If a regulator asked whether a message sitting in your archive is genuinely authentic, could you prove it? Not just produce it, but show where it came from, when it was captured, and whether anything about it has changed since? For most compliance teams, that question is harder to answer than it should be.