If you are truly going to do this for compliance then the best and only “compliant” way is to use a Third Party. This is in keeping with the SEC/NASD rule. The requirements are that the e-mails are off site in the event the SEC/NASD wanted to obtain them and the Broker/Dealer refused.
Check out the SEC/NASD compliance rule on this. We have used both EVault as well as Frontbridge.
Let me know if you need me to dig up the regs.