In brief
SMS is the baseline, matched to operator records. WhatsApp codes are supported as an addition to SMS; voice codes are a concept only. Third-party dependency and why you need legal advice.
"Can we send the code over WhatsApp instead of SMS?" and "what if a call just reads the code out?" are questions we hear more and more. Both are technically possible. The question is whether they fit your record-keeping under Law 5651. This post will not deliver a legal verdict; it explains what each method does, what it rests on and where it carries a dependency. Make the decision with your legal adviser.
The baseline first: what does an SMS code rest on?
An SMS code goes to a number an operator has assigned to a subscriber. Whoever can enter the code is whoever can reach that number. The operator already holds a record of the number's holder; the business does not look it up, it only stores the number in encrypted form. When needed, the competent authority obtains the number-to-subscriber mapping from the operator.
On top of that the box records the device MAC, the assigned internal IP and the session start and end. Daily records are chained with SHA-256 digests, time-stamped under RFC 3161 and kept on the box for 2 years. No content, visited sites or messages are recorded.
This method is the baseline because the link between the phone number and the operator record is made without any intermediary outside the business.
A code over WhatsApp: what changes and what does not
The box supports sending the verification code over WhatsApp. On the site we describe it as "an addition to SMS", not as the default. Here is why:
What does not change: the guest still enters a phone number. A WhatsApp account is bound to a phone number; the code goes to that number's WhatsApp. The box records the same number and the same device and session details. The record structure is identical to SMS.
What changes: the delivery path is a third-party platform rather than the operator's SMS network. That has three consequences:
- Platform dependency. Template approvals, changes to business account rules, outages or pricing policy are outside your control. One morning the codes may stop going out.
- The mapping is indirect. Even though the WhatsApp account is tied to the number, the path to the operator's record of who holds that number is not as direct as with SMS. The legal weight of that difference is for your legal adviser to assess, not us.
- The guest needs the app. A guest without WhatsApp cannot receive the code.
That is why, when WhatsApp is enabled on the box, the SMS fallback stays active: if the WhatsApp code does not arrive, or the guest prefers it, the code goes by SMS. The guest is never left unable to connect, and the record falls back to the operator-backed path.
When does it make sense? At venues with many foreign guests a WhatsApp code can reduce international SMS cost and feels familiar to the guest. In a café with mostly domestic guests it may be nothing more than extra complexity.
Voice codes: as a concept
A voice code means an automated call to the guest's number that reads out the code. Some messaging providers offer this as a service. We treat it here at the level of a concept; it is not a login option the box offers.
In terms of what it rests on, a voice call is close to SMS: the call travels over the operator network to that number. In practice it has two problems: the guest may miss the call, or if abroad the call cost rises; in a noisy room the code is misheard. It can be considered as a fallback for the rare cases where SMS does not arrive; use as a primary method is uncommon.
Side by side
| Method | Delivery path | Number-to-operator link | External dependency | Status on the box |
|---|---|---|---|---|
| SMS code | Operator network | Direct | SMS provider (replaceable, fallback chain) | Baseline method |
| WhatsApp code | Third-party platform | Indirect (account bound to the number) | Platform rules and outages | Addition to SMS; SMS fallback |
| Voice code | Operator network | Direct | Voice service provider | Concept; not a product feature |
How to approach the legal side
Law 5651 expects a public-access provider to keep internal IP assignment records and protect their integrity. The Law does not directly regulate a detail such as "which channel the code travelled through"; what matters is that the session can be tied to a person and that the records are reliable. Take this question to your legal adviser: "Does delivering the code over WhatsApp weaken the ability to tie the session to a person?"
The box does not make that decision for you. In either case it keeps the same record: the verified number (encrypted, masked in the panel), MAC, internal IP, session times, digest chain and time stamp. Whether you enable WhatsApp or not, your archive is verified and exported the same way.
Our recommendation
- Keep the SMS code on as the baseline method.
- Enable WhatsApp only for a concrete need (many foreign guests, SMS cost) and with the SMS fallback active.
- Talk to your legal adviser before enabling it and note the decision in writing.
- Do not expect voice codes as a product feature; discuss them separately with your provider if needed.
- Routing foreign numbers through a separate SMS provider is an alternative to WhatsApp with less dependency.
More on login methods in the FAQ. For SMS provider options and credit packages see the products page or write to us.
This article is for general information and is not legal advice.
This article is for information only and is not legal advice; confirm your obligations with your legal adviser.