Signal or WhatsApp for business: continuity, data control and POPIA
Signal and WhatsApp protect the content of your messages with the same encryption, the Signal Protocol. The difference is everything around the content: how much each service keeps about who you are and how you use it, who it shares that with, and what happens to your business's conversations when a phone is lost or an employee leaves. Signal keeps almost nothing about its users and is run by a nonprofit. WhatsApp keeps usage and device information and shares it with other Meta companies. Noiz prefers Signal. This article explains why, and how to make either app safer for client work.
Your business chats probably live on someone's phone
Most businesses never chose a chat app. Staff started using WhatsApp because clients did, and over time quotes, approvals, delivery addresses and complaints moved into chats on personal phones. That makes two questions important:
- Who owns the account? The account belongs to whoever controls the phone number behind it.
- Where does the history live? If it lives only on one phone, it is one accident away from being lost.
When a phone is lost or a person leaves
WhatsApp ties each account to a primary phone, with up to four linked devices such as a computer. History can be backed up to a Google or iCloud account, but the backup is tied to both the phone number and that Google or Apple account. WhatsApp is testing its own cloud storage, which it says is always end-to-end encrypted. Google or iCloud backups are end-to-end encrypted only if you switch that on.
Signal keeps your history on your devices: a primary phone plus up to five linked devices, including Signal Desktop for Linux, macOS and Windows. Signal's optional Secure Backups restore your message history to a new phone after loss or theft. They are end-to-end encrypted and protected by a 64-character recovery key that Signal never sees. The free tier covers all text messages and the last 45 days of media. Lose the recovery key and the backup cannot be opened by anyone, Signal included.
Either way, a person who leaves with their own number leaves with the account and its history. That is not a flaw in either app. It is a question of who owns the number. For business conversations:
- Use business-owned numbers for work accounts, not staff members' personal ones.
- Keep any backup keys or passwords with the business, not only with the employee.
- Keep a record of client instructions and decisions outside chat, in email or a ticket system, where the business controls it.
What each service keeps about you
Signal publishes every government request it receives that it is allowed to disclose, and its responses. Time after time, the only information it has been able to provide about an account is when it was created and when it last connected. Signal says it cannot decrypt messages or calls, stores encrypted messages only until they are delivered, and encrypts profile names and pictures. A feature called sealed sender hides who sent a message from Signal's own servers. Signal's code for its apps and server is published under the GNU Affero General Public License, so anyone can check how it works.
WhatsApp also cannot read message content, and deletes messages from its servers once delivered. Its privacy policy describes other information it collects: which features you use, the time, frequency and duration of your activity, your groups, your device and network details, your IP address and an approximate location. It shares information with other Meta companies, including to personalise offers and adverts across Meta's products.
Neither approach is hidden. Both companies describe what they do. The question is how much you want a third party to hold about your business's conversations, and Signal's answer is: as little as possible.
WhatsApp Business: who is responsible for client data
WhatsApp's terms for the WhatsApp Business app make the business the controller of its customers' data, with WhatsApp processing it on the business's behalf. The business must give its own privacy notices and obtain any consents.
There is one more detail. Some businesses choose to have Meta store their messages, or use Meta's AI to reply. WhatsApp says chats with those businesses are labelled and are not treated as end-to-end encrypted. If you use those features, your customers' chats are no longer protected the way they may assume.
What POPIA asks of you
The Protection of Personal Information Act (POPIA) applies to business use of any chat app. The relevant parts, in plain words:
- Collect only what you need for the purpose (section 10).
- Keep it no longer than necessary, then delete it (section 14). Client history scattered across staff phones is hard to delete on time.
- Protect it with appropriate, reasonable security measures (section 19).
- Operators. A service that processes personal information for you must keep it confidential and secure, under a written contract (sections 20 and 21).
- Transfers abroad. Section 72 limits sending personal information to third parties in other countries, so check whether it applies to client information you send through any chat service.
In 2025 South Africa's Information Regulator and WhatsApp settled a dispute over WhatsApp's 2021 privacy policy update, with WhatsApp agreeing to improve the transparency information it gives South African users. Neither app makes a business compliant on its own; how you use it does. This is general information, not legal advice.
Making Signal work for a team
- Give each work account a business-owned number, and turn on Signal's registration lock with a PIN, so nobody else can register the number on another phone.
- Use Signal usernames to talk to clients without sharing your phone number. Signal hides numbers by default.
- Turn on Secure Backups and store the recovery key in the business's password manager.
- Install Signal Desktop on work computers, including GNU/Linux, where WhatsApp offers no desktop app, only WhatsApp Web.
- Use encrypted group calls and screen sharing for meetings that should stay private.
- Use disappearing messages with care. Signal itself notes they do not protect against someone photographing a screen, and some business records must be kept by law.
Switching without losing anyone
You do not have to move everyone at once. Start with the conversations that carry the most sensitive information: clients' identity documents, banking details, contracts, staff matters. Keep WhatsApp for contacts who are not ready to move. Download Signal from signal.org and invite colleagues and clients one by one.
Talking to Noiz
You can reach Noiz on Signal or WhatsApp for short messages. For anything that needs a record, email us or open a ticket. Our help page lists every way to reach us, and the support guide explains which to use when.
Sources
Checked 19 October 2026. General information, not legal advice.
Signal
- Signal, Government communication (subpoena responses)
- Signal, Terms and privacy policy
- Signal, Technology preview: sealed sender
- Signal, Phone number privacy and usernames
- Signal, Introducing secure backups
- Signal Support, Backups and device transfers
- Signal Support, Linked devices
- Signal Support, Signal PIN and registration lock
- Signal Support, Disappearing messages
- Signal, WhatsApp's Signal Protocol integration is now complete (2016)
- Signal source code
- Signal downloads
- WhatsApp privacy policy
- WhatsApp, About end-to-end encryption
- WhatsApp, About backups and Google Drive backups
- WhatsApp, Linked devices
- WhatsApp, Account bans
- WhatsApp terms for the WhatsApp Business app
- WhatsApp desktop downloads
Law and the Regulator
- Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)
- Information Regulator, media briefing on WhatsApp (13 November 2025)
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
