Secure staff messaging

What “secure” has to mean for staff messaging

The NCSC does not tell organisations which product to use. Its guidance on choosing an enterprise instant messaging solution asks them to assess the “security features provided by the IM service. This includes end-to-end encryption and enterprise single sign on”, and in the same breath reminds them that “regulated industries and public sector organisations may have additional strictures to comply with, including the need to audit communications between staff, or respond to Freedom of Information requests.” Its secure communication principles start with “Protect data in transit” and include “Provision for secure audit of the service” and “Allow administrators to securely manage users and systems”.

Secure staff messaging is offered in three main forms, and an organisation often needs more than one:

• Collaboration platforms in the workspace you already have. Microsoft Teams or Google Chat, for staff with work accounts, managed by your own administrators and within reach of your own retention and search. For internal communication between office staff, this is usually the right answer and costs nothing more.
• Secure team messaging built for frontline staff. People added by mobile number rather than a work account, channels the organisation controls, and removal on the day someone leaves.
• End-to-end encrypted messengers sold to organisations. The strongest confidentiality from the provider, with the record trade-off described below.

For a school, a nursery, a charity or a care provider, those principles become five practical questions: who can read a message, who can join a conversation, what happens when a phone or an account is lost, where the record is, and what the supplier is allowed to do with it. The rest of this guide takes them in turn.

Encryption: which kind, and what it costs you

Almost every serious messaging service encrypts something. The question that separates them is where the keys are, and so who can read the content:

• Encryption in transit protects a message between the device and the service, usually with TLS, the same protection a banking website uses. The service receives the message and can read it.
• Encryption at rest protects stored messages on the service’s disks. The service still holds the keys, so it can show a message to an authorised person, search it or keep it.
• End-to-end encryption means only the devices at each end hold the keys, so the service in the middle cannot read the content at all.

End-to-end encryption is a strong defence against interception and against the provider. It also means the organisation has a copy of its own only if the product adds an archive as a participant or someone exports it, because a service that cannot read a message cannot file, search, keep or produce it. Neither choice is wrong. Decide which matters more for the conversations you are choosing for: confidentiality from the provider, or a record the organisation holds. Our guide to encrypted messaging for business works through the trade-off in more depth.

Check one: accounts, devices and who can join

An attack on a messaging account need not break the encryption at all, as the NCSC warns: it can add someone to the conversation instead. In March 2026 the NCSC warned, in NCSC warns of messaging app targeting, of attackers who “trick you into sharing login or account recovery codes”, “add their own device to your account without you noticing” and “join group chats without detection”. Ask any supplier:

1. Who can add people to a conversation? The organisation should decide, and should be able to see the members of every work channel and group chat.
2. Can access follow roles? Role-based access controls let a manager see what their role needs and no more, and keep external partners in the conversations they were invited to.
3. How do people sign in, and how are new devices noticed? Ask about passkeys or two-step verification, single sign-on through your identity provider for staff who have work accounts, and whether a person is alerted when a new device signs in to their account.
4. How are administrators protected? An administrator account that can read or export everything needs stronger protection than anyone else’s.
5. What happens when a phone is lost? Can the person, or the organisation, sign the account out everywhere at once?
6. What happens when someone leaves? Can the organisation remove them from every channel on their last day, and does the history stay with the organisation?
7. What about personal phones? Most frontline staff and volunteers will use their own. The tool should keep work messages separate from personal apps; for phones the organisation issues, the NCSC’s device security guidance describes how to manage them. Our guide to a bring your own device policy covers the rest.

Check two: the record, retention and telling staff

A staff message can decide something about a person: a pupil, a resident, a volunteer, a member of staff. If it may have to be produced, the organisation has to be able to find it. A subject access request must normally be answered within one month, and the ICO’s right of access guidance makes clear that this includes information held in emails and messages. A public authority, such as a maintained school or academy, may also have to answer a Freedom of Information request, and the ICO’s guidance on non-corporate communications channels says that where staff use instant messaging, “auto-delete options should be in line with the retention policies of your official systems”.

Security and compliance pull in the same direction here. A message in which a member of staff raises a safeguarding concern, or a decision taken out of hours, is often the most critical record an organisation holds about an incident, and the hardest to find if it lives on one person’s phone rather than in a messaging platform the organisation controls.

So ask: who sets retention policies, the organisation or the product? Can an administrator search and export the message history of a whole conversation, with who said what and when? Is a deleted or edited message recorded in an audit log? Do file sharing, voice and video calls follow the same rules as text messages? And who, other than the people in a conversation, can read it, and is that access itself recorded?

Then tell staff. A record that people know about is good governance; one they discover later damages trust. The ICO’s guidance on monitoring workers says “Workers have the right to be informed about the collection and use of their information”, and that you “must tell workers about monitoring in a way that is accessible and easy to understand”. Write into the staff messaging policy what is kept, who can see it and why.

Check three: the supplier, the contract and who it reaches

A supplier that hosts the messages is a processor, and Article 28 of the UK GDPR requires a written contract that sets out what it may do with the data, its security, its sub-processors, and deletion or return at the end. Read the sub-processor list and where each one processes data, not only the headline about where messages are stored, and ask whether there are international transfers. Where data is stored is sometimes sold as data sovereignty; the contract and the sub-processor list are what establish it. Some suppliers offer a private cloud or on-premises deployment, which can suit a large organisation with its own security team and moves that work to you. Ask what independent security certification the supplier holds today, as distinct from what it is working towards, and check any certificate on the certifying body’s own register.

Do a data protection impact assessment where the messages carry sensitive information or concern vulnerable people. The ICO’s guidance on when to do a DPIA says “in most cases, a combination of two of these factors indicates the need for a DPIA”.

Finally, check reach and usability, because a secure tool that some staff cannot use is not the one they will use:

• People without work accounts. Supply staff, bank and agency workers, volunteers and trustees often have no account on the organisation’s systems. If the tool’s identity is a work account, they are the ones left on the consumer app.
• Working hours. Can people silence work notifications outside the hours they work?
• The least confident user. Pilot the tool with them, on an old phone, not with the person who chose it.
• Leaving. Ask how the record comes back if you stop paying, in what format, and how long the supplier keeps it.

Where ComplyChat fits, and where it does not

Start with what it is not. ComplyChat is not end-to-end encrypted, by design: the organisation has to be able to hold the record. If your staff all have work accounts and nothing they say has to be produced later, the chat in the office software you already pay for may serve you better. ComplyChat is working towards Cyber Essentials and ISO 27001 certification and holds neither yet; our Why us page says so.

It is built for staff conversations that have to be kept and that include people with no account on your systems. A mobile number verified by SMS is the identity, so frontline staff, bank workers and volunteers can be added without a work email account, and on paid plans your organisation chooses who can start a direct message. Everyone added to a channel is told it is on the record and can object or leave. Messages travel over an encrypted connection (TLS) and are written into the record as they are sent, and the working copy is encrypted at rest. Every new sign-in, and every passkey added, sends an alert to the member’s other devices that have notifications turned on, and sign out everywhere signs a member out on every device and removes their passkeys. On paid plans, removing someone from your organisation also signs them out and removes their passkeys. Each person can choose the hours they work, so notifications stay quiet outside them.

On a connected paid plan, conversations are kept in your organisation’s own Microsoft 365 subscription, under the retention schedules you already run, and the filed archive stays there if you leave. That needs your organisation’s own Microsoft 365; people joining conversations do not need Microsoft accounts. Core messages are stored and processed in the UK, and the supporting services that may process data elsewhere are named on the service providers and locations page.

Prices are flat per tier. Foundation: £199/month or £1,990/year, 2 channels. Governance: £599/month or £5,990/year, 10 channels. Enterprise: from £1,500/month or from £18,000/year, unlimited channels. Yearly plans are invoiced in advance. All prices exclude VAT where applicable. No per-person or per-message charges. Setup included. Free is for personal conversations: one private group channel, direct messages and up to 25 people, three calendar months of recent history and no Microsoft 365 archive or Replay, so it cannot meet a retention duty. If your organisation needs to meet its retention schedules, that needs a paid plan and your own connected Microsoft 365 subscription.

Whatever you choose, take one question to the next leadership meeting: if a member of staff left today, which work conversations would leave with them on their phone, and which would stay with you?

Questions people ask

What is considered secure messaging?

Secure messaging is messaging that protects content in transit and at rest and lets the organisation control who can join, read and keep a conversation. The NCSC’s secure communication principles start with “Protect data in transit” and include “Provision for secure audit of the service” and “Allow administrators to securely manage users and systems”, so encryption alone does not make a service secure for work.

What is the most secure messaging app for staff?

The NCSC does not name a most secure messaging app: it asks organisations to assess the “security features provided by the IM service. This includes end-to-end encryption and enterprise single sign on”, against their own requirements. It adds the point consumer rankings miss: public sector organisations may need to audit staff communications or answer Freedom of Information requests, and “if data is held within IM applications that don’t permit enterprise audit, you may be unable to comply”.

What are the different types of secure messaging?

Secure staff messaging comes in three main forms: collaboration platforms in the workspace an organisation already has, such as Microsoft Teams or Google Chat, for staff with work accounts; secure team messaging built for frontline staff, who are added by mobile number rather than a work account; and end-to-end encrypted messengers sold to organisations. Each protects messages with encryption, but only the first two usually leave the organisation holding a record it can search and produce.

Do we have to tell staff their messages are kept?

Yes: the ICO’s guidance on monitoring workers says “Workers have the right to be informed about the collection and use of their information”, and that employers “must tell workers about monitoring in a way that is accessible and easy to understand”. Say in the staff messaging policy what is kept, who can see it and why.

Official guidance and your next step

Read the NCSC’s guidance on choosing an enterprise instant messaging solution and its secure communication principles, the ICO’s guidance on the right of access, on monitoring workers and on non-corporate communications channels, and Article 28 of the UK GDPR on processor contracts. Schools should also read the Department for Education’s digital and technology standards. The Data (Use and Access) Act 2025 has amended UK GDPR and the Data Protection Act 2018 in stages, so check the date on any ICO page you rely on.

This is a buying guide for UK organisations, not legal advice, and not an assessment of any particular product.

Then do one thing: list every messaging app your staff used for work last month, and for each, who administers it and who could produce a conversation from it tomorrow. The gaps in that list are your requirements.