Wire Blog

A whatsapp alternative for social care

press@wire.com (Wire) — Mon, 07 Sep 2026 11:56:19 GMT

It's a familiar story. A social worker gets a message from a client on a Saturday. A family needs to move a home visit. A colleague forwards a photo of a document that has to be dealt with before Monday. None of it goes through an official system. All of it goes through WhatsApp, because that is where the client already is, and because it works.

If you lead an IT or data protection team at a social care organization, you already know this is happening. You may have even tried to stop it. And you have likely found that stopping it is much harder than it sounds. But this isn't a story about careless staff. It's a story about a tool that solves a real, time-sensitive problem, and the gap it creates when the only tool that meets the need is one your organization cannot legally control.

Why care workers reach for WhatsApp

Social care runs on relationships, and relationships run on communication that is fast, personal, and low-friction. When a client is more likely to answer a WhatsApp message than a phone call or a letter, staff use WhatsApp. And care rarely happens one person at a time. A shift handover, a case discussion, a team covering a group of clients across several sites: this is continuous group communication, by its nature.

Ask why they use it, and the answer is almost always the same: it's where people already are. WhatsApp has more than two billion users. It is fast, familiar, and free. For a frontline worker trying to connect with someone who is hard to reach, while at the same time keeping a whole team informed, it's the path of least resistance.

So the people using it aren't the problem. They're just getting their jobs done as best they can by using the tool that works. The problem is that the tool was built for planning weekend trips and bachelor parties. It was never meant for handling case information about vulnerable people, shared across a team, every day.

Also read: WhatsApp's end-to-end encryption covers messages. It doesn't cover metadata, backups, or business messaging. Here's what's actually exposed.

Why this is different in social care

Every organization that uses consumer messaging for work takes on some risk. In social care, the risk is sharper, for two reasons. The first is the data. Conversations between care workers and the people they support touch some of the most sensitive information there is: health, family circumstances, financial hardship, legal status, children. Consumer messaging apps protect a one-to-one chat well enough. Protecting a group is a harder problem, and group is exactly what social care runs on: teams, shift handovers, coordination across multiple facilities. The security that covers a private message between two people is not automatically the security that holds when forty people across several sites are exchanging case information all day. At this scale, the encryption model itself starts to matter.

The second is the regulation, which in this sector runs deeper than general data protection. Across the EU, the GDPR already sets strict rules for handling health and personal data, and newer frameworks are raising the bar: NIS2 extends security and resilience obligations to many health and care providers, and the EU Data Act tightens control over where data can be accessed and by whom. In Germany the duty goes further still. Many care professionals are personally bound by confidentiality under Section 203 of the Criminal Code, where a breach is not a policy failure but a criminal offense. Church-affiliated providers answer to their own recognized data protection frameworks on top of that, the KDG for Catholic organizations such as Caritas and the DSG-EKD for Protestant organizations such as Diakonie. A WhatsApp message about a client is not only a governance gap. In this sector it can be a compliance breach, and for the professional who sent it, a personal legal exposure.

Why banning WhatsApp doesn't work

Most social care organizations have tried the obvious fix. They ban consumer messaging, issue a policy, and move on. It fails for a simple reason: a ban removes the tool without removing the need. Staff still have to reach clients who are only reachable on WhatsApp. They still have to coordinate quickly across shifts and sites. If the only sanctioned alternative is slower, more complicated, or does not work on the phone in their hand, they quietly go back to what works. The behavior does not stop. It moves out of sight, which is worse, because now it is happening against policy and with no visibility at all.

There's another reason bans fail that often gets missed: most of these workers don't have a company phone. They're using their own, the same device their family and friends are contacting. So any solution that depends on a managed corporate device, or asks someone to hand their personal phone over to IT, is dead before it starts. Whatever replaces WhatsApp has to work on the phone that's already in their pocket.

The organizations that actually close this gap do not do it through enforcement. They do it through replacement: giving staff something that is as easy as WhatsApp, but built to be governed and compliant.

What a real alternative looks like

This is the part that sounds harder than it is, and the clearest way to show it is with an organization that has already done it. The Dr. Georg Haar Foundation is a German nonprofit working in family and social services. Like most organizations its size, it had no large IT department and no budget for a multi-year technology project. What it had was a clear problem: staff were communicating with clients and families, and WhatsApp was no longer defensible under GDPR.

Its response was fast and led from the top. Rather than run a lengthy evaluation, the foundation piloted Wire with a small group, confirmed that staff could actually use it, and rolled it out across the organization. The deciding factors include: works on any device without tying communication to personal phone numbers, keeps work and private life separate, and simple enough that employees with no technical background could start immediately. The foundation especially appreciated that Wire separates private and professional data perfectly on a single personal device without requiring complex Mobile Device Management (MDM) profiles that may scare staff. Compliance stopped being something the organization hoped it had covered, and became something it could point to.

The same conclusion gets reached at the other end of the size spectrum, and it leads to the same place. IPW, a Swiss psychiatric provider, spent roughly two years formally evaluating its collaboration tools before concluding that a mainstream platform couldn't meet its obligations for patient data under Swiss law, even with the resources to make it work. It moved to Wire. Different organization, different scale, different process: same verdict, same choice. Tools that weren't built for the compliance reality of care can't be retrofitted into it.

Between these two sits the largest part of the sector: the regional networks and associations affiliated with Caritas and Diakonie, which face the same pressure with lean IT teams and centralized oversight from their own data protection offices. For them the question is not whether the WhatsApp gap needs closing. It is how to close it in a way that staff will accept.

Did you know?

5 categories of data on WhatsApp are not covered by end-to-end encryption, including metadata, backups, and business messaging. Read more about what WhatsApp's encryption actually protects.

From banning to replacing

The fix was never a stricter policy, it was giving them a governed tool that works the way WhatsApp does, on the personal phones they already carry. It also has to reach the families and outside professionals the work depends on, and Wire does that through a secure guest link or the web, with no app to install, no account to create, and no personal numbers exchanged.

Easy is only half of it, though. Any vendor can write "compliant" on a website; far fewer can point to an independent authority that has inspected the platform and cleared it for sensitive use. Wire is certified by the BSI, Germany's federal cybersecurity agency, for handling classified government information at the VS-NfD level. For a managing director or a data protection officer, that settles a question a vendor's word never can, and it's far easier to put in front of an auditor or a board. And because care is group communication, not one-to-one chat, Wire runs on Messaging Layer Security (MLS), the encryption standard built to hold at organizational scale rather than just between two people.

That's the whole point. Staff keep the fast, familiar experience they'd choose anyway, and the organization stops hoping it's compliant and starts being able to prove it. See how the Dr. Georg Haar Foundation made the switch, or explore Wire as a WhatsApp and Signal alternative.

Guide to Compliance Risks in Digital Collaboration

press@wire.com (Wire) — Sun, 06 Sep 2026 20:09:13 GMT

Compliance is one of the four risks enterprises face in digital collaboration, and it's the one most directly tied to fines, legal liability, and regulatory scrutiny.

1. What is compliance risk in digital collaboration?

Compliance risk in digital collaboration is the exposure to fines, legal liability, and lost accreditation that comes from using messaging, calling, conferencing, and file-sharing tools without the controls a regulator expects to see. It covers the gap between how a team actually communicates and what frameworks like GDPR, NIS2, HIPAA, and DORA require an organization to prove about that communication after the fact.

Compliance risk is generally expressed the same way as any other risk: risk = likelihood × impact. Likelihood rises with how many regulated conversations, decisions, and file transfers move through channels that were never built to produce an audit trail. Impact rises with the size of the fine, the length of the reporting deadline, and how much of a regulator's judgment about the organization's overall posture rests on the outcome of that one incident, which is often a poorly contained cybersecurity incident in the first place.

2. Why collaboration tools carry this risk specifically

The conversations regulators care about most now happen in the least formal places. A contract gets negotiated in a chat thread before it's signed. An incident gets triaged on a call before anyone opens a ticket. A vendor's access gets approved in a message that nobody archives. None of that used to sit inside the compliance perimeter, and the regulatory frameworks written in the past few years have closed that gap deliberately: NIS2 treats crisis communication as one of its ten required risk management measures, DORA expects a financial entity to produce communication logs during an ICT incident, and GDPR holds an organization accountable for how personal data moves through every tool it uses, not just the ones built for records.

A collaboration tool that can't produce a clean log, can't guarantee where data physically sits, or can't stay reachable when the primary system is the thing under investigation becomes the compliance gap itself, regardless of how well the rest of the security program is documented.

3. Compliance requirements collaboration tools need to meet

NIS2

NIS2 sets ten risk management measures that essential and important entities must demonstrate, and Article 21 names business continuity and crisis communication explicitly among them. An organization has to show it can coordinate and report during an incident, which means having a channel that stays available when the primary collaboration suite is the system that's down, a requirement our NIS2 Risk Management Checklist maps to concrete controls, one by one. Multi-factor authentication and secured voice, video, and messaging for operational and emergency use round out the same article, and Achieve NIS2 Compliance walks through what "essential" and "important entity" status actually requires in practice.

DORA

DORA applies to financial entities and the ICT providers that support them, and it organizes compliance around five pillars: ICT risk management, incident classification and reporting, resilience testing, third-party risk oversight, and threat intelligence sharing. The incident reporting pillar carries a specific bar: major ICT-related incidents need to reach senior management and regulators on a harmonized template, with audit trails and communication logs kept throughout, and the third-party oversight requirement adds its own layer, since financial entities have to map every ICT provider and account for concentration risk. DORA also intersects with NIS2 for ICT providers serving both financial and non-financial clients, which Reuschlaw's legal analysis describes as a "double impact" of overlapping obligations.

GDPR

GDPR's accountability principle means an organization has to demonstrate control over personal data, not just avoid losing it. That includes knowing where data is processed, who can access it, and how long it's retained, across whichever tool a conversation happens to run through. Cross-border data flows add another layer: transfers outside the EU need a valid legal basis, and that basis has gotten harder to rely on as EU-US data-sharing arrangements have come under repeated legal challenge.

Auditability

A compliance framework is only as strong as the evidence behind it. Regulators expect an organization to reconstruct what happened during an incident, not describe it from memory, which means exportable, SIEM-compatible logs matter as much as the policy that sits behind them, the same bar reflected in what a formal government-grade approval process looks like when auditability and access control are assessed directly.

Crisis communication compliance

Crisis communication sits at the intersection of every framework above. NIS2 requires it directly, DORA expects it during an ICT incident, and a strong crisis communication plan answers the practical question every framework asks in different words: can the organization coordinate, decide, and report while its main system is the one that's compromised? The same logic holds up against a live cyberattack, where the reporting window most frameworks now expect an organization to meet often runs on a 72-hour clock.

4. How to reduce compliance risk in collaboration

Run a compliance-specific audit

Most security audits check the network and endpoints, and skip the collaboration layer even though it carries just as much regulated material. A compliance audit should cover retention settings on every tool in use, export capability for logs and messages, where data physically resides, and who can access conversations that involve personal, financial, or classified information.

Learn from what's already gone wrong

Ransomware attacks against financial firms rose by nearly 10% in 2024, with an average recovery cost of $2.23 million, and a meaningful share of that cost traces back to incident response that couldn't move fast enough once the primary systems went down. The pattern repeats outside finance too: an organization's compliance posture is judged as much on how it communicated during an incident as on whether the incident happened at all.

Build a response plan that assumes the primary platform might be down

A compliance plan that only exists inside the platform under investigation isn't a plan. NIS2's crisis-communication requirement and DORA's incident-reporting pillar both assume a team can still coordinate and report when the system at the center of the incident is unavailable.

Best practice	Why it matters	How Wire delivers it
Keep audit logs detailed and exportable	Regulators expect an incident reconstructed with evidence, not described after the fact	SIEM-compatible, exportable audit logs, with Pydio Cells providing full application-level logging and Wire On-Prem supporting infrastructure-level logging
Maintain data residency and jurisdictional control	GDPR and NIS2 both hinge on knowing where regulated data is processed and stored	Flexible deployment models, including on-premises and EU-based hosting, aligned to ISO 27001 and ISO 27701
Run an out-of-band crisis channel	NIS2 and DORA both require the ability to coordinate and report when the primary system is the incident	A separate, always-available channel for crisis and emergency communication, used by militaries, government ministries, and enterprises worldwide
Scope access by role	Regulators expect access limited to what a role actually requires, not standing admin visibility	Zero-trust and zero-knowledge architecture, so no administrator or server has blanket access to message content
Review third-party integrations before approving them	DORA's ICT third-party risk pillar requires oversight of every vendor touching regulated data	Deployable on-premises or federated, removing dependence on ungoverned third-party SaaS
Encrypt communications end-to-end	Confidential legal, regulatory, and executive conversations need protection that holds up under scrutiny	MLS-based end-to-end encryption across messaging, voice, and video, at enterprise scale

5. Use case: crisis and incident communication

The clearest way to see compliance risk in practice is during an actual incident. A cyberattack takes down the primary collaboration suite, and the crisis team needs to coordinate response, brief leadership, and prepare a regulatory notification within a fixed window — DORA's is four hours for major ICT incidents, NIS2's reporting clock starts even sooner. None of that works if the only available channel is the one that's compromised.

An out-of-band, NIS2-ready channel needs end-to-end encryption across every conversation, a channel that stays reachable independent of the primary suite, multi-tenancy so external responders or regulators can be looped in without breaching internal access boundaries, secure file sharing for evidence and reports, and cross-platform availability so the team can reach it from whatever device is on hand.

6. Standards this page draws on

Standard / regulation	What it covers
NIS2 Directive (EU) 2022/2555	EU baseline cybersecurity obligations, including the ten Article 21 measures and crisis-communication requirement
DORA — Regulation (EU) 2022/2554	ICT risk management and resilience for the financial sector, including third-party oversight
GDPR — Regulation (EU) 2016/679	Data protection, accountability, and cross-border transfer requirements
ISO/IEC 27001 & 27701	Information security and privacy management standards referenced across compliance controls
BSI VS-NfD	German classified-communications approval, equivalent to NATO Confidential

7. Closing

A few things worth holding onto from this guide:

Compliance risk comes down to likelihood and impact, and both are shaped by whether a collaboration tool can produce evidence, not just avoid incidents
NIS2, DORA, and GDPR each require something different in detail, and all three converge on the same practical need: a channel that stays available, logs what happens, and keeps regulated data under known jurisdictional control
The practices that reduce this risk are concrete: exportable audit logs, data residency control, an out-of-band crisis channel, scoped access, and end-to-end encryption by default

See how Wire applies these principles across messaging, calling, and file sharing →

Check NIS2 Readiness Get the Crisis Comms Guide Ensure Compliant Comms

" src="https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/26656555/interactive-303326177488.png" style="height: 100%; width: 100%; object-fit: fill">

Frequently asked questions

Is Your Texting HIPAA Compliant? A Complete Guide

press@wire.com (Wire) — Thu, 27 Aug 2026 17:53:44 GMT

Text messaging has become one of the fastest and most convenient ways for healthcare professionals to communicate, and that speed is exactly why it creates compliance risk. Most consumer apps are not HIPAA-compliant, and texting through those apps creates risks for your organization.

Critical National Infrastructure: Security, Threats & Protection

press@wire.com (Wire) — Thu, 27 Aug 2026 16:35:35 GMT

Critical national infrastructure covers power grids, water systems, healthcare, financial networks, communications, transport, and other infrastructure where disruption can have serious consequences for the nation.

Cybersecurity Risk in Digital Collaboration: A Guide

press@wire.com (Wire) — Thu, 27 Aug 2026 15:46:39 GMT

What is cybersecurity risk in digital collaboration?

Cybersecurity risk in digital collaboration is the exposure to harm or the potential loss that comes from using messaging, calling, conferencing, and file-sharing tools to run day-to-day work. It covers the potential for data theft, unauthorized access, service disruption, and compliance exposure tied to a compromised, misconfigured, or ungoverned collaboration tool. The risk includes deliberate attacks such as phishing or credential theft, and non-malicious causes such as human error or a misconfigured third-party integration.

Enterprise Cyber Security Solutions: Technologies, Challenges & 8 Best Practices

press@wire.com (Wire) — Wed, 26 Aug 2026 19:24:57 GMT

Enterprise security is becoming more complex because companies have more users, devices, cloud services, and third-party applications to protect than ever before. Many successful attacks still exploit basic security gaps across these environments rather than sophisticated vulnerabilities.

OpenAI's Messages Plugin: What It Means for iMessage Privacy

alex.henthorn-iwane.ext@wire.com (Alex Henthorn-Iwane) — Wed, 26 Aug 2026 07:18:41 GMT

OpenAI's new Apple Messages plugin gives ChatGPT access to the Messages application on a Mac. Once enabled, users can ask ChatGPT to find conversations, summarize them, draft replies, and send messages.

AT&T and Verizon China Hack: End-to-End Encryption is Critical But Not Enough

alex.henthorn-iwane.ext@wire.com (Alex Henthorn-Iwane) — Fri, 21 Aug 2026 14:06:53 GMT

The recent revelations of China’s hack of western telecommunications providers across multiple countries are a red flag for corporate and government leaders who care about their sensitive data. The exfiltration of massive amounts of Internet data from western mobile and fixed line networks tells us that end-to-end encryption of internal data is table stakes, and that data protection requires a zero-trust, zero-knowledge, and post-quantum-friendly approach.

The Four Risks That Enterprises Must Consider in Digital Collaboration

alex.henthorn-iwane.ext@wire.com (Alex Henthorn-Iwane) — Thu, 20 Aug 2026 14:58:19 GMT

Digital collaboration, including messaging, conferencing, and content collaboration, has become the connective tissue of modern organizations. But for IT, cybersecurity, and compliance leaders, that connective tissue has also become a growing liability because of a gap between their perceptions and the reality of risk.

As reported in Wire’s recent State of Secure Collaboration research report, 84% of IT and security leaders considered their collaboration environments to be secure, yet 48% also reported that sensitive conversations were routinely happening in insecure tools. In this article, we cover four converging risks that are forcing a fundamental rethink of how organizations build their digital workspaces, making the cost of inaction increasingly unacceptable.

Cyber Resilience Frameworks: How to build a strategy & best practices

press@wire.com (Wire) — Wed, 19 Aug 2026 10:35:16 GMT

Every organization will experience cyber disruptions at some point. The difference between companies that recover quickly from cyber attacks and those that face prolonged downtime often comes down to their cyber resilience.