Every company that centralizes WhatsApp eventually discovers the same thing: the conversation history is its most sensitive asset. It contains personal data, negotiated amounts, special conditions, complaints, and the entire customer base. The question "who sees what" needs to be answered before a problem arises, not after.
In this article
The Four Real Risks
This is not paranoia: these situations frequently occur in growing operations that do not configure access properly.
1. Salesperson leaving with the customer base. The classic scenario. Someone leaves and takes contacts, negotiation history, and knowledge of which customers were about to buy. When WhatsApp is on their personal phone, the company loses not only the data but the entire relationship channel.
2. Excessive default access. System installed with everyone seeing everything. An intern sees the discount the commercial director approved for the biggest client, a support agent sees negotiations from another department. Rarely is there bad faith; most often sensitive information leaks within the company itself.
3. Uncontrolled export. The function to export contacts or conversations, available to any user, is the quietest way the database leaves the door.
4. Personal data where it shouldn't be. Documents, cards, exam photos, income proofs sent by clients via WhatsApp and stored indefinitely, accessible to those who do not need to see them.
The Four Access Levels
The structure that serves practically any small or medium-sized company has four profiles. More than that becomes bureaucracy; less than that becomes a problem.
Agent. Sees only conversations assigned to them and the unassigned queue of their department. Cannot export, delete, or see consolidated reports.
Supervisor. Sees all conversations of their team, redistributes service requests, monitors team indicators. Exports aggregated reports but not the contact database.
Manager. Full access to conversations and reports, including export, with records of who exported what and when.
Administrator. Configures users, permissions, integrations, and retention policies. Should be the rarest profile in the company—ideally two people, never just one, to avoid dependency on a single individual.
Continue reading for free
Fill out once and unlock this and all other blog articles. We charge nothing — we just want to know who we are writing for.
Takes 20 seconds. Prefer to talk directly on WhatsApp?
What Each Profile Should See
Beyond the level, four specific decisions often get overlooked in configuration.
Conversations of other agents. By default, no. The legitimate exception is the shared queue, where anyone can take an unassigned conversation — but taking it should record who took it.
Full phone number. This requires consideration. In operations with a history of data leaks, masking part of the number for the agent profile reduces risk without hindering work, since the conversation happens within the panel.
Exporting. Should be restricted to managers and always logged. It is the riskiest function in the entire system.
Deleting conversations and contacts. No one below administrator. And deletion should be logical — the record disappears from view but remains stored for the period defined by policy.
The principle that solves 90% of decisions: each person sees the minimum necessary to do their job. It’s not distrust — it’s reducing the surface for errors. Most data leaks don’t start with bad intent: they start with someone who had access to something they didn’t need.
What LGPD Requires in Practice
WhatsApp conversations with clients involve personal data processing, and some obligations apply directly to system configuration.
Purpose and minimization. Collect only what is necessary to serve and sell. Requesting documents by default, without need, creates liabilities without benefit.
Access control. The company must be able to demonstrate who accessed which data. This is exactly what good permission control delivers.
Defined retention period. Keeping conversations forever is the default but incorrect setting. Define how long each type of record remains available, based on business need and legal obligation, and enforce it.
Responding to data subject requests. Clients can request access, correction, or deletion of their data. There must be a defined process — who receives the request, response time, and how it is executed.
Consent record for marketing communication, which is covered in how to ask permission. Without it, sending messages carries double risk: regulatory and number blocking.
Contract with the provider. The system operator is a data processor. Verify where data is stored, what happens if you terminate the contract, and how data is returned.
Employee Offboarding Protocol
This is the most important and most neglected routine. Ideally, it should be executed on the same day of termination, in order.
- Revoke access to the panel immediately — before the termination conversation, not after.
- Redistribute active conversations to another responsible person, with notice to the client about who will now assist them.
- Close open sessions on other devices and change shared passwords, if any.
- Review secondary accesses: integrations, spreadsheets, cloud folders, emails with lists.
- Check recent exports made by that user in the last 90 days.
- Notify clients in the portfolio, including the name of the new responsible person. Silence here allows the ex-employee to resume contact outside the system.
This protocol works because the database is in the company’s system, not on someone’s phone — a condition that must be established beforehand and is the main argument for centralizing commercial WhatsApp. This topic is specifically addressed in when the salesperson leaves the company.
What to Do with Documents and Sensitive Data Sent by Clients
There is a category of content that arrives unsolicited and creates disproportionate exposure: document photos, proof of residence, cards, pay stubs, exams, reports. Clients send these for convenience, and they remain visible to anyone who opens that conversation, today and three years from now.
Four decisions solve this without hindering service.
Do not request via WhatsApp what can be collected elsewhere. A controlled storage form, whose link is sent through the conversation, solves collection without leaving the file in the service history.
Set a short retention period for attachments. If the document served a specific analysis, it does not need to remain indefinitely. A retention policy specific to files, shorter than that for text messages, greatly reduces exposure.
Restrict who can see attachments. Some systems allow separating permission to view the conversation from permission to open files. Use this when available.
Advise the team not to download. The greatest risk rarely lies in the system: it is in the agent’s computer downloads folder and personal phone gallery, where nothing is controlled and where the file survives after the person leaves.
It is worth noting that this is also a conversation with the client. A line in the service message — "for security, do not send passwords, full card numbers, or bank details here" — prevents the problem at the source and conveys care, which is exactly the impression you want to make.
The Record That Protects the Company
Besides restricting access, it is necessary to record what happened. Five events deserve permanent records: user logins and logouts, permission changes, data exports, deletions, and conversation transfers between agents.
This record serves three purposes: to investigate an incident with facts instead of assumptions, to demonstrate control during an audit or regulatory request, and — the most immediate effect — to discourage improper behavior because everyone knows it exists.
Who Owns the Number: The Decision That Precedes Everything
All permission discussions assume a condition many companies still lack: the WhatsApp number belongs to the company, not the person. While the salesperson uses their own device with their own SIM card, no access configuration protects anything — the database is by definition out of the company’s reach.
Migration to a corporate number often meets resistance, and there is a legitimate reason: the salesperson built relationships on that number and fears losing contact with clients. The effective approach acknowledges this instead of ignoring it. Keep the history visible to whoever serves so they don’t feel they lost their accumulated work. Explain the trade-off: with a company number, they are no longer interrupted on weekends, don’t have to respond late at night, and the queue is shared when they take vacation. And make the transition with client notice, with a message from the salesperson presenting the new channel.
It is worth noting that this decision is not only defensive. A company number allows service by more than one person, continuity when someone is absent, real measurement of response time, and history that survives turnover. Protecting the database is a consequence, not the sole objective — and that is why the conversation with the team is easier when approached this way.
Common Configuration Mistakes
Everyone as administrator. Happens during implementation, "to make it easier," and is never corrected. It is the riskiest possible configuration.
Shared login. Two or three people using the same access destroys any traceability and makes any investigation impossible.
Not reviewing permissions periodically. People change roles, projects end, and access remains. A thirty-minute quarterly review solves this.
Leaving export open. This function allows exporting the entire database with one click. Restrict and log it.
Ignoring personal phones. It is useless to configure the panel if half the team continues serving through their own devices, with the database in their phone contacts.
Security in service is not a technology project: it is four well-defined profiles, a written retention policy, an event log, and an offboarding protocol that someone actually executes. It takes an afternoon to configure and prevents problems that can cost years of customer base building.
Frequently Asked Questions
What access levels should a WhatsApp CRM have?
Four profiles serve practically any company: agent, who sees only conversations assigned to them and their department’s queue, without exporting or deleting; supervisor, who sees team conversations, redistributes service, and monitors indicators; manager, with full access and logged exports; and administrator, who configures users, permissions, and retention policies — a profile that should be held by two people, never just one.
What does LGPD require from those who store WhatsApp conversations?
Collect only what is necessary to serve and sell, be able to demonstrate who accessed which data, define and apply a retention period instead of keeping everything indefinitely, have a defined process to handle client requests for access, correction, and deletion, record consent for marketing communication, and formalize a contract with the system provider, verifying where data is stored and what happens upon termination.
What to do with access when a salesperson leaves the company?
On the same day: revoke panel access before the termination conversation, redistribute active conversations to another responsible person with client notice, close open sessions on other devices, review secondary accesses such as integrations and cloud folders, check exports made in the last 90 days, and notify clients in the portfolio about the new responsible person — silence here allows the ex-employee to resume contact outside the system.
Centralize service without changing your number
Connection via QR or official API, single queue with defined responsible, client history stored by the company, and sales funnel in the same WhatsApp panel.