Is the WhatsApp Business API End-to-End Encrypted?

The WhatsApp Business API is encrypted, but WhatsApp doesn’t count it as end-to-end encrypted. Messages travel between the customer’s phone and Meta’s Cloud API with the same Signal protocol as personal chats, then Cloud API decrypts them and passes them to the business, usually through a provider. Only chats with businesses on the WhatsApp Business app, or that store messages themselves, count as end-to-end encrypted.

That isn’t a security flaw. It’s how a business inbox works: a team can only read and answer a message once it has been decrypted somewhere outside the customer’s phone. This guide explains where encryption starts and stops, what customers see, what Meta and Automate AI store, and how to keep your WhatsApp setup safe.

The short answer: app vs API

End-to-end encryption means only the two ends of a chat hold the keys. On the API, one “end” is Meta’s Cloud API acting for your business, so the message is readable there and in the tools your business uses.

WhatsApp says an end-to-end encrypted chat can’t change its encryption status without the customer seeing it.

How a message travels on the Cloud API

Meta’s data privacy and security page describes the route. Following one message from a customer and the reply back:

1. The customer sends a message. It’s encrypted on their phone with the Signal protocol and travels through WhatsApp to Cloud API.
2. Cloud API decrypts it. The customer’s phone and Cloud API agree encryption keys, and Cloud API manages those keys for the business.
3. Cloud API sends it on to the business’s webhook. Meta’s About the platform page says sending messages through the Graph API and receiving events through webhooks both run over HTTPS protected by TLS.
4. Your provider stores it so your team can read it in the inbox. That’s where Automate AI comes in.
5. An agent replies. The reply goes to Cloud API over HTTPS.
6. Cloud API encrypts the reply with the Signal protocol before sending it to the customer.

Meta also says Cloud API messages at rest are encrypted, and that Cloud API only uses the messages it processes on behalf of, and at the instruction of, the business. More on the webhook side in WhatsApp Cloud API webhooks.

What your customers see in the chat

WhatsApp labels chats with businesses so customers know who handles their messages. Its Help Center describes these labels:

WhatsApp also points out that once a business receives a message, the business’s own privacy practices apply, and businesses may use chats they receive for their own marketing, including advertising on Meta. So your privacy policy should say you use WhatsApp, who processes the data and how long you keep it.

What Meta stores, and for how long

Meta’s data privacy page (also used in our WhatsApp GDPR guide) sets these limits for Cloud API:

• Messages: a maximum retention period of 30 days, to provide features such as retransmission.
• User identifiers: deleted within 30 days of a message’s last status update (sent, delivered or read), unless otherwise directed.
• Location: messages are processed in Meta data centres. With local storage, message content at rest is kept in a chosen country, though Meta says it may still be processed in its data centres elsewhere for up to an hour.
• No Storage: a local storage setting that holds message content and media only in transit, for up to one hour, with nothing kept at rest. The trade-off: message retries and webhook retries are limited to one hour (instead of up to 7 days for webhooks), and incoming media can be downloaded for one hour only.

No Storage and local storage are Meta options set on the phone number when it’s registered, and they cover only Meta’s copy. Automate AI’s Connect WhatsApp doesn’t set either, so if you need one, ask your provider whether it supports it before you connect. Your provider’s copy, and any tools you connect, sit wherever those companies store them.

What Automate AI stores

To show your team the full conversation, Automate AI keeps each message’s text, media and delivery status (sent, delivered, read or failed) on its servers, linked to the contact. That’s what makes the shared team inbox, search, reports and campaign results work.

• Some settings are stored encrypted, such as your number’s two-step PIN, the codes behind two-step login and Razorpay keys.
• Deleting a contact removes it together with its chats, campaign history and follow-ups (checked for our GDPR guide).
• Retention: Automate AI’s privacy policy says customer data is kept while the business’s account is active, then deleted on request.
• Other copies you create: exports, webhooks to your own systems, and any AI tool you connect through AI Connections. What an AI tool reads goes to that AI company.

Like every Cloud API provider, Automate AI can’t make API chats end-to-end encrypted, because the inbox needs to read the messages. What it can do is limit who sees them.

Control who on your team can read chats

Once messages are decrypted for your business, your own access settings decide who sees them. In Automate AI:

Remove people the day they leave, and don’t share one login across a team. One account per person is what makes the activity log useful. See WhatsApp Business for multiple users.

What never to send or ask for in a chat

Encryption doesn’t make every kind of data suitable for WhatsApp. The WhatsApp Business Messaging Policy says not to share, or ask people to share, full payment card numbers, financial account numbers, personal ID card numbers or other sensitive identifiers (as covered in our WhatsApp forms guide).

• Payments: send a link to a secure payment page instead of asking for card details.
• Logins: never ask for passwords or one-time codes. Send official codes only with authentication templates.
• Health: clinics can confirm a date and time without asking what’s wrong.
• Documents: if you must collect an ID document for a legal reason, use a secure upload page, not the chat.

A security checklist for your WhatsApp API setup

1. Ask everyone with access to turn on two-step login in their own Settings › Security, and to keep their backup codes somewhere safe.
2. Keep your number’s two-step PIN private. See the WhatsApp two-step verification PIN.
3. Give each person the smallest role they need, and hide customer numbers from agents who don’t need them.
4. Check your business portfolio admins in Meta Business Suite, and remove anyone who has left.
5. Protect access tokens and API keys. Never paste them into screenshots, chats or front-end code.
6. Decide where chats may be copied: exports, webhooks, spreadsheets and AI tools, and write it in your privacy policy.
7. Set a retention period and delete old contacts and chats on schedule.
8. Check data location before connecting if a regulator or customer requires data to stay in one country: Meta’s local storage covers only Meta’s copy, so ask your provider whether it supports it and where it keeps its own copy.