Security you can verify.

How it connects

Each number joins as a linked device through WhatsApp's own mechanism, the one WhatsApp Web uses, by QR code or pairing code. We never ask for your WhatsApp password, verification codes or SIM. The session runs on our managed servers: your browser talks only to app.mobileb.net, and the connection to WhatsApp comes from our infrastructure, not from your device. Your phone keeps talking to WhatsApp as it always has. For numbers linked since 15 August 2026 the device appears as "MobileB" in your Linked devices list; numbers linked earlier show a generic browser name until you link them again.

Your phone keeps running WhatsApp, keeps calls, and must reach WhatsApp now and then to keep the number registered, as WhatsApp requires of every linked device.

What we can read, and why

Like every linked device, our session decrypts messages to show them to you. That happens on our managed servers, tied to your account. It is what makes search, sharing, scheduling, agents and push notifications possible. For conversations where you want content sealed from us too, enable advanced security.

No administrator screen shows a user's chats, messages or media; the operator tools cover accounts, plans, health and deletion. Operators with database access could read ordinary conversations, which is exactly the case advanced security exists for.

What we store

• Your account: email, display name, a salted and peppered password hash (argon2id), and the address and browser of each sign-in. If you sign in with Google, the identifier and email Google returns.
• Each linked number: its linked-device credentials, label, color, sync state, and whether WhatsApp has restricted its sending.
• Messages and media for linked numbers, so your history is identical on every device. This includes messages sent from the phone, and, where the plan includes it, messages the other side later deleted or edited. WhatsApp normally withholds view-once content from linked devices, so MobileB records the marker and tells you to open it on your phone; if the payload is delivered, MobileB retains and labels it. Disappearing messages are stored as ordinary messages because MobileB does not honor WhatsApp's disappearing timer.
• Private contact names, tags, wallpapers, preferences, shares and their audit trail.
• Agent activity for 90 days, as references to messages, never copies.
• Short operational logs, rotated by size, without message bodies or tokens.

What we never do

• No advertising, no data brokers, no profiles built from your messages.
• No third-party scripts, fonts or analytics on the app or on this site: the content security policy allows scripts, styles, fonts and images from our own origin only, so this is enforced, not promised.
• Place search and map tiles go through our servers, so OpenStreetMap sees our address and the place you typed, never yours.
• No reading or classifying of conversations for any purpose other than delivering them to you and to the people and agents you explicitly grant.

The controls you keep

• Unlink from MobileB. The session ends and the linked-device credentials are removed, with retries until WhatsApp confirms. The stored history stays until your account is deleted, which you request by writing to us from the account address.
• The kill switch on your phone. WhatsApp, Linked devices, log out MobileB. It takes effect as soon as WhatsApp reports it, whether or not you can reach us.
• Shares and agent grants. Revoke any time; the next request is refused.
• Account deletion. Write to hello@mobileb.net from the account's address. Access is blocked at once; records and media are removed by a durable, asynchronous job.

Advanced security

An optional second end-to-end layer between two MobileB users: keys only on their devices, a fresh key per message, padded envelopes, files sealed with their names inside, and a server that holds no key. It stores the ciphertext as an ordinary message and records only which conversations are protected and who turned that on, so it can refuse plain sends into them. It protects content against a breach or subpoena of our servers and against a future break of WhatsApp's layer. It does not hide that two people are talking, and it cannot protect an unlocked phone. The full design, including what it does not do.

How we operate

• The app runs under a database role that cannot change the schema. Migrations are checksum-bound and applied once, by hand, before a release; the API verifies the ledger at boot and refuses to run otherwise.
• A restore-verified database backup is a required input of every deploy.
• Every push runs lint, type checks, the build, the full API suite against a real PostgreSQL, 267 web tests, and the copy lint for this site.
• The login uses argon2id with a server-side pepper, 15-minute access tokens held in memory, and rotating refresh tokens that detect reuse. Sign-in throttling is per address.
• Webhooks from the WhatsApp session are signed. Media is content-addressed, stored outside the web root, and served only to the owner or an accepted share.
• Two incidents have written reports: an API outage on 18 August 2026 after a database hardening step, with no data loss, and a deploy accident on 20 August 2026, recovered with no data loss. Both changed the release process; the changelog carries the dates.

Open risks

• WhatsApp can remove a linked device. We notice within about a minute and ask you to scan again. The cause is not fully understood, and we say so.
• WhatsApp Web's protocol can change. The session engine tracks the current version, but a change can stop every session until the engine is updated.
• The API runs as one instance by design; a restart is a brief interruption for everyone.
• Off-host backups are built and tested but not yet an active production control.
• There is no second factor on the MobileB login yet, and no list of signed-in devices with remote sign-out. A password reset ends every session.
• Advanced security depends on the code we serve. A malicious change to it could affect future messages, which is inherent to a web app; earlier messages stay protected.
• MobileB holds no security certification and offers no data processing agreement yet. Off-host backups are built and tested but not yet an active control.

Reporting a vulnerability

Write to hello@mobileb.net with enough detail to reproduce it. We read every report and answer the ones that identify a real weakness. /.well-known/security.txt carries the same address.

Changes to this page

• 21 August 2026: rewritten for the new site. Transport-cipher wording removed; "what we can read" stated; advanced security described as built; open risks and incident history added.
• 9 August 2026: first version.

MobileB is an independent product and is not affiliated with, endorsed by or supported by WhatsApp or Meta. WhatsApp's own terms apply to your use of WhatsApp.