Is WhatsApp secure enough for businesses? A quick guide for secure messaging

Is WhatsApp secure for companies? Can employees carelessly discuss work-related matters via WhatsApp?

WhatsApp users were caught by surprise last year when they learned that some of their data is shared with Facebook. Millions of users received a notification about the platform’s Privacy Policy Update in 2021. But the news triggered a question: how secure is WhatsApp and is it actually secure for companies?

The reactions were diverse. Among the big audience, a big part of the users migrated very quickly to Signal, which topped in the US’, China’s and India’s messaging app charts in only a few hours. A week after the announced WhatsApp privacy policy update, the Signal app was downloaded around 7.5 million times.

‍WhatsApp security issues come to the surface every now and then. A bug that occurred in 2009 came to public knowledge again last January when some WhatsApp groups showed up on Google search.

In this article, we will address the question of the day: Is WhatsApp secure? And is it safe to use as a mean of internal business communication?

Employees use WhatsApp every day. Why should businesses care?

A study conducted by the technology company Guild showed that almost half of UK workers (41%) admitted to using the messaging app for work. And even though WhatsApp has penetrated the corporate space due to its popularity, companies are in search of a more secure instant messaging platform.

Italy’s data protection agency contacted the European Data Protection Board (EDPB) in order to demand clear information over WhatsApp security. Besides that, some Indian and multinational companies have even issued advisories to employees asking them to use WhatsApp with caution and stop using the platform for critical business calls, as reported by Economic Times.

So why should businesses care? Because although WhatsApp does incorporate some security features, it does not adhere to the highest communication security standards for businesses. Data privacy and data security are of utmost importance to businesses that want to keep their customers and attract new ones.

Read on to find out more about secure messaging, the importance of compliance in Enterprise communications, and steps on how to choose the most secure messaging app for your business.

What is a Privacy Policy and why the concern?

Don’t worry, you’re not the only one to skip the screen with tiny text called “new terms and conditions”.

WhatsApp’s sharing data made a lot of Americans search for Facebook’s Privacy Policy, as pointed out by Google Trends. But, first of all, what is a Privacy Policy and how important is it?

A Privacy Policy is a legal statement or document that describes:

• how your information will be collected and handled by a company;
• how your personal information will be treated;
• how you can access your data and edit it or ask for a correction.

If you are familiar with WhatsApp you already know it collects a lot of metadata, such as your phone number, profile picture, and device data.

In our webinar, we explain why metadata - or data about data - is sometimes just as risky as data harvesting.

Privacy Policy update brings to the table is the integration with Facebook and many Facebook-owned companies.

WhatsApp’s updated terms of service have new sections, such as Location Information and Transactions and Payment Data. Here are the most notable changes:

• WhatsApp said it will share data related to how people interact with businesses on its app;
• Businesses will be able to use Facebook’s hosting infrastructure to manage chats with the customers;
• Companies will also be able to use the data for their own marketing purposes, such as Facebook ads.

Even though WhatsApp has confirmed that the new privacy policy targets only business accounts, this update has not been well received amongst its users. The US Federal Trade Commission has filed an antitrust lawsuit against Facebook due to its acquisition of WhatsApp and Instagram. WhatsApp security is being discussed as other lawsuits suggest the social network is monopolizing data.

So, is WhatsApp secure for companies?

The short answer? No.

Even though WhatsApp is currently one of the most popular messaging platforms in the market, it was never meant for business communication. And if your staff deals with sensitive information, secure messaging should definitely be a priority from now on.

The Ponemon Institute report points out that, in the past two years, 53% of organizations have experienced at least one data breach caused by a third party software or app. Add to that a rising number of ransomware attacks from 2020 onwards - that was influenced by a quick shift to remote and hybrid work.

Cybersecurity leader at PwC Sivarama Krishnan says a lot of companies in the pharma and financial services are quitting WhatsApp and looking for secure messaging for their businesses. “They are restricting communications to emails or personal messages instead of WhatsApp now as many services companies are evaluating other options”, he says.

There are many reasons why you should never consider WhatsApp a secure messaging app for your business. And by that, we mean internal communication between employees. Here are the main two reasons why WhatsApp is not secure to use as a main communication method between employees:‍

1) WhatsApp is not GDPR compliant

Besides not being meant for business purposes, WhatsApp is not compliant with privacy regulations like General Data Protection Regulation (GDPR). For example, this messaging app allows any employee to remove users and add customers and suppliers without their consent.

This may be troublesome once WhatsApp says the responsibility for this consent belongs to the users. Not being a GDPR compliant company could represent a financial risk for your businesses. In case you don’t remember, last year Google was fined US$57 million by France's data protection authority.

You can read more about GDPR Privacy Policy and WhatsApp here: How the General Data Protection Regulation applies to European region users

2) WhatsApp lacks user management features

Yes, you can create groups and add users to them, but that’s only it. WhatsApp does not offer well-defined administration roles, making it impossible for companies to control and limit access to their data.

The app also doesn’t provide a central directory to let you know of existent WhatsApp groups in your company. On top of that, keeping track of your conversational history is very challenging when information is distributed among numerous chats or group conversations.

So what should you take into consideration when choosing the most secure messaging app?

How to choose the best secure messaging app for business

1) Adopt a business-purpose platform for daily communications

The misuse of a messaging app leads to more chaos in the workflow, no matter what business you are in. That’s why more and more companies are looking for team collaboration tools as they are designed and dedicated for business purposes only.

Companies that wish to have secure messaging as a priority must ensure their communication takes place in a platform that adheres to privacy standards and offers data protection.

2) Make sure to go for a compliant messaging tool

If you work with data you must keep an eye on regulations around the world, such as GDPR and California Consumer Privacy Act (CCPA), for example. Using a globally compliant secure messaging tool your business is at risk of being fined at any moment.

3) Open source for security and endless customization options

Being an open source software means that the code is available for everyone to see, adjust and improve. When it comes to secure messaging, it’s better to count on a great number of developers who are ready to tackle the security breach very quickly.

Unlike closed source tools, like WhatsApp, Slack and Microsoft Teams, open source alternatives are constantly under review and creating a secure digital workplace. Besides that, they allow more customizations as you can edit the code and tailor it in order to attend your demands.

Learn what are the biggest benefits of open source software.

4 - Feel secure through self-hosting deployment

Being able to choose whether to run the software on your infrastructure or in a cloud is also a very important requirement you should take note of.

In order to ensure secure messaging for your teams and customers, you shouldn’t depend on other companies’ servers. Through self-hosting deployment, you have more protection for your data storage and control of user permissions.

Own your data and create a secure digital workplace

At Rocket.Chat we believe that trust in a product is essential so that’s why we created a platform with the most advanced security features. Besides being open-source and globally compliant, Rocket.Chat brings secure messaging and videoconference tools to your fingertips.

In case you have doubts, consultation is on us! We are here to help you keep your team communication secure. Shoot us an email and talk to our team!