---
title: "WhatsApp Business Security for Companies | Whalemate"
description: "End-to-end encryption is not enough to approve WhatsApp Business. The real decision depends on access, webhooks, retention, and marketing controls."
url: https://www.whalemate.com/en/resources/blog/whatsapp-business-security-companies/
lang: en
updated: 2026-11-10
alternates:
  es: https://www.whalemate.com/recursos/blog/whatsapp-business-tan-seguro-empresas/
  pt-BR: https://www.whalemate.com/br/recursos/blog/whatsapp-business-risco-empresas/
index: https://www.whalemate.com/llms.txt
---

[Back to blog](https://www.whalemate.com/en/resources/blog/)

Blog

# WhatsApp Business Security for Companies

End-to-end encryption is not enough to approve WhatsApp Business. The real decision depends on access, webhooks, retention, and marketing controls.

Nov 10, 2026
By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/)
13 min read

![WhatsApp Business Security for Companies](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/whatsapp-business-security-companies.webp)

In this article

1. [Does end-to-end encryption mean WhatsApp Business is secure?](#s1)
2. [What changes when the company uses Cloud API?](#s2)
3. [Where does channel protection end and company responsibility begin?](#s3)
4. [Does two-step verification solve account takeover risk?](#s4)
5. [What requires controlling credentials, devices, and internal access?](#s5)
6. [What about webhooks, payloads, and traceability?](#s6)
7. [Does Cloud API retention cover preservation and deletion obligations?](#s7)
8. [Can WhatsApp Business be used for marketing without reviewing the legal basis?](#s8)
9. [What turns an operational issue into a regulatory incident?](#s9)
10. [What real deadline does the company have to react?](#s10)
11. [Does fraud scale change the channel assessment?](#s11)
12. [What does this mean tomorrow for a CISO, IT, or compliance team in LATAM?](#s12)
13. [What to read next?](#s13)
14. [¿Riscos à informação no WhatsApp Web em ambiente corporativo?](#s14)

For CISOs, IT, and compliance teams in LATAM, saying WhatsApp Business is secure is only defensible if three distinct layers are separated: transport and platform security, company security and governance after a message is received, and the ability to respond to fraud and incidents within the regulatory deadline. The overlap between WhatsApp, Meta for Developers, the WhatsApp Business terms, the LGPD, the ANPD, and the ICO shows that end-to-end encryption does not by itself solve internal access, webhooks, retention, marketing, traceability, or notification.

None of the source material presents these layers in a single view. When they are compared, the real decision point appears: do not approve WhatsApp Business in the abstract, but define which use cases are authorized and what evidence the company must produce.

| Channel | Layer assessed | What it protects | Declared limit | What it requires from the company | Deadline or retention | Source |
| --- | --- | --- | --- | --- | --- | --- |
| WhatsApp Help Center, chats with businesses on WhatsApp Business | Transport and chat | Conversations with businesses that use the WhatsApp Business app are protected by end-to-end encryption by default, according to WhatsApp Help Center. | After a message reaches a business, it is subject to that business's own privacy practices, according to WhatsApp Help Center. | A business may designate employees or other providers to process and answer messages, and may use received chats for marketing, including advertising on Meta, according to WhatsApp Help Center. | not specified | WhatsApp Help Center |
| Meta for Developers, WhatsApp Cloud API | API and delivery to systems | Cloud API uses Signal protocol encryption to protect messages before they leave the device, and Graph API and Webhooks operate over HTTPS protected by TLS, according to Meta for Developers. | When a message reaches Cloud API, Cloud API decrypts it and forwards it to the business. Cloud API acts as an intermediary and manages encryption and decryption keys on behalf of the business, according to Meta for Developers. | Incoming messages and delivery statuses are communicated to the company's server through webhooks, and webhooks deliver JSON payloads, according to Meta for Developers. | Maximum retention period of 30 days for message data. User identifiers are deleted within 30 days after the last message status update, unless otherwise indicated, according to Meta for Developers. | Meta for Developers |
| WhatsApp Business App Terms | Account, access, and responsibility | The business must keep account credentials secure, protect WhatsApp devices and accounts, prevent unauthorized access or use, and immediately report suspected incidents or unauthorized access, according to the WhatsApp Business App Terms. | The business is responsible for all activity carried out under its account, according to the WhatsApp Business App Terms. | It must allow access only to authorized people acting on its behalf and for authorized purposes, and implement and follow recognized industry standards and best practices for data and information security, according to the WhatsApp Business App Terms. | Immediately report suspected incidents or unauthorized access. No retention period specified. | WhatsApp |
| LGPD Brazil | Legal duty of the controller | Article 46 of the LGPD requires technical and administrative security measures to protect personal data from unauthorized access and from destruction, loss, alteration, communication, or any other form of improper or unlawful processing, according to the Presidência da República do Brasil. | Article 46, paragraph 2, of the LGPD requires security measures to be observed from the product or service design phase through execution. Article 6, item X, requires proof of effective measures capable of demonstrating compliance and the effectiveness of those measures, according to the Presidência da República do Brasil. | Under the WhatsApp Business App Terms, the user company acts as Controller under the LGPD regarding customer data processed to enable contact through WhatsApp, according to WhatsApp. | Article 48 requires notification to the national authority and the data subject of a security incident that may cause relevant risk or harm, according to the Presidência da República do Brasil. | Presidência da República do Brasil, WhatsApp |
| ANPD Brazil | Incident notification | Notification to the ANPD and to data subjects must be made when the incident may cause relevant risk or harm, according to the Autoridade Nacional de Proteção de Dados. | The ANPD defines incidents subject to assessment as those related to breaches of the confidentiality, integrity, availability, and authenticity properties of personal data security, according to Serviço Federal de Processamento de Dados. | The notification must include the nature and category of the affected data, the number of data subjects, the security measures adopted, the risks identified, mitigation measures, and the description and root cause of the incident, according to the Ministério das Mulheres do Brasil. | Within 3 business days, unless a specific law sets a different deadline, according to the Autoridade Nacional de Proteção de Dados. | ANPD, Serpro, Ministério das Mulheres do Brasil |
| ICO | Governance of non-corporate channels | The Information Commissioner's Office recommends strictly controlling or prohibiting the use of social networks or messaging apps such as WhatsApp to share personal information. | Using non-corporate channels for official information can make it harder to comply with data protection obligations, according to the Information Commissioner's Office. | Official information should be kept in corporate channels and, if private channels such as WhatsApp are used, there must be mechanisms to move it quickly into corporate systems. It also requires appropriate policies, information security, and supervision, according to the Information Commissioner's Office. | It must be securely destroyed when no longer needed. No numeric deadline specified. | Information Commissioner's Office |

## Does end-to-end encryption mean WhatsApp Business is secure?

WhatsApp Help Center says that all messages are protected by the same Signal encryption protocol before they leave the device, and that conversations with businesses using WhatsApp Business are protected by end-to-end encryption by default. But the same WhatsApp Help Center also says that after a message reaches a business, it is subject to that business's own privacy practices.

Whalemate's reading is that encryption protects the initial path, not the full life of the data. If the use case includes support, sales, or collections, the assessment cannot stop at the channel, because the relevant risk starts once the message is inside the company's operational perimeter.

## What changes when the company uses Cloud API?

Meta for Developers documents that in Cloud API, the message travels encrypted between WhatsApp and Cloud API, but when it reaches Cloud API it is decrypted and forwarded to the company. The same documentation says Cloud API acts as an intermediary and manages encryption and decryption keys on behalf of the company.

Whalemate's reading is that this changes the security question. It is no longer enough to validate channel encryption, because the risk shifts to delivery into internal systems, exposure of webhooks, the servers that receive JSON payloads, and control over who can operate that integration.

## Where does channel protection end and company responsibility begin?

WhatsApp Help Center says a company may designate employees or other providers to process and answer messages, and may use received chats for marketing, including advertising on Meta. At the same time, the WhatsApp Business App Terms say the company is [responsible for all activities](https://www.whatsapp.com/legal/WhatsApp-Terms-for-WhatsApp-Business-App) carried out under its account.

Whalemate's reading is that the security boundary is not defined by the product but by the governance the company can demonstrate. If multiple people or third parties access messages, accounts, or integrations, the critical issue stops being the encryption promise and becomes the real chain of custody of the data.

## Does two-step verification solve account takeover risk?

WhatsApp Help Center presents two-step verification as an optional feature that adds an extra layer of security to the account. Polícia Civil de Santa Catarina recommends enabling two-factor authentication and turning on WhatsApp's two-step verification with a 6-digit PIN, and WhatsApp recommends not sharing the 6-digit verification code or the two-step verification password.

But NIST recommends enabling multifactor authentication and moving toward phishing-resistant authentication, and NIST SP 800-63-4 says authenticators that require manually entering a code, including out-of-band OTP authenticators, should not be considered [phishing-resistant](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/). In addition, a document from the Assembleia Legislativa de São Paulo warns that two-factor authentication is not fully protected.

Whalemate's reading is that two-step verification is a floor, not a sufficient guarantee. It helps reduce basic exposure, but it does not justify treating the account as protected against [social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/) campaigns or credential theft.

## What requires controlling credentials, devices, and internal access?

The WhatsApp Business App Terms require keeping account credentials secure, protecting WhatsApp devices and accounts, preventing unauthorized access or use, and immediately reporting suspected incidents or unauthorized access. They also require allowing access only to authorized people acting on the company's behalf and for authorized purposes.

The CIS Mobile Companion Guide identifies device management and configuration as a central mobile security issue, along with the use of cryptography and controls over the installation and use of mobile applications. Whalemate's reading is that a well-configured account can still be insecure if it runs on unmanaged devices, with shared credentials, or with extended third-party access without traceability.

## What about webhooks, payloads, and traceability?

Meta for Developers documents that in Cloud API, incoming messages and delivery statuses are communicated to the company's server through webhooks, and that those webhooks deliver JSON payloads. It also documents that Graph API and Webhooks operate over HTTPS protected by TLS.

Whalemate's reading is that TLS protects transport, but does not replace control over the destination. A CISO must be able to show which server receives those events, who manages that endpoint, how related access is authenticated, what logs are kept, and how those events are correlated with corporate systems.

## Does Cloud API retention cover preservation and deletion obligations?

Meta for Developers sets a maximum retention period of 30 days for message data in Cloud API and says user identifiers are deleted within 30 days after the last message status update, unless otherwise indicated. The Information Commissioner's Office, for its part, says a company that processes personal information must keep it secure and destroy it securely when it is no longer needed.

Whalemate's reading is that the platform's retention does not replace the company's retention policy. If chat content has already been transferred into CRM, help desk, ticketing, collections, or internal repositories, the operational obligation shifts to those systems and their document lifecycle.

Whalemate

Want to see Whalemate in your organization?

Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there.

[Book a demo](https://www.whalemate.com/en/demo/)

## Can WhatsApp Business be used for marketing without reviewing the legal basis?

WhatsApp Help Center says a company may use received chats for its own marketing activities, including advertising on Meta. But the Information Commissioner's Office requires a valid legal basis for direct marketing and says the most likely bases are consent and legitimate interests.

Whalemate's reading is that the technical ability to use the chat for marketing does not equal automatic regulatory permission. Compliance has to define which data is reused, for what purpose, and under what legal basis before campaigns or audiences derived from conversations are enabled.

## What turns an operational issue into a regulatory incident?

Article 48 of the LGPD requires the controller to notify the national authority and the data subject of a security incident that may cause relevant risk or harm to the data subjects, according to the Presidência da República do Brasil. Brazilian institutional guidance defines a personal data security incident as any confirmed adverse event that compromises the confidentiality, integrity, or availability of personal data, and the ANPD adds examples that also relate to authenticity, according to Serviço Federal de Processamento de Dados.

Whalemate's reading is that a credential exposure, a compromised device, a poorly protected webhook, or improper provider access are not only technical failures. They can become personal data incidents that trigger legal review and formal response.

## What real deadline does the company have to react?

Resolution CD/ANPD No. 15 of April 24, 2024 establishes that notification to the ANPD and to data subjects must be made within [3 business days](https://www.gov.br/anpd/pt-br/canais_atendimento/agente-de-tratamento/comunicado-de-incidente-de-seguranca-cis) when the incident may cause relevant risk or harm, unless a specific law sets a different deadline, according to the Autoridade Nacional de Proteção de Dados. The LGPD itself requires the notification to include, at a minimum, the nature of the affected data, information about the data subjects, technical and security measures used, risks, reasons for any delay, and measures adopted or planned, according to the Presidência da República do Brasil.

Whalemate's reading is that the problem is not only preventing the incident, but being able to reconstruct it quickly. If the company does not know who accessed what, what data was circulating, which provider was involved, and which controls were active, it reaches the regulatory deadline without enough evidence to respond.

## Does fraud scale change the channel assessment?

Meta says WhatsApp bans tens of millions of accounts per month, often without a recent user report, according to Meta Scam Protection Center. BBC News reported that Meta said it removed more than 6.8 million accounts linked to scam centers in the first half of 2025, and The Economic Times cited a monthly report saying WhatsApp banned 9.96 million accounts in India during January 2025 and acted preventively on 1.32 million before receiving complaints.

Agência Lupa reported at least 281,200 electronic fraud cases in Brazil during 2024, up 17% from 222,700 cases in 2023, although that figure covers electronic fraud in general and not exclusively WhatsApp Business. In 142 verified scams between 2020 and 2025, Agência Lupa reported that 93% offered some immediate financial return and 77% used brands or public figures to reinforce an appearance of authenticity and security.

Whalemate's reading is that the platform's anti-abuse controls exist, but they do not eliminate impersonation risk or opportunistic brand misuse. For a company, that means reports, blocks, deception attempts, and escalation times must be measured as part of channel security.

## What does this mean tomorrow for a CISO, IT, or compliance team in LATAM?

The decision enabled by these sources is not to approve WhatsApp Business in the abstract. It is to authorize narrow use cases with an inventory of data, control over who accesses the account and devices, two-step verification and MFA where applicable, provider and integration management, webhook and credential controls, retention and deletion rules aligned with internal systems, fast traceability into corporate repositories, a defined legal basis for marketing, and a response procedure measured against the applicable ANPD deadline.

If the company uses WhatsApp Business or Cloud API, the minimum defensible position is to show who has access, what data may be shared, where it ends up after the chat, how reports and blocks are recorded, and how long the organization takes to detect, escalate, and notify an incident. If that evidence does not exist, the phrase "WhatsApp Business is secure" describes only part of the channel, not the company's risk posture.

## What to read next?

- [Industries on the platform](https://www.whalemate.com/en/solutions/)

## ¿Riscos à informação no WhatsApp Web em ambiente corporativo?

The risk in a corporate environment is not in chat encryption, but in what happens after the message enters the company. If WhatsApp Web or WhatsApp Business is used without access controls, device controls, webhook controls, and internal policies, information can be exposed inside the corporate perimeter itself.

The article material already says the company must restrict who can access messages, protect credentials and devices, and treat received messages as data subject to internal governance. It also says official information should be kept in corporate channels and that, if WhatsApp is used, there must be a way to move it quickly into internal systems.

[See the full topic guide](https://www.whalemate.com/en/solutions/)

Questions

## Frequently asked questions

**Does WhatsApp Business have end-to-end encryption?**

Yes. WhatsApp Help Center says that conversations with companies that use the WhatsApp Business app are protected by end-to-end encryption by default. But the same source clarifies that, once the message reaches the company, it becomes subject to that company’s privacy and operational practices.

**Does Cloud API keep end-to-end encryption all the way to the company’s system?**

Not in the same way. According to Meta for Developers, the message reaches Cloud API encrypted, but it is decrypted there and forwarded to the company. In addition, Cloud API acts as an intermediary and manages the keys on behalf of the company, so the risk analysis must include webhooks, integrations, and receiving servers.

**Is enabling two-step verification enough?**

No. WhatsApp presents it as an additional layer of security, and authorities such as the Polícia Civil de Santa Catarina recommend enabling it, but NIST SP 800-63-4 says that authenticators based on manually entered codes should not be considered phishing-resistant. It works as a basic control, not as a guarantee against account takeover.

**What should compliance require before enabling marketing through WhatsApp?**

It should require a data inventory and purpose definition, a definition of what chat information can be reused, a valid legal basis for marketing, and retention and deletion rules. According to WhatsApp Help Center, a company can use chats for marketing, including advertising on Meta, but the Information Commissioner's Office requires a valid legal basis for direct marketing.

**When can an incident in WhatsApp Business require notification to the ANPD?**

When the incident could cause relevant risk or harm to data subjects, according to article 48 of the LGPD and the ANPD guidance. If there was exposure through credentials, devices, unauthorized access, provider, or webhook, the company has to assess whether it affected confidentiality, integrity, availability, or authenticity and, if applicable, notify within 3 business days, according to the ANPD.

Whalemate

Is this risk in your program?

If this article describes something you already faced — or that the board is asking you to explain — book a demo.

[Book a demo](https://www.whalemate.com/en/demo/)

## Would you like to go deeper on this topic?

Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas.

- [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CWhatsApp%20Business%20Security%20for%20Companies%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)
- [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CWhatsApp%20Business%20Security%20for%20Companies%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)

In this article

1. [Does end-to-end encryption mean WhatsApp Business is secure?](#s1)
2. [What changes when the company uses Cloud API?](#s2)
3. [Where does channel protection end and company responsibility begin?](#s3)
4. [Does two-step verification solve account takeover risk?](#s4)
5. [What requires controlling credentials, devices, and internal access?](#s5)
6. [What about webhooks, payloads, and traceability?](#s6)
7. [Does Cloud API retention cover preservation and deletion obligations?](#s7)
8. [Can WhatsApp Business be used for marketing without reviewing the legal basis?](#s8)
9. [What turns an operational issue into a regulatory incident?](#s9)
10. [What real deadline does the company have to react?](#s10)
11. [Does fraud scale change the channel assessment?](#s11)
12. [What does this mean tomorrow for a CISO, IT, or compliance team in LATAM?](#s12)
13. [What to read next?](#s13)
14. [¿Riscos à informação no WhatsApp Web em ambiente corporativo?](#s14)

Whalemate

Is this risk in your program?

[Book a demo](https://www.whalemate.com/en/demo/)