Producing records for a legal request

Before you search, before you export, before you finish reading the request. A hold excludes matching records from every deletion path at once: retention expiry, erasure requests, and post-cancellation purge alike.

The reason for the order is that the alternative is irreversible. If a retention window closes while you are still gathering, or someone submits an erasure request for the same contact, the record’s encryption key is destroyed and no one can recover it — not you, and not us. A hold is cheap and can be released in a moment. A shredded record cannot be unshredded.

Hold on a contact rather than a conversation and it covers every conversation that contact appears in, which is usually the right scope for a dispute with one customer. The reason you type is written to the audit log, and that reason is frequently the thing a court asks to see.

Search the archive by customer name, conversation subject, tag, record type or date range.

Message content is not searchable, and it is worth knowing why before you plan a search. Transcripts exist only as encrypted objects; they are never written to our database in readable form. That is what makes a database compromise worthless to an attacker, and the cost of it is that you cannot query for a phrase.

In practice this rarely blocks anything. Widen, then narrow locally: export the customer or the date range as JSON, and search the file. The limitation moves content search to your machine rather than preventing it.

Opening a record shows the full exchange as archived — every message, with its timestamp and its author, and whether that author was a teammate or the customer.

Alongside it sits the provenance panel: record type, the original Intercom ID, the archive version, when the snapshot was taken, and when the conversation was created in Intercom. The checksum is verified as the record is read, so a record that did not match what was stored would fail to display rather than display something misleading.

Where Intercom returned only part of a very long thread, the record says so and says which part is missing — including whether the opening of the conversation is absent. A transcript that looks complete but is not is worse than one labelled honestly.

• PDF — what you hand to counsel, a regulator or a court. Readable, with attribution and timestamps.
• JSON — structured, for e-discovery tooling or for searching locally.
• CSV — tabular summaries.

Scope an export to specific records you have selected, or to a whole tag or date range. Every record in the bundle carries the checksum it was stored with, so whoever receives it can verify for themselves that nothing changed after it left us.

Download links are signed and expire after five minutes, and the bundle itself is deleted after seven days. That is deliberate — an export sitting in object storage indefinitely is a copy of your archive without your archive’s protections. Download it and put it in the matter file.

This is the step most people miss, and it is often the one that decides whether the transcript is useful.

The transcript says what was said. The audit log says the record has existed untouched since it was captured, and shows exactly who viewed, searched, exported or downloaded it, and when. That is your chain of custody, and you can export it as CSV.

Verify the chain before you export it. Each entry is hashed together with the hash of its predecessor, so a verified chain demonstrates that no entry has been altered, removed or reordered since it was written — and the database rejects updates and deletes on that table outright, so there is no path by which it could have been.

If opposing counsel asks how you know the transcript was not edited before disclosure, this is the answer. Exporting is itself recorded, so the log also shows what you produced and when.

Holds do not expire on their own; that is the point of them. When the matter is over, release the hold deliberately and record why. The release is written to the audit log alongside the original reason, so the file shows both why the records were preserved and why preservation ended.

Until then the records stay outside every deletion path, including erasure requests. If someone asks to be erased while a hold covers their conversations, those records are preserved and reported back to you as held rather than silently skipped — so the conflict surfaces and you can decide, rather than discovering it later.

• Undo a crypto-shred. Once a record’s key is destroyed the ciphertext is unreadable permanently. There is no escrow and no recovery path. This is why step 1 is step 1.
• Recover what Intercom never gave us. If a conversation was deleted in Intercom before its first backup, it was never archived. Converight protects everything from the moment you connect onwards.
• Shorten a retention period already applied. Records keep the retain-until date they were locked with. Object Lock will not permit shortening it, by us or by anyone.