WhatsApp Business
Communications API · business.whatsapp.com · last read 2026-10-12
Identity
| Legal entity | WhatsApp LLC |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | WhatsApp Ireland Limited |
| LEI | 984500DBD07752F00118 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | whatsapp.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | developers.facebook.com | 2026-10-09 |
EU: The optional data_localization_region parameter enables local storage of data-at-rest, with "EU (Germany): DE" listed as a supported value. The document names no plan and no cost for it.
Subprocessor chain
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · whatsapp.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | other |
| Notice of new subprocessors | Advance notice of sub-processor changes, subject to applicable law; period and method not stated |
| If you object to one | If the objection is reasonable, the customer may tell WhatsApp in writing and stop using the Business Services |
| Breach notification | without undue delay |
| Audit | On request, the information and assistance reasonably necessary to show compliance; no on-site audit stated |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| ISO 27001 · ISO27001 | Claimed | Cloud API | developers.facebook.com | 2026-10-08 |
| SOC 2 Type II · SOC2T2 | Claimed | Cloud API | developers.facebook.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · WhatsApp LLC | Active | non-HR data | 2027-01-23 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · WhatsApp LLC | Active | non-HR data | 2027-01-23 | 2026-10-09 |
| Global LEI Index (GLEIF) | WHATSAPP LLC · WHATSAPP LLC | ISSUED | US-DE | 2027-08-01 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under WhatsApp Business; WhatsApp Ireland Limited; WhatsApp LLC
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under WhatsApp Business; WhatsApp Ireland Limited; WhatsApp LLC
- Data Privacy Framework List (US): checked 2026-10-12, 2 entries under WhatsApp Business; WhatsApp Ireland Limited; WhatsApp LLC
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under WhatsApp Business; WhatsApp Ireland Limited; WhatsApp LLC
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under WhatsApp Business; WhatsApp Ireland Limited; WhatsApp LLC
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under WhatsApp Business; WhatsApp Ireland Limited; WhatsApp LLC
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: facebook.com (security.txt, expires 2026-11-11; read 2026-10-12)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| dpa-de | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-09 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.