Guide · Compliance · For the owner whose bank, clinic or IT team wants the paperwork

When your compliance team asks if WhatsApp is certified: Meta's SOC 2, ISO 27001 and GDPR pages, the sub-processor list, and the 90-day deletion rule

Before a bank, a clinic or a large company lets its customers talk to it on WhatsApp through a proper system, someone on the compliance or IT side usually sends a questionnaire: is it certified, who processes the data, where is it stored, and what happens to it when you stop. Meta publishes most of the answers itself. This guide puts those pages into plain words: the Compliance Center, the SOC 2, SOC 3 and ISO 27001 pages, the GDPR notes, the Cloud API Terms with their 90-day deletion rule, the list of companies that run Meta's data centres, and WhatsApp's own Trust & Safety and Business Privacy pages.

Published 15 October 2026

Where Meta keeps the paperwork

Meta runs a Business Messaging Compliance Center. In Meta's words, it is there to help with compliance and reporting by sharing information and easy access to documentation. For WhatsApp, it lists:

For the Cloud API: A SOC 2 Type II page, a SOC 3 page, an ISO 27001 page and a GDPR page. The Cloud API is the version of the WhatsApp Business Platform that Meta hosts, which a business's own system connects to.
For the Marketing Messages API for WhatsApp: A SOC 2 Type I page, an ISO 27001 page and a GDPR page. As its name says, it is for marketing messages.
Regional documents: Documents tied to rules in India and Brazil, for each of the two APIs, which this guide skips.

Our reading

Every certificate on the Compliance Center names the Cloud API or the Marketing Messages API, both hosted by Meta. None names the WhatsApp Business app on a phone, so these pages describe the setup where your number runs through Meta's hosted system.

SOC 2 Type II and SOC 3 for the Cloud API

SOC reporting is a framework set by the American Institute of Certified Public Accountants for reporting on a company's internal controls. Meta's SOC 2 page says the Cloud API, hosted by Meta, is certified under SOC 2 and keeps strict data handling governance. Meta also says it runs regular penetration testing and documents its controls through the Cloud Security Alliance's standard questionnaire.

What the SOC 2 Type II report covers: The Security, Availability and Confidentiality criteria: from how Meta secures its platforms and data centres to how it checks the identity and background of its employees.
How to get it: Meta says the latest report is available on request, subject to a non-disclosure agreement, and to ask your sales or account contact at Meta for a copy.
SOC 3, the public version: A public report that summarises the SOC 2 Type II report, downloadable from Meta's SOC 3 page. It includes the independent auditor's opinion on Meta's internal controls over Security, Availability, Processing Integrity, Confidentiality and Privacy.

Our reading

Send the SOC 3 first: anyone can download it, and it often answers the first question. If the reviewer insists on the full SOC 2 report and you have no contact at Meta, ask the provider that connected your number how they can help you request it.

ISO 27001, and the Marketing Messages API

Meta's ISO 27001 pages say both the Cloud API and the Marketing Messages API for WhatsApp, hosted by Meta, are certified under ISO 27001, the international standard for information security management systems. Meta says the certification gives an independent validation of how its security management programme is designed and how well it works. The certificate can be downloaded from each page.

For the Marketing Messages API, Meta's SOC 2 page lists a SOC 2 Type I report covering Security, Availability and Confidentiality. It too is available on request, subject to a non-disclosure agreement.

Our reading

A reviewer who sees "Type I" for marketing messages and "Type II" for the Cloud API will ask why. Quote Meta's pages as they stand, and send the question to Meta rather than answering it yourself.

What Meta's GDPR page says

GDPR is the European Union's data protection law. Meta's GDPR page for the Cloud API sets out how Meta acts when a business uses it:

Meta as processor: The Cloud API, hosted by Meta, is offered as a data processor to business customers, and Meta says its agreements give customers the contractual commitments GDPR requires from a processor, plus commitments on security.
Trained staff: Members of the Cloud API team are trained on Meta's role as processor or sub-processor.
Transfers: Meta and WhatsApp rely on GDPR-compliant transfer mechanisms when they move data from the EU or the UK to the US.
Servers: The Cloud API runs on Meta's data centres in the US and the EU, unless a business has chosen to store data in a specific country with Cloud API Local Storage.
Government requests: The page points to Meta's Transparency Center for how Meta responds to government requests for data.

Our reading

This is EU-law material. It doesn't say anything about UAE or Saudi law, but its questions (who is the processor, where are the servers, how is data moved abroad) are the same ones a Gulf questionnaire asks, so it makes a useful template. Your own lawyer decides what your local law needs. How long messages are kept and how Local Storage works are covered in Who can read your WhatsApp business messages, and what WhatsApp gives governments in Does WhatsApp read or sell your business chats?.

The Cloud API Terms: who owns the data and what Meta may do with it

The legal side is in Meta's WhatsApp Business Platform Cloud API Terms, last updated on 23 September 2026. In plain words:

You keep your rights: Between you and Meta, the business keeps its rights in the content and data it provides through the Cloud API, and gives Meta the right to use that content to run, secure and provide the Cloud API to the business.
What personal data includes: In particular: phone numbers, message content, personal identifiers, and message details such as type and time.
What Meta may do with it: Meta says it will not keep, use or share that data except to provide the Cloud API, unless it has the business's permission, the law requires it, or the terms allow it. The business also instructs Meta to process it to provide and improve the Cloud API, to store numbers for the contact book while that is turned on, and to give insights and metrics, including link tracking.
Aggregated data: The business instructs Meta to aggregate or anonymise the data to improve the Cloud API and other Meta Business Suite tools that work with it, for Meta's internal benchmarking and analytics, and to give analytics back to businesses.
Safety use: Meta may use the data as a controller to keep the Cloud API safe and secure and to enforce its terms and policies.
Controller and processor: The business is the controller and Meta Platforms Ireland Limited is the processor, unless the business is in the United States, Canada or Brazil, where Meta Platforms, Inc. is the processor.

The terms also say it is the business's sole responsibility to work out its own legal obligations.

Our reading

For a business in the UAE, the processor named in these terms is Meta's Irish company. Put that name and the terms' date in your questionnaire, and check the date again before each review, because the terms say Meta may update them from time to time.

The 90-day deletion rule

The same terms set out what happens to the data when a business stops using the Cloud API:

Within 90 days: Once the business stops using the Cloud API and any outstanding delivery is complete, Meta will delete any remaining personal data within 90 days, unless the law requires it to keep it longer.
Or returned: Instead, the business can ask Meta to return all of that personal data, unless the law requires otherwise.
Account data: When the terms end, Meta deletes data related only to the Cloud API from the business's accounts, except data it keeps for a limited time for legal, financial, tax, record-keeping or audit reasons.
Backups: Deleted content may stay in backup copies for a reasonable period while the deletion is carried out.

Our reading

The 90 days is about what Meta holds. Copies in your own system, exports and staff phones are yours to delete, so your own retention policy still has to cover them.

The sub-processor lists

A sub-processor is a company the processor uses to handle the data. Exhibit B of the Cloud API Terms lists the companies Meta may use to run the data centres and data storage behind the Cloud API, in the US, Denmark, Sweden and Ireland. It adds Amazon Web Services, storing data in the business's own applicable country, but only for businesses that have Cloud API Local Storage turned on.

WhatsApp publishes its own Sub-Processors List as well. It names the Meta company that hosts and runs the WhatsApp Business service, and the same data centre and storage companies in the same four countries.

Our reading

Meta's GDPR page says the applicable list is either the one in the WhatsApp Business Data Processing Terms or the one in the Cloud API Terms. For the Cloud API that Meta hosts, the Cloud API Terms list is the one those terms point to, and it is the one that adds Amazon Web Services for Local Storage. Attach both if a reviewer asks for every list Meta publishes.

What WhatsApp's own pages say

WhatsApp's Trust & Safety page for businesses says:

Encryption: Every WhatsApp message, including messages between people and businesses, is protected by the same Signal encryption protocol from before it is sent until it is delivered.
Security: The Cloud API is hosted by Meta, which uses Defense in Depth: layers of protection so weaknesses in its code are prevented and dealt with from several angles.
Certification: The Cloud API is certified under SOC 2.
GDPR: The WhatsApp Business Platform lets businesses continue to meet their obligations under GDPR.

Where the Cloud API, hosted by Meta, sits in that path is explained in Who can read your WhatsApp business messages.

WhatsApp's Business Privacy page adds what customers are told:

What reaches Meta: When a business uses ads that click to WhatsApp, or sends offers or updates customers chose to receive, Meta may receive certain information. Message and call content is not shared with Meta.
Who hosts the chat: A business on the WhatsApp Business Platform can use Meta's hosting or work with a provider for its chats and hosting, and WhatsApp makes it clear in the chat which choice the business has made.
Customer controls: WhatsApp always makes it clear when people are chatting with a business, they can block a business at any time, and they can review their ad settings.
How WhatsApp makes money: By charging businesses for their conversations with customers.

If you're a clinic or a finance business

The certificates answer the security questions. What you may and may not send on WhatsApp is a separate set of Meta rules, covered in WhatsApp for a clinic and WhatsApp for a finance business. If the reviewer also asks how you would know about an outage, Meta's status page is explained in Is WhatsApp down, or is it us?.

What this means for your business

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats Meta's pages as we read them on 15 October 2026, and is not legal advice.

Our reading

A short checklist for the questionnaire: attach the SOC 3 and the ISO 27001 certificate, tell the reviewer that Meta makes the SOC 2 Type II report available on request under a non-disclosure agreement and let them ask how they can see it, quote the Cloud API Terms and their date, name the processor and the 90-day deletion rule, attach the sub-processor list, and say whether Local Storage is turned on for your number. Questions about your own system, your staff and your own copies of the data still need answers from you and whoever runs that system.

Questions

Is WhatsApp for business certified?

Meta's compliance pages say the Cloud API, hosted by Meta, is certified under SOC 2 (Type II) and ISO 27001, with a public SOC 3 summary, and that the Marketing Messages API for WhatsApp is certified under ISO 27001 and SOC 2 (Type I). None of these pages names the WhatsApp Business app.

How do I get Meta's SOC 2 report?

Meta says the latest SOC 2 Type II report for the Cloud API is available on request, subject to a non-disclosure agreement, from your sales or account contact at Meta. The SOC 3 summary can be downloaded from Meta's page.

Who is the data processor for the Cloud API?

Meta's Cloud API Terms say the business is the controller and Meta Platforms Ireland Limited is the processor, unless the business is in the United States, Canada or Brazil, where Meta Platforms, Inc. is the processor.

What happens to our customer data if we stop using the Cloud API?

Meta's terms say it will delete any remaining personal data within 90 days, unless the law requires it to keep it longer, or return it on request. Deleted content may stay in backups for a reasonable period while deletion is carried out.

Where are the servers?

Meta's GDPR page says the Cloud API runs on Meta's data centres in the US and EU, unless a business has chosen Cloud API Local Storage. The sub-processor list in the Cloud API Terms names data centre companies in the US, Denmark, Sweden and Ireland, and Amazon Web Services only for Local Storage.

Does Meta see our customers' messages?

Not for advertising: WhatsApp's Business Privacy page says message and call content is not shared with Meta when businesses use ads that click to WhatsApp or send updates. But when a business uses the Cloud API, Meta hosts it, and the Cloud API Terms list message content among the personal data the business makes available to Meta, which Meta processes for the business. How long it is kept is in the who-can-read guide linked above.

Who is BitByteCore?

BitByteCore is a verified Meta Tech Provider (since 9 September 2026). This guide repeats Meta's own pages, and is not legal advice.

Sources

Meta for Business: Business Messaging Compliance Center, read 15 October 2026.
Meta for Business: SOC 2 Type II for Cloud API, read 15 October 2026.
Meta for Business: SOC 3 for Cloud API, read 15 October 2026.
Meta for Business: ISO 27001 for Cloud API, read 15 October 2026.
Meta for Business: ISO 27001 for Marketing Messages API for WhatsApp, read 15 October 2026.
Meta for Business: SOC 2 Type I for Marketing Messages API for WhatsApp, read 15 October 2026.
Meta for Business: GDPR compliance for Cloud API, read 15 October 2026.
Meta: WhatsApp Business Platform Cloud API Terms (last updated 23 September 2026), including the list of agreed sub-processors, read 15 October 2026.
WhatsApp: Sub-Processors List, read 15 October 2026.
WhatsApp Business: Trust & Safety, read 15 October 2026.
WhatsApp Business: Business Privacy, read 15 October 2026.

This guide describes Meta's pages as we read them, and is not legal advice. More plain-language notes like this one are on the guides page.

Want customer conversations in one place you own?

We set up a business's WhatsApp number on a system its team runs, so every customer conversation sits in one place the business owns. A short call is the easiest way to see how that would work for you.

Book a demo