A WhatsApp vendor can look excellent in a controlled demo and still fail in production. The safest buying process is to reconstruct one realistic operating case, include the ugly parts, and make the vendor show who owns each decision.

Consider a hypothetical B2B distributor. It already receives permissioned WhatsApp opt-ins from quote forms and trade events. The company wants faster follow-up, multilingual routing and better sales handoff. Its first shortlist contains a communications provider, a shared-inbox vendor and a managed agency.

The team’s first mistake is to ask, “Which one has the most automation?” The better question is, “Which arrangement lets us prove permission, protect the customer state, route replies, measure quality, and leave without losing the business?”

Use the questions below before signing.

1. Show us exactly how opt-in is recorded

Do not ask whether the vendor is “WhatsApp compliant.” Ask for the data model.

Where is the opt-in source stored? Can it record the form, event, QR code or customer action that created permission? Is the date available? Is the wording or campaign context retained? Can the company export the record?

Then test an opt-out. Ask the vendor to show what happens if the same person appears in another campaign or is owned by another salesperson. Does suppression apply everywhere that it should?

WhatsApp’s Business Messaging Policy requires opt-in before business-initiated contact through the service and requires businesses to respect opt-out requests. A vendor should make those controls easier to operate, not hide them behind a promise.

Transferable rule: treat permission and suppression as business data, not campaign settings.

2. Who owns the number and business identity?

This question can decide whether migration later is easy or painful.

Ask:

  • Who is the legal/administrative owner of the WhatsApp business account?
  • Who owns the phone number?
  • Who controls recovery credentials?
  • Which staff have administrator rights?
  • What happens if the agency relationship ends suddenly?
  • Can the client move to another provider without changing the customer-facing number?

A quick launch is not valuable if the business rents its identity from a vendor it cannot leave.

Transferable rule: convenience can be outsourced; identity ownership should be explicit.

3. What exactly happens outside the customer-service window?

Ask the vendor to show both kinds of workflow:

  1. a customer initiates or continues an active conversation; and
  2. the business needs to initiate an eligible message outside the active service window.

Who creates the approved template? Who checks variables? Who knows whether the template is approved, paused or rejected? What does the operator see when delivery fails? Can a salesperson accidentally use the wrong template for the wrong purpose?

A vendor that only demonstrates live chat is not demonstrating the full operating model.

Transferable rule: test the regulated/structured path, not just the happy path.

4. What is the current price equation?

Get pricing in writing and date it.

As a current reference checked on 2026-10-05, Twilio’s WhatsApp pricing page states a $0.005 handling fee per message plus applicable Meta template-message fees and identifies its displayed pricing as current as of August 2026. Other providers may package pricing differently.

Ask every vendor to break out:

  • setup fees;
  • platform or seat fees;
  • provider handling fees;
  • Meta-related message/template charges;
  • phone-number or account charges if any;
  • integration fees;
  • support tiers;
  • managed-service labor;
  • overage;
  • data export or migration charges;
  • contract minimums.

Then ask for an invoice simulation at your expected volume and at 2× volume.

Transferable rule: compare total operating cost, not the cheapest line item.

5. Break the CRM integration in front of us

A clean demo proves almost nothing.

Use a test account containing duplicates, multiple contacts, an existing owner, a previous opt-out and a service ticket. Disconnect the CRM for ten minutes. Reconnect it. Send two events in the wrong order. Change the account owner.

Watch what happens.

Ask which system is authoritative when data conflicts. Ask how the vendor prevents an old webhook replay from reopening a closed state. Ask how errors surface to an operator.

Transferable rule: integration quality is measured by recovery from bad states, not creation of good states.

6. How do you route a valuable reply?

Give the vendor a realistic message: “We need 200 units delivered to Los Angeles next month. Can you quote today?”

Then ask:

  • who receives it;
  • whether account context appears automatically;
  • whether a known owner is respected;
  • what happens if the owner is unavailable;
  • how escalation works;
  • how the next step is recorded;
  • how long unowned work can sit unnoticed.

The reply-routing workflow often has more economic impact than another template feature.

Transferable rule: measure time to accountable owner, not just time to automated acknowledgement.

7. How do you separate sales, service and partner traffic?

One WhatsApp number can attract several kinds of work. Ask how the vendor handles an existing customer with a delivery issue, a new buyer asking for a quote, a distributor applying to partner, and a person requesting no further contact.

If everything lands in one generic queue, staff will invent their own classification system. If automation classifies everything without a human override, edge cases can disappear into the wrong workflow.

Look for a small, understandable taxonomy with explicit owners.

Transferable rule: classification should reduce ambiguity, not create a black box.

8. What can AI do, and what can it not do?

Ask the vendor to separate:

  • summarization;
  • translation;
  • suggested replies;
  • qualification assistance;
  • routing;
  • autonomous sending;
  • voice or calling features.

These are not the same risk.

If AI summarizes a conversation, can the user see the original messages? If it translates, can bilingual staff review important commercial terms? If it suggests a reply, can the human edit it? If it makes qualification decisions, which fields and evidence drive the decision?

Do not let “AI-powered” become a reason to skip ownership.

Transferable rule: automate deterministic work first and keep source evidence accessible.

9. What security controls exist in ordinary daily use?

Ask about role-based access, administrator controls, authentication, integration credentials, exports, logs, retention, device access and offboarding.

Then simulate an employee leaving. Can access be removed immediately? Does the employee still possess an export? Are API keys personal, shared or service-owned? Can the business identify unusual export activity?

Security should map to the actual data flow. A long compliance PDF does not answer who can download contacts today.

Transferable rule: test the control, not the certification label alone.

10. How do you handle country differences?

Ask the vendor to configure one Canadian workflow and one UK workflow and explain what changes.

Canada’s CASL framework includes consent, sender identification and unsubscribe obligations for commercial electronic messages. UK electronic-marketing and data-protection rules distinguish among recipient types and circumstances. Other countries differ.

A vendor should not answer “we are globally compliant” and stop there. It should provide controls, configuration and evidence that your organization can map to current local rules.

Transferable rule: compliance is a configured operating process, not a universal checkbox.

11. What happens when the platform or account is restricted?

Ask for the incident playbook.

Who notices first? What evidence is collected? Which actions stop automatically? Who contacts the provider? Which messages are paused? How are salespeople informed? How are customers redirected if the channel is temporarily unavailable?

Ask for an anonymized example of a real service incident, if the vendor can provide one.

Transferable rule: resilience is part of channel design.

12. Show the export before we sign

Ask for a sample export containing contact identifiers, permission state, suppression state, conversation metadata, assignment, template identifiers and relevant business outcomes.

Then ask what cannot be exported.

If the answer is “we can export everything” but nobody can produce a file and schema, treat it as unproven.

Also ask how long export takes at contract termination and whether there are extra charges.

Transferable rule: portability must be demonstrated while the relationship is still optional.

13. Ask a reference customer about the second month

The first month often has extra implementation attention. The second and third months reveal the normal operating model.

Ask a reference:

  • what they had to rebuild after launch;
  • which integration caused the most work;
  • how support behaves during an incident;
  • whether template operations became a bottleneck;
  • how much internal staffing they still need;
  • what they wish they had negotiated before signing.

Avoid only asking “Are you happy?”

Transferable rule: references are most useful when they describe friction.

14. Run a constrained pilot with explicit pass/fail criteria

The hypothetical distributor should not start by sending to every eligible contact. It should choose one market, one permission source, one or two use cases and a limited cohort.

Before the pilot, define pass/fail criteria:

  • permission evidence complete;
  • no unresolved suppression failures;
  • reply ownership within target time;
  • CRM records accurate;
  • meaningful reply rate observable;
  • sales-accepted conversation definition consistent;
  • export works;
  • no critical security or policy issue;
  • full cost can be reconciled.

At the end, do not ask “Did we get replies?” Ask which part of the operating chain failed first.

A vendor scorecard that exposes weak claims

Area Evidence to demand Red flag
Permission sample opt-in record + opt-out propagation test “Your CRM number is enough”
Identity account/number ownership map vendor-only recovery control
Templates create/approve/fail/version demo manual mystery process
Routing live ownership + escalation test shared queue with no SLA
Integration failure-and-recovery test only happy-path demo
Security role/offboarding/export test generic security deck only
Geography configurable controls + current authority mapping “global compliance” slogan
Economics dated invoice simulation only per-message headline
Exit real export + migration steps undefined portability

The final vendor question

Ask: “If we terminate the contract tomorrow, what exactly do we keep, what stops working, what must be migrated, and how long does it take?”

A strong vendor can answer without becoming defensive.

The best partner is not the one that removes every responsibility from the buyer. It is the one that makes responsibilities visible, gives the business durable control over identity and customer state, and reduces operational friction without hiding risk.

Sources

Related Reading