Signal is American, so it's just like WhatsApp

Signal: why "American" is not a problem 🌍

Signal is developed by the Signal Technology Foundation, a non-profit organisation based in Mountain View.

Security does not depend on nationality, but on the governance model: the foundation was created specifically so that no pressure could come from acquisitions or investors who might have pushed the app towards advertising or data monetisation.

The fact that it is American matters little because:

• The code is open source (client and protocol), so anyone can verify it, regardless of where the company is based.
• Signal applies end-to-end encryption by default to everything, and does not keep metadata useful to a court order (the published "transparency reports" show how little they can actually hand over to the authorities).
• Being a non-profit removes the structural incentive to "sell" data to generate revenue.

Funding and sustainability 💸

Signal is funded by donations from individual users and by large contributions from supporters, including a founding loan from WhatsApp co-founder Brian Acton.

In 2024 the foundation reported about 29.4 million dollars in revenue against about 38 million in expenses — a deficit covered by the initial reserve and by ongoing donations.

This is Signal's structural weak point: it is not yet financially self-sufficient in the long term, and it depends on the generosity of donors and on Acton's initial capital.

It is a deliberately chosen "no ads, no data-selling" model, but its future sustainability is less guaranteed than that of a commercial giant.

WhatsApp: the difference 🔍

WhatsApp is owned by Meta Platforms, a publicly traded company whose business model is based on advertising and data collection (even though WhatsApp itself does not show direct ads in messages). Even though the encryption protocol used by WhatsApp is technically similar to the Signal Protocol, the difference lies in the company behind it:

• Meta has a structural economic incentive to collect metadata (who you talk to, when, how often, your address book) for its own advertising ecosystem, even if the content of messages stays encrypted.
• WhatsApp is profitable and financially rock-solid, being part of a giant worth hundreds of billions in market capitalisation.
• But it is a company that answers to shareholders, not to a declared privacy mission; policies can change (as already happened with data sharing with Facebook in 2016).

Certifications

Neither Signal nor WhatsApp holds formal public-facing "security" certifications as a main selling point; trust is based above all on:

• Independent audits of the code and of the cryptographic protocol (the Signal Protocol has been analysed academically many times, since it is public).
• For Signal, the complete openness of the source code (largely including the server) allows continuous verification by the security community.
• WhatsApp is closed-source, so you have to trust (spoiler: I don't) Meta's statement that it uses the same protocol, without being able to verify the implementation directly.

In short: trusting public source code is feasible, but when we talk about the internal implementations of the WhatsApp app you just have to trust them, a bit like we did with Santa Claus as kids.

The real question I'm asking you today is: do you still believe in Santa Claus? 🧐