It is interesting that the aides's solution is similar (BlackBerry instant messages) which, apparently, RIM does not archive (though I'll bet the Canadian CSE does).

An interesting property of BBM is that organisational policy can be enforced for message deletion. It is not implausible that future iphones will have to supply some proof of being un-tampered before being allowed to join Apple's overlay network.

In the short term, switch to Signal or WhatsApp, and don't send anything naughty. Have a scheduled deletion policy written down and follow it.