danielsaltman

<!– Replace the following line with this: –>

Overview <!– Replace the following line with this: –>

<!– Replace the following line with this:
–>

<!– Replace the following line with this:
–>

<!– table of contents: uses nested tables instead of

–>

<!– Replace the following line with this: –>

Table of Contents <!– Replace the following line with this: –>




<!– Replace the following line with this: –>

<!– Replace the following line with this: –> Analysis 1.0 The Three Faces of E-Mail Archiving 1.1 Compliance/Records Retention/Supervision 1.2 Legal Discovery 1.3 Mail Server Data Management 2.0 The Hosted E-Mail Value Proposition and Vendor Challenges 2.1 The Benefits of Outsourcing E-Mail Archiving 2.2 Vendor Solutions — An Expanded Range of Options 2.3 Vendor Challenges 3.0 Comparing Service Provider Pricing the Gartner Way 4.0 Selected Hosted E-Mail Archiving Service Providers 4.1 Autonomy Zantaz — Pleasanton, California, U.S. 4.1.1 Strengths 4.1.2 Challenges 4.2 Global Relay — Vancouver, British Columbia, Canada 4.2.1 Strengths 4.2.2 Challenges 4.3 Google — Mountain View, California, U.S. 4.3.1 Strengths 4.3.2 Challenges 4.4 Iron Mountain Digital — Boston, Massachusetts, U.S. 4.4.1 Strengths 4.4.2 Challenges 4.5 LiveOffice — Torrance, California, U.S. 4.5.1 Strengths 4.5.2 Challenges 4.6 MessageOne — Austin, Texas, U.S. 4.6.1 Strengths 4.6.2 Challenges 4.7 Microsoft — Redmond, Washington, U.S. 4.7.1 Strengths 4.7.2 Challenges 4.8 Mimecast — London, U.K. 4.8.1 Strengths 4.8.2 Challenges 4.9 Perimeter eSecurity — Milford, Connecticut, U.S. 4.9.1 Strengths 4.9.2 Challenges 4.10 Proofpoint — Sunnyvale, California, U.S. 4.10.1 Strengths 4.10.2 Challenges 4.11 Smarsh — Portland, Oregon, U.S. 4.11.1 Strengths 4.11.2 Challenges

<!– Replace the following line with this:
–>






<!– Replace the following line with this: –>

List of Tables <!– Replace the following line with this: –>

<!– Replace the following line with this:
–>



	Table 1.	E-Mail Archiving Requirements Checklist




<!– Replace the following line with this: –>

List of Figures <!– Replace the following line with this: –>

<!– Replace the following line with this:
–>



	Figure 1.	E-Mail Archiving Outsourced Market

<!– Replace the following line with this: –>

Analysis <!– Replace the following line with this: –>

<!– Replace the following line with this:
–>



In 2003, Gartner chronicled the advent of e-mail archival service providers. That perspective examined a whole new category of service providers founded primarily to help companies meet regulatory requirements related to preserving electronic communications. At the time, only two service providers, Iron Mountain and Zantaz (acquired by Autonomy in 2008), fit the category. Since then, many new companies have announced hosted e-mail archiving as stand-alone services or in conjunction with other services. SaaS is gaining increased market acceptance as service providers address the concerns about data security and establish selling partnerships with large vendors to reduce viability concerns. While several of the featured service providers offer very basic capabilities, others have continued to raise the bar and have worked to compete more aggressively in larger accounts by adding attachment management and improved discovery tools. Gartner believes increased competition is inherently good for users, because it gives them more choices and generally promotes lower prices. The challenge becomes sorting out different vendor pricing models and the value of the services delivered measured in conjunction with service capabilities, service levels and quality of service. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 1.0 The Three Faces of E-Mail Archiving Most organizations and businesses looking for an archiving solution for e-mail are motivated by one or more of the following three reasons: Compliance/records retention/supervision Legal discovery Mail server data management <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 1.1 Compliance/Records Retention/Supervision Most companies and organizations are mandated to retain records of the business. Highly regulated industries generally must comply with industry-specific as well as general business and geography-specific requirements that relate to retention of business records and, in some cases, supervision of employee communications with customers. For example, broker-dealers in the financial services sector must comply with Securities and Exchange Commission (SEC) Rule 17a and self-regulating requirements of the Financial Industry Regulatory Authority (FINRA); see Note 1. These regulation not only define the kinds of records to be retained but also require supervision of communications to ensure that brokers are acting within mandated guidelines. Government agencies and state and local governments must also retain and make available records, including e-mail communications. The Sarbanes-Oxley (SOX) Act highlighted the need to include electronic records as part of the retention plan for keeping records of the business. A similar regulatory focus and rules update has occurred in countries around the world. With the exception of the SEC and FINRA, there is currently little clarity around the required process for retention and, in many cases, even the length of time e-mail must be maintained. Determining which e-mails meet the definition of a record is also often unclear; thus relying on each e-mail user to identify and retain the appropriate messages requires a clear classification policy, careful training, and supervision to ensure that all required records are retained. Some companies are blocked from moving forward with archiving projects as negotiations on policy and practices are debated. Some have decided to save every e-mail, just to be safe. A few have developed classification policies and are working to see how reliable users are in identifying corporate records. Few e-mail archiving software and service companies will provide records policy development or legal advice. Specialty law firms and consulting firms have developed practices specifically to help companies to research regulations and develop policies. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 1.2 Legal Discovery Legal discovery is related to compliance in that information retained by the business or agency can be subject to disclosure. In late 2006, the U.S. Federal Rules of Civil Procedure (FRCP) were revised to better address the requirements relating to the retention and discovery of electronically stored information (ESI) and its production in the discovery process. This update highlighted the responsibility of corporate management to understand how records are stored and managed. CIOs and other IT managers are now being asked to help support corporate efforts to document record-retention policies and to provide detailed information about related IT processes, while, at the same time, trying to cope with growing data volume. The implementation of the revised FRCP rules has served as a wake-up call to corporate legal teams that has them driving their companies to move quickly to bring electronic records management under control. Over the past several years, there has been a surge in market activity around electronic discovery (e-discovery). Although the update to the FRCP clarifies that discovery extends to any type of digital data, e-mails have been a common target in legal discovery. There is a tug of war going on within companies with some constituencies looking to delete all e-mail within a very short time to reduce risk while others are concerned about destroying valuable corporate information. Monitoring and content filtering is being used to supervise proper e-mail use and to identify potential problems before a legal situation arises. Since it is difficult to delete all copies of an e-mail, some companies find retaining all e-mail provides important information when preparing for a case. A key part of any archiving solution is the deletion of data when it reaches the end of its defined retention period. When companies are involved in legal situations, they may need to suspend the deletion of data per a court order —which is referred to as putting the data on “legal hold.” Most archiving service providers look to meet the legal hold requirement by copying the impacted data to a case file for retention until no longer needed for that case. The original copy is deleted when the original retention period is reached. This is a simple approach but one that corporate legal council needs to be comfortable with. Solutions that suspend deletion of the data in the archive are available, but are often more complex to manage. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 1.3 Mail Server Data Management One primary advantage of e-mail archiving for IT is the potential for removing older messages from the active message system, thus freeing up storage space on e-mail servers and improving application performance. Using a mailbox management capability, archived e-mails and/or attachments will no longer reside on the mail server, freeing up precious disk space and reducing backup volume. Users should be able access this older e-mail via a Web browser-based application or through a mail system plug-in application. Service providers are increasingly offering a feature called “stubbing.” Stubbing (or linking) gives users access to archived e-mail within the e-mail application, just as if it were still stored in the active e-mail data store. The automating of the migration of older e-mail to the archive with deletion and stubbing negates requirements for use of unpopular mailbox-size quotas. In addition, migrating user personal stores to the archive where they are stored more efficiently can free up substantial disk space. Centralizing all historical messages in the archive provides IT with a single location to search when needed and the control to delete messages per a defined policy. Until recently, IT departments interested in providing users access to historical e-mail via stubs in the active mail store had to manage the archiving in-house. Within the past year, service providers have started to offer stub-based solutions, mostly for attachments only, removing this roadblock to a service solution where this approach is sufficient to address the management problem. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 2.0 The Hosted E-Mail Value Proposition and Vendor Challenges 2.1 The Benefits of Outsourcing E-Mail Archiving For many organizations and companies, managed e-mail archiving services can deliver a fast, relatively painless, solution with no initial infrastructure investments. Monthly usage payments address capital challenges. Defined service-level agreements commit the service provider to providing the required level of performance. Moreover, keeping internal IT out of the solution eliminates concerns about the possibility of insider tampering for companies under particular scrutiny. Additional service provider benefits include the following: Pay for use — Push initial and ongoing resource purchases and related planning to service provider, paying for only what is needed. Offload disaster recovery implementation — Leverage service provider's multiple sites to meet remote storage and disaster recovery requirements. Media maintenance — Rely on service provider to update media and data formats as records age and as device and application technology changes. Compliance requirements tracking — Use service provider's expertise to alert company of legislative changes or interpretations that may affect company compliance to records retention requirements. Staffing efficiency — Continue IS staff focus on the company's core business. Complete capture — 24/7 coverage to ensure that all records are captured. Provide a short-term solution while company management decides on the ultimate approach to be records management. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 2.2 Vendor Solutions — An Expanded Range of Options Because they are designed to meet the same legal requirements, the basic functionality of all e-mail archival service providers is pretty much the same when addressing records capture, search, and retention requirements. The provider will work with the customer to determine which e-mails are to be archived and if compliance supervision is required. From there, the process for archiving is usually as follows: Selected e-mails are transferred to service provider via VPN, although smaller companies might chose to use the Internet. E-mails are indexed and archived for specified retention periods and sometimes encrypted and/or digitally signed. Each message and/or attachment is given a unique code to ensure that it is stored only once. Tools that store attachments separate from the message can result in a greater reduction of data stored. The metadata and index for the record are stored separately and manage the retrieval and retention of the archived e-mail record. Browser-based searches are available to assigned individuals or can be designated to an audit agency. Records are destroyed at end of the retention period, so that they are not retrievable, even with forensic tools. Records that are under legal hold need to be retained for as long as the requirement exists. For all service providers, ingesting active mail at the start of the process and migrating existing personal stores often requires additional cost in the form of professional services from the vendor, although some vendors are starting to provide tools that speed the process and reduce the cost. The cost of this activity should be negotiated upfront. Depending on the amount of data involved, this cost could be a factor in vendor selection. Although the basic purpose of external service provider solutions is the same, their implementations, user interfaces, breadth of services, security features, experience and pricing certainly are not. In fact, no two service providers highlighted in this report use exactly the same technology in their solutions. The increased use of on-site appliances to manage data reduction and encryption helps to reduce bandwidth traffic and fears about data security. In addition to different architectures, service providers can have very different pricing methodologies. Autonomy and Iron Mountain charge strictly by the amount of data stored. Google, Mimecast and Smarsh charge on a per-seat basis with unlimited storage. Others price on a combination of per-user and per-storage basis. Some service providers charge for searches, others don't. Additionally, service providers will charge different rates for ancillary services, such as supervisory compliance, discovery services, help desk and tape restores. Finally, the breadth of services and methods of service delivery differ greatly from one service provider to another. Some have acquired other companies to meet SEC supervisory regulations. Others sublicense or partner to meet those same requirements. Additionally, some service providers grew from a background in electronic records management or security and have migrated to e-mail archiving services, while others grew from e-mail archiving and are moving to more comprehensive digital records archival and management. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 2.3 Vendor Challenges Currently, Gartner tracks more than a dozen e-mail archiving service providers, exclusive of e-mail hosting companies that may also offer archiving as an incremental service. But no matter what their business model, all archiving service providers face similar challenges. To begin with, providers of hosted e-mail archiving services face many of the same hurdles that are challenging service providers in general. Certainly, security tops the list, but e-mail archiving providers might face even tougher scrutiny here. Not only must the data they store be secure, for financial clients with broker-dealers, it must be tamper-proof as well. Another factor is market maturity. The market for e-mail archival services is still young and is attracting a growing number of players — many of them will be acquired, merge, change business models or simply go out of business. For organizations looking for a service provider, finding one that will be in business for as long as the data will need to be stored is a concern. Service provider viability is as much of a concern as service capabilities, especially for organizations with long retention periods. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 3.0 Comparing Service Provider Pricing the Gartner Way Although customers have dozens of service provider options, it's not that difficult to narrow the field rather quickly. The first hurdle is the e-mail platform itself. All service providers can support Microsoft Exchange. Fewer can handle Lotus Domino. Still fewer Novell GroupWise, Bloomberg, or Web-based mail systems. If mail server data management is a requirement, this will further narrow the field. A few vendors do attachment management, leaving a stub or link. Autonomy can do full mailbox management with its EAS On-Demand and MessageOne also manages stubbing with an on site appliance Comparing vendor pricing is difficult because of the wide range of pricing models and the various forms of discounting available. To accurately compare one service provider's prices with another, Gartner recommends the following steps: Define a likely scenario and ask each vendor to provide a monthly price and identify setup fees. Because different service providers utilize different billing methodologies, it can be very difficult to compare prices without a scenario. Some charge by the total amount of data protected, while others charge a flat price per user and retention period. In either case, it should be possible for the service provider to estimate a monthly “run rate” based on volume and service levels. Keep in mind that models based on the amount of data protected will increase every month throughout the retention period unless it is moved to lower-cost media. As a consequence, so will the bill. For vendors that charge by amount of stored data, the vendor's approach to compression, single-instance store or data deduplication can have an impact on the cost. Discuss the vendor's approach to deduplication and estimate the additional savings possible with a vendor that is more efficient removing duplicates. Encryption in the active e-mail system can negatively impact deduplication, so discuss this impact as well. Decide which services and service levels you really need — All the “free” services included in a service provider's base price are worthless if you don't need them. Just how valuable are instant messaging archival capabilities if your company doesn't support instant messaging? In this case, it simply doesn't matter whether the service provider charges additional for these capabilities. Remember that bandwidth isn't free — Transferring e-mails with large attachments can burn up bandwidth, and one way or another the customer will pay for it. Ask vendors with on-site appliances if single instancing of messages occurs prior to transmission so that only unique messages and attachments are sent or if all copies are sent over the wire and then duplicates removed at the service provider site. Ask pricing for discovery support — Are robust discovery tools available? If so, is there an added cost? Can the vendor provide additional services if you have questions, or must you find that help elsewhere. Give the vendor a discovery scenario and ask it to provide a price. What will it cost to get your data from the service if you decide to bring the application in-house or if you decide to change service providers? Get a guaranteed price and delivery time commitment written into your contract. The requirements list in Table 1 is a good starting point for comparing vendors you want to consider. But no matter which e-mail archiving service provider is ultimately selected, Gartner recommends negotiating an exit strategy upfront. Transforming archived e-mails into .pst files can be an expensive proposition. Rearchiving them into another service provider's repository could be even more expensive. Table 1. E-Mail Archiving Requirements Checklist Our Requirements User E-Mail and IM Environments to Be Supported Exchange, Domino, Novell, Bloomberg IM, etc. Planned migrations from/to IM, Mailboxes and Servers Number of e-mail mailboxes to be archived Number of e-mail mailboxes to be supervised Number of IM accounts to be archived Number of IM accounts to be supervised Approximate mailbox monthly volume Approximate IM monthly volume Location of mail/IM servers Legacy Data to Be Archived (E-Mail Backup Tapes) Other Documents to Be Archived Confirms, Statements, 1099s, SharePoint, etc. Mailbox Management Requirements Message and/or attachment removal Deletion of messages from mailboxes Archive Access and Security Integration with application development or Lightweight Directory Access Protocol for management and security End-user access to archive via Outlook End-user Web access to only its part of the archive Data stored in encrypted form at service provider's data center Data stored multiple times in at least two different locations User Compliance and Supervision Requirements SEC 17a, FINRA, HIPAA, NYSE 342, etc. Discovery Requirements Legal hold Review and case management capabilities Data export format requirements IM = instant messaging HIPAA = Health Insurance Portability and Accountability Act Source: Gartner (April 2009) <!– Replace the following line with this: –> Back to List of Tables <!– Replace the following line with this: –> <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.0 Selected Hosted E-Mail Archiving Service Providers Before 2000, only Zantaz (now a division of Autonomy) delivered a robust service provider alternative to in-house deployments. Today, customers have many choices among managed e-mail archiving service providers, ranging from archiving and discovery companies such as Autonomy Zantaz; to managed backup companies, like EVault; to spam filtering and e-mail hygiene service providers including Global Relay, LiveOffice, MessageOne, Proofpoint, and Postini (acquired by Google); to managed security companies like Perimeter to business continuity/disaster recovery behemoths, such as IBM and SunGard. Hosted e-mail services like NTT America and Intermedia frequently provide e-mail archiving services to their customer base. Since our report in February of 2008, the customer base for archiving services has grown to 23,624 companies. Petabytes (PB) under management grew from about 1PB to 2.5PB, with most vendors having modest archives per customer. Autonomy, with only 3% market share based on number of customers (see Figure 1), had the largest amount of data under management. As a metric to measure success in the market, terebytes of data under management can recognize service providers managing the largest amount of data, or reward those who inefficiently manage the storage resource. Leading vendors are constantly looking for ways to leverage new technologies, such as new redundant array of independent disks levels and data deduplication, to store more data in less space. Since our February 2008 report, the acquisition frenzy for e-mail archiving services has slowed dramatically. Other than the acquisition of Fortiva by Proofpoint, all service providers featured in this report remain under the same ownership as in 2008. Prior to that, FrontBridge was acquired by Microsoft, EVault was acquired by Seagate, and Zantaz was acquired by Autonomy. MessageOne, (acquired by Dell) entered the market in 2006. Postini also launched an archiving service in 2006 and then was acquired by Google in 2007. The service providers featured in this report represent larger and more-established service offerings but are not an exhaustive compilation of every service offering available. SunGard offers a service using EMC's EmailXtender software product but has only a handful of customers since launching the service in 2005. IBM, EDS, Quest Systems and Renew Data also sell a service managed by AXS-One, which itself became an acquisition target of Unify in 2009. Gartner anticipates a plethora of new market entrants, partnerships and acquisitions in 2009 and 2010 for a number of reasons. One is purely economic. Despite a weakening global economy, not a single service provider interviewed for this report reported any deterioration in market demand for its services, and some anticipate 2009 revenue to top 2008 two to three times over. Additionally, cloud technologies are lowering the barriers to market entry. Previously, service providers had to spend investment capital on compute and storage infrastructure. But the advent of cloud computing is allowing newcomers like Sonian Networks to enter the market without investing a nickel in servers and storage. Figure 1. E-Mail Archiving Outsourced Market <!– Replace the following line with this: –> Source: Gartner (April 2009) <!– Replace the following line with this: –> Back to List of Figures <!– Replace the following line with this: –> <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.1 Autonomy Zantaz — Pleasanton, California, U.S. www.zantaz.com Founded in 1996, Autonomy Zantaz (Zantaz), with its Digital Safe service, is the oldest and one of the largest e-mail archiving service providers in terms of the amount of stored mail. The company broadened its solutions offerings through the 2004 acquisitions of Educom and Steelpoint Technologies and was itself acquired by Autonomy in 2007. Zantaz offers licensed software, as well as hosted services primarily related to e-mail archiving, eDiscovery and records management. The company has seen strong growth in volume of Digital Safe data under management as a result of its support for large customers, including some of the largest financial services companies in the United States. Autonomy's strong European presence has helped Zantaz grow e-mail archiving business to the point that it now represents one-third of company revenue. In 2006, the company introduced a new service option (EAS On-Demand) that places an appliance at the customer site for handling the capture and transmission of messages but also serve as a local repository for messages deleted and stubbed in the user's mailbox. Adoption for this new service got off to a slow start but is accelerating. Digital Safe, a compliance-and-discovery-focused solution, supports the archiving of Exchange, Domino, GroupWise, Oracle Collaboration Suite, Unix Sendmail, Bloomberg and Instant Message. The product was re-engineered to operate on top of the Autonomy Intelligent Data Operating Layer (IDOL), which indexes, removes duplicates, and provides the tools for analyzing the archived data. If mailbox management is not needed, no on-site user hardware is required and journaling is used to capture messages for transmission to two of five primary data centers located in the U.S. and the U.K. Data is not stored in encrypted form. For those looking for mailbox management, an on-site server is required and all the capabilities of the EAS product solution are available for managing mailbox sizes and access to stubbed data through EAS On-Demand. Digital Safe has extensive supervision and eDiscovery capabilities and the ability to export and load data into the more comprehensive Introspect discovery and Aungate legal hold and Early Case Assessment (ECA) solutions. The company also offers data restoration and electronic discovery services as well as consulting, implementation and support services. Leveraging Autonomy's IDOL search engine, Zantaz claims the unique position of being the only service provider to create a consolidated archive of all information sources including e-mail and instant messaging, voice, video and enterprise systems. The 2007 acquisition by Autonomy of electronic records management software provider Meridio has provided more-robust retention management technology for integration with the archiving offerings. Digital Safe is priced based on storage used, with added cost modules for supervision, discovery, real-time policy management, and mailbox management. Monthly cost decreases for data stored beyond three years. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.1.1 Strengths Public company with strong financial viability and large development team Blue-chip company references and a competent professional services organization for advisory and legacy migration services Both hosted and on-site managed compliance and discovery solutions <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.1.2 Challenges Bankruptcies, consolidations and chaos in the U.S. financial industry, the company's primary customer segment, resulting in both challenges and opportunities Delivering on the EAS On-Demand solution to establish a competitive advantage over the growing number of viable competitors Growing the customer base and providing new references for the IDOL-based solution <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.2 Global Relay — Vancouver, British Columbia, Canada www.globalrelay.com Founded in 1999, Global Relay is a 60-person, private, employee-owned company offering hosted services for e-mail archiving, filtering and continuity. The Message Archiver & Compliance Reviewer service supports the archiving of Exchange, Lotus Domino, GroupWise, Bloomberg, Instant Messaging, and SMTP-based mail systems. Reporting 3,000 customers and 180 terabytes of data, the company is now targeting large companies. Their largest customer is using the service for 8,000 mailboxes. The bulk of Global Relay customers are in the financial industry and have focused on supervision tools for the archive. Discovery focuses around its proprietary search capability and exporting capabilities. Through partner selling efforts, the company (notably in an exclusive partnership with Reuters) can boast customers around the world, including growth in Asia/Pacific, although 80% of its business is in North America. Other partners include IBM's Exchange Hosting business through Apptix, Rackspace, USA.NET, Softek and Bell Canada. The Message Archiver stores all messages on disk in .eml format in its own proprietary encrypted format, which incorporates both Advanced Encryption Standard (AES) and RSA secure encryption algorithms. The data is mirrored between geographically dispersed data centers in Toronto and Vancouver, Canada, and multiple copies are stored in each location. The company also makes a copy of the client's data on a dedicated write once, read many (WORM) tape drive to meet tamperproof requirements and also will provide the drive and tapes to the client use if it decides to take the data back on-site. User information can be imported from company directory systems. The product includes the ability to restore a message to the active mailbox, if needed. The product is Unicode-enabled and the graphical user interface is localized in English, French, Spanish, German, Portuguese, Japanese and Chinese. Service pricing is based on the number of users, but there is a volume-stored pricing option for customers with more than 1,000 users. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.2.1 Strengths Strong partner channel network and exclusive deal with Reuters Robust supervision capabilities with no journaling requirement XML formatting technology delivers easy integration into multiple messaging services <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.2.2 Challenges Expanding customer base beyond traditional financial institutions Limited market awareness Need to expand discovery and mailbox management capabilities to compete effectively against expanding capabilities of competitors <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.3 Google — Mountain View, California, U.S. www.google.com On 5 February 2008, Google announced the extension of its Google Apps Packages to include Postini's services for spam and virus protection and an e-mail archiving and discovery offering based on the Postini technology. Postini had launched an e-mail archiving service in mid-2006, but it really began to gain traction when the company partnered with Google in February 2007. Google acquired Postini in September 2007. Marketing for the Postini offering was limited, as the company worked through the acquisition. Initial target was the compliance market. Google now offers archiving based on the Postini code for both Google Apps, as well as on-premises e-mail systems. The majority of its installed base is small and midsize companies, but customer size has been growing as Postini/Google has rolled out advanced investigation capabilities and the ability to consolidate historical data. The Google Message Discovery service captures messages from any messaging system using MX record redirect or can use envelope journaling with Microsoft Exchange or Lotus Domino. Messages, header, and attachments are indexed and stored, unencrypted, in multiple secure data centers in different geographical areas. Retention management includes the ability to implement legal hold when required and manage retention policies for up to 10 years of data, at either the domain, or the user-group level. Three levels of access privileges allow the user, IT and legal or compliance personnel to access appropriate parts of the archive. Users can recover a message from their personal archive, bringing a copy back into their e-mail in-box. Google also offers a toolbar plug-in for Outlook that allows end users to search for, view and respond to e-mails natively in their e-mail client. All access to the archive is logged, and the logs are retained for review if needed. A centralized Web-based administration tool provides for monitoring and display of reports on archive use. Current searches are English only, but the user interface has been localized in French, German, Spanish and Italian. Pricing is based on mailbox and the length of time the data is to be retained. List pricing for Google Message Discovery is $25 per user, per year for one-year retention, and $45 per user, per year for up to 10 years of retention. Both packages include unlimited storage. Virus and spam protection, as well as Postini's content policy management, are included as part of the service. Additional services are available for ingesting personal stores and messages on backup tapes. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.3.1 Strengths Public company with large base of Google Apps customers Postini customer base in spam and virus protection Simple pricing structure, simple deployment <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.3.2 Challenges Enterprise resistance to storing unencrypted data outside the corporation Increasing market awareness for and positioning of the capabilities of the Google Message Discovery versus the Postini Archive Manager Scalability and customer support as it targets larger clients with longer retention periods <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.4 Iron Mountain Digital — Boston, Massachusetts, U.S. www.ironmountain.com/digital Founded in 1951, Iron Mountain is a public company with more than 20,000 employees and 2008 revenue of over $3 billion, primarily from the storage and protection of paper records and electronic media. Digital services accounts for about 7% of company revenue. In November 2001, the company entered the digital archiving market by offering services for archiving e-mail, electronic documents and scanned images. In 2003, Iron Mountain introduced data restoration services for regulatory investigations and litigation discovery. The Digital Record Center for Compliant Messaging (DRC-CM), formerly known as Digital Archives, is targeted at customers in the financial industry with North America SEC compliance archiving and supervision requirements. For all other customers, Iron Mountain provides e-mail archiving and management based on technology licensed from Mimecast (see Mimecast section) and infrastructure but hosted by Iron Mountain. Iron Mountain also resells the Dell MessageOne managed e-mail service solution, which includes e-mail archiving, continuity, and security. Today, DRC-CM is used for Exchange, Bloomberg, and Instant Message. Support for Lotus Domino was added in 2007, and the company now supports a few customers on that platform. Pricing is based on monthly gigabytes (GB) of storage consumed. Scaling to meet massive data requirements has been a recent challenge, but a major revamping of the company's storage architecture is in place, and current customer data is in progress and expected to be completed by midyear. Microsoft's journaling feature is used to capture messages from specific targeted users. Once data is captured and sent to Iron Mountain, it is fully indexed, digitally fingerprinted, and written to disk. Today, data is encrypted in transit, although not in the existing store. The product road map will provide for encryption capabilities as part of the store in the updated archive services platform architecture. The index data is stored in Oracle databases for searching, and the original message is stored on two WORM devices and dispatched to separate locations. Results from queries can be moved to “discovery folders” where result sets can be further managed and, if desired, exported using .eml, PST, and NSF formats for use by other litigation support tools. Iron Mountain's acquisition of Stratify should provide additional discovery capabilities. For regulated environments, DRC-CM supports postreview and provides tools for sampling and management by reviewers. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.4.1 Strengths Public company with a large base of paper- and tape-archiving customers Reputation in records management, compliance and document management Professional services organization to support policy design and legacy ingestion of data <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.4.2 Challenges Competition from product and service providers with lower cost, but equally robust solutions — including the MessageOne offering that it resells Saturated market for North America SEC compliance archiving and turmoil in its key target market, the financial services industry Porting customer data to the new storage infrastructure to reduce costs <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.5 LiveOffice — Torrance, California, U.S. www.liveoffice.com Founded in 1998, LiveOffice is a private, 150-person company that provides a variety of e-mail services in addition to archiving including spam filtering, antivirus protection, e-mail continuity and hosted e-mail and BlackBerry. Archiving accounts for the vast majority of company revenue. LiveOffice supports mainstream e-mail applications, including Exchange, Domino, GroupWise and SMTP as well as instant messaging from Yahoo, MSN, AOL, Google, Bloomberg, and Reuters. LiveOffice currently reports 8,500 customers in North America and is archiving 250 terabytes of customer e-mail data. The company historically targeted businesses in the financial community but began offering a service in June, 2008 targeted at the rest of the market, which accounted for more than one-half of its sales in the fourth quarter of 2008. The average customer archives 125 mailboxes being archived with less than a couple hundred GB stored. About 100 have more than 500 mailboxes being archived, with some managing thousands of mailboxes. The company promotes tight integration of its service into both Lotus Notes and Microsoft Exchange. The product provides journal-based archiving with data stored in the primary data center in El Segundo, California, U.S., with a backup facility in Las Vegas, Nevada, U.S. The system supports the archive, index, search and retrieval of messages and attachments. The user interface has been localized in English, Spanish, and French. Archiving is in multiple languages, including Unicode character sets. Access to the archive system is protected by user-identification and password, but the data is only encrypted if requested. The service is offered on a per-mailbox basis with unlimited storage. There are two offerings, one with special supervision features targeted at the regulated portion of the financial industry, which includes the ability to do both pre- and postreview of messages, and one for all other industries. The base product outside financial services provides online search (Boolean logic, proximity searches, fuzzy and phonetic searches) and retrieval features that meet eDiscovery requirements. Compliance policy management capabilities (that is, lexicon-based scanning) are also available. In 2008 LifeOffice offered free e-mail continuity services to all of its Exchange customers and added an incremental encryption option. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.5.1 Strengths “Prereview” capabilities that provide the ability to quarantine suspect e-mail for review before it is sent to a user mailbox or gets sent out Strong management team and marketing resulting in fast customer growth “Free” e-mail continuity services and an incremental encryption offering <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.5.2 Challenges Concern about company viability, a standard concern for any small, private company, but especially important in a market where the relationship depends on the service being available for a multiyear period Limited visibility in the market Managing fast growth <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.6 MessageOne — Austin, Texas, U.S. www.messageone.com In April 2008, Dell finalized its acquisition of MessageOne, a 175-person, private company providing archiving and continuity services for Exchange as well as e-mail hygiene under the E-mail Management Services (EMS) brand. Additionally, the company offers an emergency notification service for crisis management. MessageOne entered the archiving market in mid-2006, leveraging its exiting continuity storage infrastructure with data centers in the U.S. (Chicago and Dallas) and Europe (the U.K. and Germany). Three-quarters of its customers are in North America. Europe is the next-largest regional penetration, but the company reports customers in other areas as well, mainly divisions of U.S.- or Europe-based companies. MessageOne targets companies with 1,000 or more mailboxes, with such customers accounting for 80% of its revenue. The company does support one customer with 200,000 mailboxes. Iron Mountain and SunGard are reselling partners, offing both continuity and archiving services through MessageOne. MessageOne customers deploy a small Windows appliance in their environments, which connects to the Exchange and Active Directory servers to perform functions, such as message capture, compression, attachment stubbing, transmission and receipt verification. Once messages are sent to a MessageOne data center, they are redundantly stored in at least two locations and indexed. Every message is encrypted in motion and then stored. The archive supports Unicode; non-English access is available through Outlook, but the Web-access capabilities are available in English only. Authentication and access permissions are synchronized through the appliance with the user's company security policy as recorded in Active Directory. Searches are federated across many search nodes, and all data exists on at least two nodes for high availability and data protection. MessageOne has no tools other than storage and policy management to support the special requirements of the broker-dealer part of the financial market, preferring to focus on the broader market where eDiscovery is more of a concern. The company has developed tools for ingesting active messages and personal stores and has the ability to recover messages to the exchange server. And it provides an extract capability that allows users to roll data off the archive as it ages onto their user storage if they wish to store and manage it themselves for “just in case” use. The service is priced based on number of mailboxes and volume of storage. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.6.1 Strengths No journaling required, strong encryption through a local appliance that guarantees secure access Multitenancy, multigeography storage architecture for secure, low-cost storage with two copies at the primary site and another at a different location Additional e-mail services, including spam-blocking, virus protection, and e-mail continuity services <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.6.2 Challenges Charging for storage capacity while increasingly competitors do not Gaining increased visibility for the company and the offering Extending its eDiscovery and mailbox management capabilities if it is to effectively compete in the 1,000-or-more market <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.7 Microsoft — Redmond, Washington, U.S. www.microsoft.com/exchange/services Microsoft became a hosted e-mail archiving service provider through the acquisition of FrontBridge Technologies in 2005. Microsoft offers the service as one of four Exchange Hosted Services. In mid-2009 Microsoft will begin migrating its e-mail archiving data to the company's cloud storage infrastructure, the same storage platform as SQL Data Services, a building block service of the Azure Services platform. The average customer for Microsoft Exchange Hosted Archive has approximately 450 to 500 mailboxes under management and less than 150GB of data stored though Microsoft reports at least one customer with over 6,000 mailboxes under management. Microsoft also has a reselling relationship with Proofpoint; this archiving solution can be used in conjunction with the Exchange Online Dedicated service for customers with 10,000 or more mailboxes who may also need an encrypted data store. Based on a redirection of a customer's mail exchange (MX) record, messages to and from the Internet are copied to the archive “in stream” with envelope journaling used to capture internal messages. Although most current customers are in North America, Microsoft does have a geographically separate data center network for archiving in Europe. The product currently supports Exchange, Bloomberg and IM archiving. Messages in the archive are single-instance stored. The product provides search and postreview supervision capabilities with highlighting of words in returned messages that caused the message to be selected. Supervision tools include sampling via keyword dictionaries and/or percentages and extensive reviewer management tools. The product also has a message-restore feature to allow deleted messages to be copied back to the active mail store. Exchange Hosted Archive also includes a continuity feature that allows ongoing send/receive functionality of e-mail during a network outage. The new offering is now Unicode-enabled, and messages are not encrypted when stored. Microsoft SQL Search is the offering's search engine. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.7.1 Strengths The Microsoft brand, financial strength, technologies and R&D money Microsoft selling channel partners Part of a portfolio of Exchange Hosted Services, including continuity and message-filtering services <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.7.2 Challenges Scalability — which may be addressed when migration to CloudDB is complete No professional services capability for retention policy construction, compliance assessment, or audit support Positioning Exchange Hosted Archiving offering with resale of Proofpoint Competing with other robust solutions that are less costly <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.8 Mimecast — London, U.K. www.mimecast.com Founded in 2002, Mimecast offers managed e-mail archiving as part of a wider Unified E-mail Management service. The service includes integrated continuity and security for corporate communications and data. A U.K.-based company, Mimecast began active operations and marketing in the U.S. in January 2008 and has other operations in Europe, the Middle East, Africa and offshore. The 130-person company claims 2,000 customers, including 40% of the U.K.'s top law firms. Gartner estimates that more than 50% of its customers are using the e-mail archiving service. Mimecast markets through direct and alliance channels to the enterprise market and also serves the small and midsize markets through partners. In April of 2009, Iron Mountain announced an agreement to license Mimecast technology for a managed solution that would be hosted at Iron Mountain facilities. Mimecast e-mail archiving works with all mail servers but offers additional services for Exchange and Outlook implementations, such as integration into Outlook for active search and transparent failover and the archiving of e-mails to and from users on the same mail server. With Mimecast's proprietary technology, e-mails are captured either through the gateway for external mail or journaling for internal mail, then encrypted, hashed, split into component parts, single-instanced, and then hashed again. Encryption is AES 256, with fragments of both customer data and decryption keys stored across different servers so individual server data is meaningless outside of the entire repository. At present, Mimecast archives e-mail messages and attachments only. Plans for document archiving, IM and SharePoint support are on the road map. Pricing is on a per-seat basis with unlimited storage. Mimecast also charges a small annual fee for technical support. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.8.1 Strengths Encryption of customer data and key management Strong European presence E-mail continuity service <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.8.2 Challenges Charges customers for phone support Currently no mail server management — planned for mid-2009 No IM support — currently negotiating with providers Potential for acquisition by Iron Mountain <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.9 Perimeter eSecurity — Milford, Connecticut, U.S. www.perimeterusa.com E-mail archiving is only one of 50 Perimeter eSecurity services offered on a software as a service (SaaS) basis. Founded in 1997, the company's services focus largely on managed security, such as intrusion detection and prevention, vulnerability scanning, Web content filtering, secure remote access using identity tokens, and anti-phishing. E-mail-related services include e-mail hygiene, e-mail continuity and hosted e-mail. Managed e-messaging compliance is provided by wholly owned subsidiary, Seccas. The company also provides hosted messaging through the 2007 acquisition of USA.NET. The e-mail archiving service was launched in 2001 and has attracted only a relatively small number of customers — 550 — who are fairly evenly split between Exchange and SMTP Mail. The service supports Lotus Domino, as well as Bloomberg, Reuters and Instant Messaging. Perimeter developed proprietary technology for e-mail archiving. E-mails are captured by journaling. They are indexed, deduped and then stored in redundant data centers in New Jersey and Pennsylvania. E-Discovery is supported using Boolean searches. Pricing is based on the number of users, amount of storage and retention period. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.9.1 Strengths Large client base to sell into Managed e-messaging service E-mail continuity service <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.9.2 Challenges Keeping focus on e-mail archiving with 50 other SaaS offerings. Concern about company viability, a standard concern for any small, private company, but especially important in a market in which the relationship depends on the service being available for a multiyear period; company will open financials to prospects under NDA. Growing market awareness. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.10 Proofpoint — Sunnyvale, California, U.S. www.proofpoint.com Founded in 2002, Proofpoint focuses on e-mail products and services with solutions for e-mail security, archiving and data loss prevention. Proofpoint lacked an e-mail archiving service until June of 2008 when it acquired 45-person e-mail archiving service provider, Fortiva, of Toronto. Proofpoint e-mail archiving service offers capabilities for journaled capture and archiving of e-mail, IM, Bloomberg mail, and attachments with the added ability to delete attachments from the active e-mail data store, leaving a link for mailbox-size reduction but with easy user retrieval. Searches can be done in real time or via a batch process with a resulting copy of the messages available for review online or exported in PST format. Supervision is available as an additional service option and offers a range of workflow scenarios for message review. But Proofpoint's unique contribution is its patented DoubleBlind Encryption technology that allows customers to retain exclusive access to their data while archiving at one of Proofpoint's data centers. The appliance is on the customer's network, connected directly with the Microsoft Exchange and Active Directory servers. At configurable time intervals, the on-site appliance uses MAPI calls to log into Exchange and access the journal mailbox and copy any messages to the appliance where they are indexed, encrypted and sent via secure connection for storage at a Proofpoint data center. Messages stay in the journaling mailbox until storage at Proofpoint is confirmed. The only data permanently stored on the appliance is the user's encryption keys. Messages can be decrypted only when an authorized user on the customer's network conducts a search from Outlook or from a Web-based user interface. Messages can be viewed only by someone with access to both the customer Proofpoint appliance and the Proofpoint data center. Ten roles can be defined, each with different data access characteristics, and users can be assigned a role in their Active Directory profile. Proofpoint e-mail archiving maintains a full audit trail of user activities relating to the data. In November 2008, Proofpoint enhanced the service to allow mobile employees to search the archive using any device supporting Microsoft Outlook Web Access. Proofpoint pricing is on a per-seat and per-GB per-month basis, billed annually. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.10.1 Strengths Complementary e-mail security offerings Strong encryption Microsoft relationship <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.10.2 Challenges Limited archiving customer base Limited market visibility, and limited focus on archiving Concern about company viability, a standard concern for any small, private company, but especially important in a market where the relationship depends on the service being available for a multiyear period <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.11 Smarsh — Portland, Oregon, U.S. www.smarsh.com Founded in 2001 and named for founder Steve Marsh, Smarsh initially targeted its e-mail archiving and compliance hosted solution to the financial services market as a solution compliant with the requirements of SEC 17A and FINRA 3010. In 2008, the company acquired CentraScan and Financial Visions, adding additional hosted e-mail and turnkey Web site services to its core e-mail archiving services. Smarsh reports 4,000 e-mail archiving customers, predominantly North American financial services companies. In 2009 and beyond the company is seeking to expand its customer base to other industries. Based on proprietary technologies, the Smarsh SaaS offering accommodates all e-mail systems as well as IM. E-mail messages are typically journaled from the e-mail server then indexed, scanned, deduped and stored on WORM devices to multiple locations in the U.S. Unique to Smarsh is a rule-based classification agent called Virtual Compliance Officer designed to automate many e-mail supervisory tasks. Customer support is provided 24/7 from East and West Coast centers. Professional services are delivered mainly through partners. Pricing is on a per-seat basis with unlimited per mailbox capacity. <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.11.1 Strengths Focus on financial services with unique “virtual compliance officer” supervisory tool Large customer base Customer relationship management service offering targeted at the financial industry complements e-mail archiving in that market <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> 4.11.2 Challenges Migrating customer data to new storage infrastructure and new deduplication capabilities Concern about company viability, a standard concern for any small, private company, but especially important in a market where the relationship depends on the service being available for a multiyear period Expanding outside of financial services <!– Replace the following line with this: –> Back to Table of Contents <!– Replace the following line with this: –> © 2009 Gartner, Inc. and/or its Affiliates. All Rights Reserved. Reproduction and distribution of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner's research may discuss legal issues related to the information technology business, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The opinions expressed herein are subject to change without notice.