Summer 2026
WhatsApp, on the record.
Your teams already run on WhatsApp. We move those conversations onto a number your organisation owns – same app, nothing to install, nothing to learn – and capture every message into your own Microsoft 365 tenant, where it is answerable the day a regulator, a relative or a tribunal asks.
Your charity is already having the conversations. None of them are governed.
WhatsApp lives in your care homes, your frontline teams, your fundraising threads, your trustee chat. Your DPO knows. Your IT director has tried to stop it. The conversations happen anyway – just outside everything you bought to keep the organisation safe.
Then one morning it surfaces. A solicitor's letter asks for "all WhatsApp messages concerning my mother". A safeguarding review needs a thread that lives on the personal phone of someone who left in March. An inspector asks how handover decisions are recorded, and the only honest answer is "on people's own phones".
You can spend another year fighting the culture. Or you can govern the channel your people refuse to give up.
Three doors everyone tries. None of them hold.
Write the policy. Send the memo.
The chats don't stop; they go quiet. Risk you could at least see becomes risk you can't, and the next incident arrives with "and they knew" attached to it.
Roll out the approved app.
Teams, Slack, a "secure messenger". Adoption lasts a fortnight, the night shift never moves, the families never join. Now you run two channels: one official and empty, one real and invisible.
Hope the letter never comes.
The cheapest option, right up until the morning it isn't. This strategy ends with a Subject Access Request, a tribunal order or an inspection finding – and it picks the date, not you.
Don't fight WhatsApp. Govern it.
Keep the app every member of staff, every volunteer and every family already uses. Move the conversations onto a number the charity owns. Capture everything, disclose everything, and be able to answer anything. Same habit, new ownership.
Four steps. Then it just runs.
Stand up a governed channel
A WhatsApp Business number your organisation owns, in your own Meta Business portfolio. Staff and families message it like any other contact – same app, nothing to install.
Bring your people across
We set up your conversations, relay groups and invites, and supply the staff and family comms. Membership is controlled centrally: one click in, instant removal when someone leaves.
Every message captured
Each message flows through the official API into your own Microsoft 365 tenant, where your Purview retention, legal hold and eDiscovery govern it like any other record. Disclosed to members, never covert.
Search, hold, answer
Subject Access Requests, safeguarding evidence, retention and litigation holds – answered from the compliance tooling your organisation already runs, in hours not weeks.
Built for the people who have to answer for it.
A number the charity owns
Conversations run on your organisation's WhatsApp Business number, not a volunteer's personal phone. The channel survives staff churn, phone upgrades and awkward exits.
Joiners in, leavers out, instantly
Add and remove members by API. When someone leaves, they're out of every governed group before they reach the car park. No more "who still has access to that chat".
Every message, in your own tenant
Captured through the official API into your Microsoft 365 tenant – not ours. Your Purview retention, legal hold and eDiscovery govern WhatsApp like any other record, from day one.
SARs answered in an afternoon
Search by data subject across every governed channel. Redact, package, deliver inside the statutory month. A workflow built around ICO guidance, for charity DPOs.
Holds that survive deletion
Messages are archived the instant they are sent – the API offers no delete-for-everyone takeback – and Microsoft 365 litigation hold preserves them through any purge attempt. A trustee-ready evidence trail.
Your tenant, not ours
The archive never lives with us. Leave, and there is nothing to hand back – the records were always yours, in your tenant, under your keys and your access controls.
We're building this with ten organisations. Be one of them.
We're a young company with a strong opinion and a working product. We won't show you logos we don't have. What we need now is ten organisations who live this problem every day – and we're paying properly for the privilege.
Founding partners get the product at half price, the founders on a first-name basis, and a real say in what gets built next. In return we ask for the one thing money can't buy at this stage: your honest, public word that it works.
- Half price for two years, then today's list price locked for life
- White-glove setup: Business API onboarding and migration of every group, done for you
- The trustee pack on day one: DPIA template, privacy notices, staff and family comms, board briefing
- A named line to the founders and a vote on the roadmap
- In exchange: a reference call and a case study, once we've earned them
The Answerable Guarantee
If a Subject Access Request touches your governed channels and you can't produce the WhatsApp side within one working day, our team does it with you, free. If we still can't, we refund your year. The product has one job; this is us betting on it.
The no-hostage clause
Leave whenever you like. Full export in open formats within fourteen days, a certificate of deletion, no exit fees. If we're not earning the renewal, we shouldn't have it.
"A named line to the founders" is not a metaphor. I'm Terry Sullivan, I built this, and I read everything sent to enquiries@chat.org.uk myself. If you'd rather take our measure before booking anything, write to me directly.
Pricing built for charities and care providers. No mystery line items.
Every number here is the number you pay. No platform fees, no inflated seat counts, no setup hidden in the small print. You pay for staff seats; everyone you serve joins free. Annual billing saves around two months on Foundation and Governance, onboarding is on us, and founding places take half off both – Enterprise founding terms are agreed in conversation.
- Up to 40 staff seats
- Unlimited volunteers, families & residents
- Up to 15 governed groups – relay or native
- Archive in your own Microsoft 365 tenant, audit logs included
- Unlimited self-serve search & export · 2 managed SAR responses / year
- Onboarding & group migration included (annual plans)
- Email support, 48-hour response
- Up to 250 staff seats
- Unlimited volunteers, families & residents
- Unlimited governed groups – relay or native
- Bulk export in eDiscovery-ready formats
- Unlimited self-serve search & export · 15 managed SAR responses / year
- Retention & hold policy set-up, done for you
- Quarterly compliance reports
- Phone support, next-day response
- Unlimited staff seats & groups
- Unlimited volunteers, families & residents
- Unlimited managed SAR responses
- Purview retention & hold configuration across every site
- Multi-site numbers & per-site archives
- Bespoke integrations (care management, HR, M365)
- Named success lead & SLA with credits
- Onboarding & migration across every site included
What we won't promise. And nobody honest can.
Read personal phones.
Nobody can, lawfully. A vendor who says otherwise is selling you a data breach with a dashboard. Governance starts where ownership starts: on a number the charity controls.
Absorb your existing groups.
The official API can't join groups it didn't create. We migrate you forward instead, with the rollout plan, invites and policy templates to make the switch stick.
Monitor anyone covertly.
Every governed group is disclosed to its members, with the wording supplied by us. Disclosure is what makes the archive usable as evidence and your position defensible.
Claim "zero knowledge".
Governance and zero knowledge are mutually exclusive. Your archive lives in your own tenant, readable by your authorised administrators – and we say out loud what that does and doesn't mean.
Built the way a charity DPO would design it.
We operate to the standards your trustees expect, and a few they don't yet ask about. Every claim on this page is independently auditable, and where we're still earning a certificate, we say so.
Designed to ISO 27001
Information security mapped to ISO 27001:2022 controls from day one. Independent certification on the roadmap.
Cyber Essentials path
Targeting certification under the UK NCSC scheme. Increasingly expected by funders and public sector partners.
UK data residency
Your archive lives in your own UK-region Microsoft 365 tenant; capture runs in UK-region Azure. Every third party – Azure for transient capture, Meta's WhatsApp API, Stripe billing – is disclosed in our sub-processor list.
Your archive, your tenant
The record sits in your Microsoft 365 tenant under your access controls, your retention and any Customer Key encryption you run. We hold no copy to lose.
GDPR by design
DPIA templates, Article 30 records, lawful basis register. Built in, not bolted on.
Disclosed capture only
No covert monitoring. Members are in a charity-owned group and told it is governed. Lawful and ethical by default.
Questions worth asking.
Find out where you stand before someone asks.
A 30-minute risk audit with our team. Bring your messiest scenario. You leave with a one-page, board-ready summary of your WhatsApp exposure and a straight answer on whether we're the fit – even if that answer is no.
Not ready for a call? Ask for the trustee briefing instead – one page on WhatsApp exposure, written for boards, no follow-up unless you ask for one. Request the briefing