My phone stopped working this morning. Within minutes I had lost access to every WhatsApp conversation I was in the middle of — including active client threads — and there was nothing I could do about it from any other device.
Most businesses have made WhatsApp critical infrastructure without ever deciding to. Client enquiries, approvals, support requests, scheduling — it all accumulates there because it is convenient. But convenient is not the same as dependable, private, or legally sound. This article examines WhatsApp through the three lenses that matter most to a business — continuity, data control, and compliance — and makes the case for moving that communication to Signal.
What is Signal?
Signal is a free, open-source messaging application built by the Signal Foundation, a non-profit. It is not owned by an advertising company, it carries no ads, and it is funded by donations and grants. It runs on Android, iOS, Windows, macOS, and Linux. Its encryption is so well regarded that WhatsApp itself licenses Signal’s protocol — the difference between the two products is everything built around that shared protocol, and that is what the rest of this article is about.
Continuity: you can lose access overnight
WhatsApp ties your account to a single physical phone, and that access can be taken away from you in two ways.
The first is account suspension. WhatsApp bans and locks accounts regularly, often with no clear reason and no effective route of appeal. I have had this happen — an account holding years of client history, gone, with no path to recovery. For a business, that is not an inconvenience; it is the sudden loss of a communication channel and all of its records at once.
The second is the device itself. WhatsApp’s account identity is anchored to a phone. If that phone breaks, is lost, or is stolen — as mine did this morning — access stops until a replacement is in hand and the account re-registered. WhatsApp’s linked devices help, but they are companions to the phone; the account still lives and dies with it. For Linux users there is not even a proper desktop client — tools like Whatsie are wrappers around WhatsApp Web and do not carry your chat history.
Signal handles this differently. Signal Desktop is a genuine native application — not a browser wrapper — available for Windows, macOS, and Linux alike, so Linux users get a real client with full chat history rather than a browser tab. A linked Signal desktop keeps working while your phone is offline, and Signal is actively developing a fully standalone desktop client that will not require a phone at all. Your access to your own conversations should not be hostage to one fragile device staying intact and in your pocket.
Data control: your data is not in your hands
WhatsApp is owned by Meta, a company whose business is advertising. The contents of your messages are encrypted, but the metadata around them is not protected in the same way — who you contact, when, how often, and from where. Metadata alone is enough to map a business’s relationships, clients, and working patterns, and Meta’s privacy policy permits WhatsApp data to be shared across the wider Meta group. When the platform carrying your client communication is run by an advertising company, the confidentiality of that communication is not fully in your hands.
Signal is built on the opposite premise. Every message, call, and file is end-to-end encrypted by default, with no unencrypted mode to fall back to. More importantly for a business, Signal collects almost nothing. When it was subpoenaed by a US grand jury, the only data it could produce was the date the account was created and the date it last connected. There was nothing else to hand over. A feature called Sealed Sender means even Signal’s own servers cannot see who is messaging whom.
Because Signal is open source — its client and server code are both public — these claims are verifiable rather than promised. Independent researchers can and do audit it. WhatsApp’s code is closed; its security is something you take on trust. Signal’s is something you, or anyone, can check. For organisations with stricter requirements, Signal can also be configured to route traffic through your own proxy server.
Compliance: where it becomes a legal problem
This is where the argument moves from good practice to legal exposure.
Because Meta is a United States company, WhatsApp falls under the US CLOUD Act (2018), which lets US authorities compel American companies to hand over data wherever in the world it is stored — including on servers inside the EU. That sits in direct tension with GDPR. Data hosted in Dublin or Frankfurt but controlled by a US corporation remains reachable under US law. Data residency is not the same as data sovereignty.
This is not theoretical. In May 2023 the Irish Data Protection Commission fined Meta €1.2 billion — the largest GDPR penalty on record — for unlawfully transferring EU user data to the United States. That case concerned Facebook, but it is the same company, the same US jurisdiction, and the same transfer exposure that govern WhatsApp.
The EU Data Act, fully applicable since September 2025, responds directly to this conflict: Chapter VII requires providers operating in the EU to take measures preventing unlawful non-EU government access to data. For Irish businesses, NIS2 — being transposed through the National Cyber Security Bill — adds cybersecurity risk-management duties across a widening range of sectors. Routing sensitive operational communication through a platform under foreign jurisdiction is a risk-management weakness under that regime.
For South African businesses, POPIA imposes comparable obligations. Its purpose-limitation principle sits awkwardly with a platform that feeds communication metadata into a global advertising operation, and POPIA’s rules on cross-border transfers require the destination to offer adequate protection — something the CLOUD Act’s reach directly complicates.
Signal, as a non-profit that stores no metadata, has effectively nothing to compel and no commercial incentive that puts it at odds with regulators. For any business with genuine compliance obligations, that is a material difference.
If your business operates in a regulated sector and you would like to understand your communication security obligations more fully, Noiz’s cybersecurity services include communication security assessments.
What you gain day to day
None of this comes at the cost of usability. Signal is a fully featured messaging app, and several of its features are genuinely useful for business:
- Screen sharing during calls: Share your screen, or ask a client to share theirs, during a support call or consultation — without bringing in Zoom or Teams, and with the call still fully encrypted. For remote support and onboarding this is a practical, private alternative to platforms that capture session data of their own.
- Disappearing messages: Set messages to delete automatically after a configurable period, per conversation — useful for keeping sensitive exchanges from accumulating indefinitely.
- Usernames: Communicate using a username instead of exposing your personal phone number to clients and contacts.
- Encrypted group calls: End-to-end encrypted group voice and video for team and client calls.
Anyone who can use WhatsApp can use Signal. The interface is familiar within minutes.
Making the switch
The one real obstacle is that Signal has fewer users than WhatsApp, so switching means asking the people you communicate with to install it. The answer is not to move everything at once. Start with your most sensitive conversations — clients handling confidential information, your accountant, your legal contacts — and keep WhatsApp for the contacts who are not ready yet. The balance shifts over time as more of your network adopts it.
Signal is free, and installing it takes about two minutes: https://signal.org.
Noiz’s position
Noiz uses Signal exclusively for internal communication and recommends it to clients. That is not a philosophical preference — it is a decision based on who controls the platform, what it collects, what jurisdiction it answers to, and how easily access to it can be lost.
If you want help moving your team to Signal, or a broader review of how your business communicates and where that creates exposure, get in touch.
