What Wealthbox Vault's Compliance Monitor Means for Docs

Wealthbox Vault's Compliance Monitor is a new role, launched October 28, 2026 as part of the paid Wealthbox Vault add-on, that gives designated users read access to every file in their assigned workspaces plus a complete, exportable audit log of who viewed, downloaded, or modified each file - regardless of that user's individual file permissions (wealthbox.com). For firms that also run Docusign, it raises a concrete question: once a signed agreement lands back in Wealthbox, which system's audit trail actually counts, and what does a connecting integration need to log to satisfy both?

What Does Wealthbox Vault Actually Add?

Wealthbox Vault is an add-on, not a feature that ships free with every plan. It gives advisory firms unlimited file storage, full-content search, retained file versions, and the Compliance Monitor role. Full-content search indexes the text inside PDFs, Word documents, spreadsheets, scans, and even photos of business cards, so a search for a phrase surfaces every matching file, not just files with a matching name.

Two details matter more than the headline features if you're thinking about compliance:

• Files stored in Vault cannot be deleted by any user, including firm administrators. That's a hard platform rule, not a permission setting someone can turn off.
• Firms can export the entire Vault, or a filtered subset, as a .zip at any time, preserving folder structure and including a CSV manifest - useful for regulator requests or e-discovery without needing API access.

Wealthbox also expanded its AI to read client documents (PDFs, Word, Excel, PowerPoint, scans, images) on every plan, not just Vault. Wealthbox AI and AI Agents follow the same user-level permissions as the rest of the product, so they only touch files a given user could already see.

What Does the Compliance Monitor Role Actually See?

The Compliance Monitor is a role you assign to specific users, not a feature everyone gets. A Compliance Monitor gets read access to every file and folder in their assigned workspaces, overriding individual file-level permissions, and can view and export the complete audit log of Vault file activity. That log is the part integrators need to pay attention to: it's Wealthbox's own record of file-level activity, independent of whatever activity trail a connected system (like Docusign) keeps on its own side.

That's a meaningfully different compliance surface than Wealthbox had before Vault. Previously, "who touched this file" lived wherever the file itself lived - often scattered between email attachments, a shared drive, and the CRM's generic activity stream. Vault centralizes that into one queryable, exportable log that a designated compliance role can pull without asking an engineer for a database export.

Where Should a Signed Agreement's System of Record Live Now?

If your firm sends agreements through Docusign and stores the signed copy back in Wealthbox, you now have two systems that each believe they are authoritative for part of the record:

• Docusign owns the signature event itself: who signed, when, from what IP, with what certificate of completion. Docusign Agreement Manager (formerly Navigator) consolidates executed agreements into a repository that tracks key terms, commitments, and deadlines.
• Wealthbox Vault owns what happens to the file after it lands in the CRM: who viewed it, downloaded it, or (if someone tries and fails) attempted to delete it.

Neither system is wrong to call itself the system of record - they're the record for different events in the document's lifecycle. The practical answer for most firms: let Docusign Agreement Manager stay the record of the signing event, and route the executed PDF into Wealthbox Vault specifically (not a generic Wealthbox file field) so that everything that happens to the document after signature - views, downloads, edits - gets captured in the audit log a Compliance Monitor can actually pull. Dropping signed PDFs into a non-Vault file field defeats the point: those files can still be deleted, and they won't show up in the Compliance Monitor's audit export.

What Does This Mean for Wealthbox-to-Docusign Integrations?

An integration that pushes a signed Docusign envelope into Wealthbox now has to decide, explicitly, which folder or workspace it lands in and whether that workspace is Vault-backed. That's a config decision your integration code needs to make deliberately, not something to leave to whatever default folder the Wealthbox API happens to pick.

A few concrete implications for anyone wiring Wealthbox to Docusign:

1. Write to Vault-enabled workspaces, not legacy file fields. If Vault is purchased for the firm, confirm the target workspace for signed documents is Vault-backed before you point the sync at it. A file landing outside Vault is deletable and invisible to the Compliance Monitor's audit log.
2. Don't try to duplicate Wealthbox's audit log yourself. Once a file is in Vault, Wealthbox is already capturing view/download/edit events. Your integration's job is to get the right file into the right place with the right metadata (envelope ID, signer, completion date) attached, not to re-implement file-activity logging that Vault already does.
3. Keep the Docusign-side audit trail intact and linked. Store the Docusign envelope ID and a link back to the certificate of completion as metadata on the Wealthbox record, so a Compliance Monitor reviewing Vault's log can cross-reference the Docusign-side signing record without leaving Wealthbox.
4. Use the Wealthbox REST API for the sync itself. Wealthbox documents a REST API at api.crmworkspace.com/v1, authenticated with an access token generated in account settings, for read/write access to CRM data (wealthbox.com/api). That's the supported path for pushing a completed document and its metadata into a contact or household record.

How Should You Trigger the Sync When Docusign Completes an Envelope?

This is where the Docusign side of the integration matters as much as the Wealthbox side. Docusign Connect delivers webhook notifications when an envelope's status changes, and those payloads can (and should) be verified with an HMAC-SHA256 signature before you trust them (developers.docusign.com).

A reliable version of this flow looks like:

Step 5 matters because neither Docusign's delivery log nor Wealthbox's Vault audit log tells you whether your integration successfully moved the file between them. If the relay call to Wealthbox fails silently, Docusign shows the envelope as completed, Wealthbox's Compliance Monitor never sees a file that technically should exist. That's the gap a dedicated relay with its own retry logic and logging closes - which is the specific problem Baton is built to solve for Docusign-triggered automations, and it's also covered in more general terms in how to trigger Docusign Workflow Builder runs from any source platform.

What Is the Wealthbox Developer Portal, and How Does It Change Things?

The same week Wealthbox launched Vault, it also opened a Developer Portal (October 27, 2026, one day before Vault). It's worth being precise about what this portal actually does: it lets technology partners configure MCP connections, set up authentication, test connectivity, and submit integrations specifically for the Wealthbox AI Assistant - not a general-purpose webhook or app-marketplace portal for arbitrary integrations.

That's a narrower scope than it might sound at first. If your integration's job is moving signed Docusign documents into Wealthbox Vault, the Developer Portal isn't the path for that today; the standard REST API is. The Developer Portal becomes relevant if you want the Wealthbox AI Assistant itself to be able to query your system (for example, surfacing contract terms from a document management system directly inside a Wealthbox AI conversation) - a materially different integration pattern than a one-way file sync.

Implementation Checklist for Wealthbox + Docusign Teams

• Confirm the firm has purchased Vault before assuming any uploaded file is covered by the audit log or the no-delete rule.
• Point signed-document syncs at a Vault-backed workspace, not a generic file field.
• Attach Docusign envelope ID, signer identity, and completion timestamp as metadata on every synced file, so the two systems' records can be cross-referenced.
• Verify Docusign Connect's HMAC signature on every webhook before acting on it.
• Log your integration's own delivery attempts and failures separately from both Docusign's and Wealthbox's native logs.
• If a Compliance Monitor needs a specific document class (signed agreements, suitability forms) isolated for review, use a dedicated Vault folder rather than relying on search to find it later.

FAQ

Does Wealthbox Vault replace the need for a separate document management or CLM system? Not for signature and agreement intelligence. Vault is advanced file storage and search inside Wealthbox; it doesn't handle the signing workflow itself. Firms still need Docusign Agreement Manager or a similar system for the agreement lifecycle, with Vault as the downstream storage and audit layer.

Can a Compliance Monitor see files outside their assigned workspace? No. The role's elevated access is scoped to the workspaces an admin assigns to that user; it overrides individual file permissions only within those assigned workspaces, not firm-wide by default.

Is Wealthbox Vault required to get the Compliance Monitor role? Yes. Compliance Monitor and the audit log are part of the Vault add-on, not the base Wealthbox CRM plan.

Does the Wealthbox Developer Portal give third parties a general webhook integration? No. As launched, it's scoped to configuring MCP connections and tools for the Wealthbox AI Assistant, not a general webhook or app marketplace for arbitrary system integrations.

Next Step

If your firm or your platform needs signed Docusign agreements to land in Wealthbox Vault with an audit trail that actually holds up to review, that's an integration design problem worth getting right the first time. Talk to the fluidlabs team about building the Wealthbox-to-Docusign sync, including the relay logic that keeps both systems' logs trustworthy.