Sarbanes-Oxley requires corporate record-keeping and outlaws interference with investigations. While it doesn't specifically mention ephemeral messaging, it would seem to preclude its use in anything business-related. So it's not "trying to prove a negative" so much as it seems to be saying these applications are illegitimate for business use period.