WhatsApp's security story is better than most channels, but not perfect. If you handle customer data — orders, PII, payment info — you should understand exactly what's protected and what isn't.
What end-to-end encryption actually means
Every WhatsApp message is end-to-end encrypted: only the sender's and receiver's devices can decrypt the content. Not WhatsApp, not Meta, not your ISP, not a government subpoena to Meta's servers.
Encrypted in transit:
- Text messages
- Photos, videos, voice notes, documents
- Voice and video calls
- Location shares
- Group chats
Not encrypted:
- Cloud backups — if you back up to iCloud or Google Drive without WhatsApp's opt-in "end-to-end encrypted backups", the backup is decrypted at rest on Apple's or Google's servers.
- Metadata — WhatsApp knows who messaged whom and when, even if not what.
- Business API messages — messages sent through the WhatsApp Business API pass through the API provider (Twilio, MessageBird), who can technically see them. E2E encryption is between the customer and the API provider, not the customer and the business.
What Meta can see
Even with encryption, Meta sees:
- Your phone number, name, profile photo, "about" text.
- Who you message and how often (contact graph).
- When you're online.
- Your device model, OS, and app version.
- IP address and approximate location.
- If you enabled "Read receipts", the fact that you read a message.
Meta uses this metadata for spam detection, product improvements, and — in some regions — ad targeting on Facebook and Instagram (WhatsApp Business specifically).
Business-critical controls to turn on
1. Two-step verification (essential)
Prevents someone from stealing your number via SIM swap and taking over your WhatsApp.
- WhatsApp → Settings → Account → Two-step verification → Enable.
- Set a 6-digit PIN you'll remember.
- Add an email for PIN recovery.
Without this, a SIM swap = full WhatsApp takeover of your business number. With it, the attacker also needs the PIN.
2. End-to-end encrypted backups
Standard backups to iCloud/Google Drive are unencrypted. Enable E2E backups:
- Settings → Chats → Chat backup → End-to-end encrypted backup → On.
- Save the 64-digit recovery key (or set a password).
Now even Apple, Google, or a subpoena can't read your backups.
3. Session control
- Settings → Linked devices.
- See every device where WhatsApp Web / desktop is logged in.
- Log out any you don't recognize.
- Repeat monthly.
4. Privacy settings
- Last seen & online: My contacts (not "Everyone") for business number, or "Nobody" if you don't want customers to know when you're online.
- Profile photo: My contacts (or "Everyone" if you want customers to see a professional logo).
- Read receipts: On for business — customers value knowing you saw the message. Off only if you're overwhelmed.
- Groups: "My contacts" — prevents random people adding you to spam groups.
5. Screen lock (mobile)
- Settings → Privacy → Screen lock → require Face ID / fingerprint to open WhatsApp.
- If someone unlocks your phone, they still can't see your business chats.
Storing customer data — legal considerations
If you handle personal data of EU customers (GDPR) or California customers (CCPA), your WhatsApp workflow is subject to those laws:
- Consent: don't add customers to broadcast lists without explicit opt-in.
- Right to be forgotten: if a customer asks you to delete their data, delete the chat AND any backups.
- Data retention: don't keep chats forever. Set a policy (e.g. 12 months post-purchase) and export/delete on schedule.
- Sensitive data: never send credit card numbers, government IDs, or medical info over WhatsApp unless you're on the API with a proper compliance setup.
Common security mistakes
- Sharing a WhatsApp Business number across a team via screen sharing. Everyone can see every chat. Move to the API or use a shared iPad with strict access control.
- Screenshotting chats for CRM. Chats can include personal data — screenshots pile up in phone rolls that back up to cloud. Extract text only, not screenshots.
- Using WhatsApp Web on public computers. If you forget to log out, the next person has full inbox access. Enable "Log out on browser close" or just don't do it.
- Sending passwords or 2FA codes over WhatsApp. WhatsApp is not designed as a secrets manager. Use a proper password tool.
- Ignoring the "phone verification" nudge. Enable two-step verification today.
What to tell customers
If customers ask "is WhatsApp secure?", the honest answer:
"Yes — messages between you and us are end-to-end encrypted, meaning even WhatsApp can't read them. However, we keep chat logs for order records. If you'd prefer a more secure channel for [payment / sensitive info], we can use [alternative]."
Transparency builds trust.
Generate your WhatsApp link → free WhatsApp link generator.