[throwaway19937]

Here are a few possible explanations based on my experience at various employers.

1. Departments/divisions have their own budgets; Quill was purchased before security or compliance was involved.

2. Quill was deployed or piloted for a group without retention requirements then escaped into the wild. Security or compliance wasn't involved until it was in use company wide.

3. A client required using Quill so the usual compliance requirements were waived.