Is WhatsApp Business End-to-End Encrypted? E2EE vs At Rest

Is WhatsApp Business end-to-end encrypted? It depends on who runs the business side of the chat: a phone running the WhatsApp Business app, or Meta's Cloud API and the software connected to it. This guide explains end-to-end encryption vs encryption at rest and in transit, compares WhatsApp, Instagram, Messenger, Telegram and Viber as of September 2026, and shows how to test a vendor's security claims.

Key Takeaways

End-to-end encryption (E2EE) is about who holds the keys, not where data sits: only the endpoints in the conversation can decrypt the message.
The WhatsApp Business API (Cloud API) is not end-to-end encrypted by WhatsApp's own definition, because Meta hosts the business endpoint and decrypts incoming messages before forwarding them.
Instagram ended E2EE for DMs on May 8, 2026, and Messenger chats with businesses do not support E2EE.
Telegram chats are not end-to-end encrypted by default; only opt-in secret chats are. Viber excludes chatbots and business accounts from its default E2EE.
By design, an AI auto-reply platform has to read the messages it answers, so it cannot be zero-knowledge about them. Judge vendors on credential encryption, access control, retention and deletion.

End-to-end encryption vs encryption at rest vs in transit: who holds the keys

Encryption in transit protects data moving between two systems, such as a phone and a server, usually with TLS. Each server that receives it can decrypt it.
Encryption at rest protects data stored on disks, in databases or in backups. The service storing it typically holds the keys and can decrypt it whenever its software needs to.
End-to-end encryption means only the endpoints of the conversation hold the keys. Servers in the middle relay ciphertext they cannot read.

Encryption in transit plus encryption at rest is not the same as E2EE. That combination usually still lets the provider read the content, because in most setups the provider controls those keys. The real E2EE test is whether anyone other than the endpoints can decrypt the message.

Is WhatsApp Business end-to-end encrypted? App vs Cloud API

The WhatsApp Business app is end-to-end encrypted when the business runs it on its own devices with no Cloud API companion or vendor linked. The WhatsApp Business API (Cloud API) is not, by WhatsApp's own definition.

WhatsApp's Encryption Overview whitepaper (updated February 2026) says messages between WhatsApp users, including WhatsApp Business app users, use the Signal Protocol and count as end-to-end encrypted because each endpoint is a device its user controls.

Every WhatsApp chat uses the same Signal protocol. What changes the E2EE label is who operates the business endpoint. Cloud API has been hosted by Meta since 2021, and WhatsApp does not consider those chats end-to-end encrypted because messages are not delivered directly to an endpoint the business controls.

Meta's Cloud API data privacy documentation describes the flow:

The customer's app and Cloud API, acting for the business, negotiate Signal keys.
Cloud API decrypts incoming messages and forwards them to the business.
For replies, Cloud API encrypts the message with Signal before delivering it to the customer.
Meta acts as a data processor for the business, stores Cloud API messages encrypted at rest, and keeps them for a maximum of 30 days.

Cloud API's overview docs say webhooks are delivered over HTTPS protected by TLS.

So WhatsApp Cloud API still uses Signal encryption on the wire and encrypts messages at rest; it is simply not end-to-end, because Meta's servers handle the plaintext on the business's behalf. For the feature differences, see our WhatsApp Cloud API vs Business App comparison.

Is WhatsApp Business end-to-end encrypted with a vendor, companion link or AI inbox?

A chat with a WhatsApp Business app account is not always E2EE. According to the whitepaper, it loses that status when:

The business links Cloud API as a companion to its WhatsApp Business app, which has been possible since 2024. Those one-to-one chats are shared with Meta for processing.
A vendor operates the business's WhatsApp Business API. That vendor has access to the business's private keys, even when the vendor is Meta, so WhatsApp does not treat those chats as end-to-end encrypted.

WhatsApp shows the customer a system message in the chat when the status changes. The On-Premises API, whose self-hosted endpoints counted as end-to-end encrypted, is gone: its final client, v2.63, expired on October 23, 2025, and Meta now directs businesses to Cloud API.

In practice, if you answer WhatsApp at scale through an API, a Business Solution Provider or an AI inbox for WhatsApp, your chats are not ones WhatsApp classes as end-to-end encrypted.

What happens when an AI chatbot or CRM reads your WhatsApp messages

Can an AI chatbot read end-to-end encrypted messages? Only if it sits at an endpoint that receives the decrypted text. With Cloud API, the path looks like this:

The customer's phone encrypts the message with Signal.
Meta's Cloud API decrypts it for the business.
A webhook delivers it over TLS to the business's platform: a CRM, helpdesk or AI inbox.
The platform stores the conversation and passes the text to an AI model to draft or send a reply.

At step 4 the message is readable inside the vendor's systems, whatever encryption at rest that vendor uses. Two things are true at once: the chat is encrypted on the wire, and your CRM can read it.

Instagram DMs after May 8, 2026: no end-to-end encryption

Are Instagram DMs end-to-end encrypted in 2026? No. According to the Instagram Help Center, Instagram stopped supporting E2EE messaging on May 8, 2026. The feature was always optional, turned on per chat and never the default. Meta pointed users who want E2EE to WhatsApp.

If you run AI replies on Instagram, treat those DMs as not end-to-end encrypted.

Facebook Messenger: personal chats vs chats with businesses

Meta began rolling out default E2EE for personal one-to-one Messenger chats and calls on December 6, 2023. The Messenger Help Center lists products that don't currently support E2EE, including chats with businesses, accounts using business messaging tools and Marketplace chats.

So Messenger end-to-end encryption does not cover a customer's chat with a Facebook Page that uses an inbox or chatbot.

Telegram cloud chats, secret chats and bots

Is Telegram end-to-end encrypted by default? No. The Telegram FAQ describes two chat types:

Cloud chats, the default, use client-server encryption and are stored encrypted on Telegram's servers so they sync across devices.
Telegram secret chats use end-to-end encryption. They are one-on-one, tied to specific devices, don't sync and are not the default.

Bots work in cloud chats. The official Bot API lists chat types as private, group, supergroup and channel, with no secret-chat type. Since Telegram Business launched in March 2024, businesses can connect bots that answer messages on their behalf, but those bot conversations are not secret chats.

Viber private chats vs Viber business accounts

Viber's privacy policy says end-to-end encryption protects one-on-one calls and messages, group messages, private media sharing and linked devices, and Viber says it is on by default. The exception that matters for businesses is in Viber's public content terms: content in Communities, Channels, Chatbots and Business Accounts is not end-to-end encrypted, and Viber stores it.

Encryption by channel: comparison table (September 2026)

Channel	Personal chats E2EE by default	Business or bot chats E2EE	Who can process business messages	Source
WhatsApp Business app (no API, no vendor)	Yes (Signal)	Yes	Business's own devices	WhatsApp whitepaper
WhatsApp Cloud API or vendor-run API	Yes (Signal)	No	Meta as processor, the business, connected platforms	WhatsApp whitepaper, Meta docs
Instagram DMs	No (opt-in E2EE ended May 8, 2026)	No	Meta, the business, connected tools	Instagram Help Center
Facebook Messenger	Rolling out by default since Dec 2023 (personal one-to-one)	No	Meta, the business, connected tools	Messenger Help Center
Telegram	No (secret chats are opt-in)	No (bot chats are cloud chats)	Telegram servers, bot operator	Telegram FAQ, Bot API
Viber	Yes	No (chatbots, business accounts)	Viber, business administrators	Viber privacy policy and terms

Why AI auto-reply platforms cannot be zero-knowledge

Zero-knowledge encryption means a provider stores your data without ever holding the keys to decrypt it, so it cannot read the content.

An AI auto-reply product works the other way by design. To answer "Do you deliver to Erbil tomorrow?", the model has to read the question in plaintext, check your knowledge base and write a reply. The logic is direct: a system that reads messages to answer them can always read them.

A vendor advertising a "zero-knowledge AI inbox" or an "end-to-end encrypted AI chatbot" is either stretching the terms or not running AI on your messages. The useful questions are about limiting who and what can reach the readable data.

How to evaluate vendor encryption claims

Red flags:

"End-to-end encrypted" applied to an AI chatbot or a WhatsApp Cloud API inbox.
"All data encrypted" with no list of what is encrypted or who holds the keys.
"Military-grade" or "bank-grade" with no algorithm, scope or key management detail.
Certification badges with no certificate or audit report you can request.

Questions to ask:

Which fields are encrypted at the application level, and with which algorithm?
Are channel access tokens and AI provider keys encrypted, and where is the key kept?
Is message content encrypted at the application level, or only credentials and selected fields?
Which vendor staff can view customer conversations, and is that access logged?
How long are messages kept, and what does account deletion actually remove?
Which AI providers receive message text, and under what data-use terms?

What Raabt encrypts and secures today

Raabt is an AI auto-reply platform, so the same logic applies to us: our AI reads message text to write a reply. That means Raabt is not end-to-end encrypted, and by the definition above no AI inbox can be. Here is what is in place today:

Field-level encryption: credentials, tokens and selected contact details (phone, email, address) are encrypted with AES-256-GCM, using a key derived via HKDF-SHA256. This covers connected channel access tokens for Facebook, Instagram, WhatsApp and Telegram, plus AI provider API keys. The app refuses to start without a key of at least 32 characters.
Passwords and codes: passwords are hashed with Argon2id, partner API key secrets are stored only as SHA-256 hashes, and one-time codes are stored only as HMAC-SHA256 hashes.
Sign-in: email and password sign-ins require a one-time code sent to your email before a session is issued.
Team access: four roles (owner, admin, agent, viewer) with per-section permissions, and business endpoints first confirm the caller is an active member of that business.
Webhooks and media: Meta webhooks are rejected unless their X-Hub-Signature-256 signature is valid, Telegram webhooks require a secret token, and attachments are served only through expiring HMAC-signed URLs.
Deletion: Raabt supports Meta's data deletion callback, with a status link on the data deletion page. Account deletion takes your password plus an emailed code, and the account is immediately deactivated and its email anonymized.

Frequently Asked Questions

Is the WhatsApp Business API end-to-end encrypted?

No. WhatsApp's whitepaper says chats with businesses using Cloud API are not considered end-to-end encrypted, because Meta hosts the endpoint. Messages still travel to Meta with Signal encryption, and Meta decrypts them and forwards them to the business over TLS.

Can Meta read WhatsApp Business messages?

On Cloud API, yes: Meta's servers decrypt messages as the business's data processor, store them encrypted at rest and keep them for up to 30 days. On the WhatsApp Business app with no Cloud API link or vendor, no: chats are end-to-end encrypted between devices.

Can an AI chatbot read end-to-end encrypted messages?

Only when it receives the decrypted message at an endpoint. On WhatsApp Cloud API, Instagram, Messenger business chats, Telegram bots and Viber chatbots, the business side is not end-to-end encrypted, so the AI works with readable text.

What is the difference between end-to-end encryption and encryption at rest?

Encryption at rest protects stored data, and the service storing it typically holds the keys. End-to-end encryption keeps the keys only on the conversation's endpoints, so the provider relaying the message cannot read it.

Is Telegram end-to-end encrypted by default?

No. Default cloud chats use client-server encryption and are stored encrypted on Telegram's servers. Only secret chats, which are one-on-one and must be started on purpose, are end-to-end encrypted, and bot conversations are not secret chats.

Are Instagram DMs still end-to-end encrypted in 2026?

No. Instagram stopped supporting end-to-end encrypted messaging on May 8, 2026, and it was never the default, so treat DMs with business accounts as not end-to-end encrypted.

Ready to automate replies with channel tokens encrypted using AES-256-GCM? Start free.