Choosing secure messaging for client communication

Clients want to reach you quickly, and the quickest thing is usually a text to your personal cell. Before long, a domestic client is sending photos of a spouse’s car at midnight, an attorney is texting a witness’s new address, and your case file is split between your phone, your inbox and your notes.

This guide compares the common ways investigators message clients, explains what each one actually protects, and suggests a simple policy you can give clients on day one.

What you need from a messaging channel

For case communication, a channel should ideally do four things:

1. Keep the content private in transit and in storage, so neither network eavesdroppers nor the service provider can read it.
2. Confirm who you’re talking to, so a message “from the client” really is from the client.
3. Stay with the case, so the conversation is part of the record and not lost in your personal texts.
4. Be easy enough that clients use it. A secure channel nobody uses pushes everyone back to texting.

No single option is perfect on all four. The point is to choose on purpose.

The options, compared

SMS text messages

Standard SMS is not encrypted. CISA’s mobile communications guidance, written for people whose phones are likely targets, is blunt: “SMS messages are not encrypted,” and someone with access to a carrier’s network can read them. SMS also lives on your personal phone, mixed with everything else, and it’s easy to text the wrong contact.

Use it for: “Report is ready, check your portal” and appointment reminders. Nothing with case content.

iMessage and RCS

Apple’s iMessage is end-to-end encrypted between Apple devices, and newer versions of the RCS standard on Android can be too. But whether a given conversation is encrypted depends on both people’s devices and settings, and a message to a different kind of phone may silently fall back to SMS.

Backups matter as well. Apple’s security overview explains that, with standard data protection, when iCloud Backup is on, “your backup includes a copy of the Messages in iCloud encryption key.” In other words, the messages themselves are encrypted, but a copy of the key sits in a backup Apple can help you recover, unless you turn on Advanced Data Protection.

Use it for: quick logistics with clients who all use the same kind of phone. Treat it as better than SMS, not as a case record.

WhatsApp

WhatsApp messages are end-to-end encrypted by default. Chat backups to Google Drive or iCloud, though, are only end-to-end encrypted if the user turns that option on. You can’t control your client’s backup settings, and the conversation still lives on personal phones rather than with the case.

Signal

Signal is the option security professionals recommend most often. CISA’s guidance names it as an example of a free messaging app “that guarantees end-to-end encryption,” and suggests checking how much metadata any such app collects. Signal collects very little, and it lets both people compare a “safety number” to confirm they’re talking to the right person.

The drawbacks are practical: many clients don’t have it, it isn’t tied to a case, and messages can disappear (by design, if disappearing messages are on), which may not suit a conversation you need to keep. If you use it, save important messages to the case file.

Email

Ordinary email is encrypted between most mail servers in transit, but it’s stored readable by both email providers, forwarded easily, and a favorite route for impersonation. An email that looks like it’s from your attorney client asking you to send the report to a “new address” is a classic fraud. Email is fine for scheduling and for notifications. It’s a poor place for case detail, and a worse place for attachments (see sharing files securely with clients).

A client portal with built-in messaging

Many case-management tools include a portal where clients log in to see reports and send messages. The advantage is structural: the conversation is attached to the case, clients don’t need your personal number, and you can end access when the engagement ends.

The question to ask is who can read those messages. Some portals encrypt only in transit and on the vendor’s disks, so the vendor’s systems can read them. Others encrypt on the sender’s device so only the people in the conversation can. Our zero-knowledge encryption explainer covers the difference and the questions to ask.

How to verify who you’re talking to

Encryption protects content from outsiders. It doesn’t stop you from having an encrypted conversation with the wrong person.

• Confirm identity out of band the first time: a phone call to a number you already have, or in person.
• Compare safety codes when the app offers them (Signal’s safety numbers, or a portal’s equivalent), and pay attention when an app says a contact’s key has changed. Usually it’s a new phone. Occasionally it isn’t.
• Never act on a change of instructions (new delivery address, new payment details, “send it to my other email”) without confirming by phone.

A simple client messaging policy

Put this in your engagement letter or welcome email, so expectations are set before the first 11 p.m. text:

1. Where to message: “Please message me through [portal or app] for anything about your case. I don’t discuss case details by text or email.”
2. What text is for: “I’ll text you only to say a report or message is waiting.”
3. Response times: “I reply to messages within one business day. If I’m in the field, it may be the evening.”
4. Emergencies: “If you believe you or someone else is in danger, call 911 first, then call me.”
5. Your side: “Please don’t forward my reports or messages, and keep your device locked.”

Attorneys in particular value this. Pursuit Magazine’s piece on why attorneys don’t hire investigators puts responsiveness near the top of the list and urges investigators to “over communicate”. A clear channel makes that easier to do safely. Our guide to client communication for private investigators covers the cadence side.

If you inherit a messy channel

Most investigators already have case content scattered across texts and chat apps. You don’t need to fix the past overnight:

• From now on, move case discussion to one channel and say so.
• Save anything material from old threads to the case file (a screenshot or export, dated), then delete it from your phone when the case closes.
• Turn off message previews on your lock screen.
• Remove clients from personal group chats and social media connections where you can.

Choosing, in one paragraph

Use a portal or an end-to-end encrypted app for anything with case content, confirm identity once by phone, keep SMS and email for “there’s a message waiting,” and write the rule down for clients. That combination does more for confidentiality than any single app choice.

Spotted an error? Tell us by email and we'll correct it.