Phone Number Masking & the Audit Trail

Whatbot hides customer phone numbers by default, everywhere in the dashboard. Instead of a number, an agent sees a reference for the customer: the lead reference from your CRM (for example L-972876) when the contact has one, and otherwise a whatbot reference such as W-4F2A91. A W-reference is the same for a chat wherever it appears — the inbox, a ticket, a CSV — so agents can still point each other at the right customer.

Masking happens on the server. The API never sends the full number to the browser in the first place, so there is nothing to uncover in developer tools. This is the difference between privacy and the appearance of it.

What is masked

Every dashboard surface that shows a customer’s number: the inbox conversation list and thread header, contact search, the contact profile, broadcast recipients and the opt-out list, segment previews, catalogue orders, the call log, form responses, and the CSV exports built from any of them.

A number stored in a contact attribute, a form answer or a flow variable under a key such as phone is hidden automatically.

Chat properties can be covered too: when you define one under Settings → Chat Properties, choose whether its value is Shown as-is, Masked or Hidden from agents. Today a masked value and a hidden one both appear as ****** in the dashboard, for every role.

What is not masked, and why

Message bodies. If a customer types their number into a chat, it stays visible. Redacting free text reliably is not possible, and half-redacting it takes away the context an agent needs to help the person they are talking to.

Contact names. A name is not what this feature protects.

The public API and webhooks. These are contracts. Integrations — a CRM sync, a voice agent, your own tooling — parse phone and would break if its shape changed underneath them. The public API carries the full number unless an administrator turns on Also mask the public API, webhooks and MCP tools on the Privacy page. With that on, the public API’s number field carries ****** instead, so check every connected integration before you switch it on. A webhook event that includes the customer’s number carries it in full whichever way that setting is.

MCP tools (the AI-assistant connection) are the exception: an assistant works alongside your agents, so it is masked exactly like the inbox, always.

Your own business number. The number customers message you on is yours, not a customer’s, and is shown in full in Settings.

Nobody can uncover a number

There is no “click to reveal”. Nobody in the dashboard can uncover a customer’s full number — not an agent, not an administrator, and not whatbot’s own staff. The Who can uncover a number setting has a single option, Nobody. An attempt to uncover one through the API is refused, and the refusal is recorded in the audit log.

Inside the CRM this is also locked by the database, so it cannot be changed from whatbot at all.

The audit trail

The audit log (administrators only; open it from the link at the bottom of the Privacy page) shows who did what: the person, their role, the action, the masked value involved, where the request came from, when, and from which IP. You can filter it by action and export it to CSV. It records, among other things, privacy-setting changes, refused attempts to uncover a number, CSV exports, and role changes on the team.

The log is append-only. Not by convention — by a database rule that refuses every edit and delete, including from whatbot’s own backend. A log the application can rewrite is not evidence of anything.

The log never stores a full phone number. Entries record the masked value, so the audit trail can never become a second copy of what it exists to protect.

Settings

The Privacy page is for administrators. Open Settings → Role Based Access and follow the privacy setting link. There you can change:

Setting	Default	What it does
How numbers are shown	Lead reference	Lead reference (agents see the CRM lead reference instead of a number) or Hidden (agents see ****** and work from the contact name)
Where the reference comes from	Automatic	Which CRM field supplies the lead reference. Shown with how many conversations currently have one
When a conversation has no reference	A whatbot reference (W-4F2A91)	A W-reference, the contact’s name, or nothing
Who can uncover a number	Nobody	The only option
Also mask the public API, webhooks and MCP tools	Off	Extends masking to /public/v1. Webhook events still carry the full number; MCP tools are masked either way

Contacts created by hand, imported from a CSV, or messaging from a number your CRM has never seen have no lead reference. That is normal: they get the fallback, which by default is a W-reference.

Changing any of these is itself recorded in the audit log, with the before and after. Loosening a privacy setting without a trace would defeat the point.

If a workspace has no settings saved, it gets the strictest ones. That is deliberate: a new workspace, or one whose settings cannot be read for any reason, masks rather than exposes.