and the change itself is logged to that same protected target.
3. Privileged access to the archive is time-bound and requested, not standing.
4. The person who can release a legal hold is not the person who can delete expired records.

None of this is exotic. It is the same control thinking applied to payments, extended to the archive, which is often the last system in a bank to receive it.

Regulatory questions are usually not "give us this record". They are "show us the position on this date" or "reconstruct this client's activity across this quarter". That is a query, and it depends on whether the archive kept the relationships between records or only the records.

Legal hold sits on top of all of it and overrides expiry entirely. A hold is not a longer retention period. It is a separate state that blocks disposition until released, holds must be tracked individually so that a record under two holds stays frozen when one is lifted, and every application and release needs an authorising name and timestamp. The mechanics are set out on regulatory data retention.

Over-retention is also a risk. Data kept past its period remains discoverable and still has to be secured. Disposal that cannot be evidenced is barely better than no disposal at all.

Institutions with comparable evidential pressure include telecommunications operators handling call detail records and public bodies with disposal authority constraints. See the industries overview, or request an assessment with your record counts rather than your capacity figures.