Can My Employer Read Texts on a Company Phone?

The phone is theirs, so most people assume the messages are too. The reality is more specific. An employer that owns a phone can take it back and read whatever is on it, can obtain the carrier's record of which numbers you texted and when, and can restore a backup if the phone backs up to an account it controls. What it usually cannot do is read your messages remotely while you carry the phone around, because neither Apple nor Google gives mobile device management tools access to message content, and because end-to-end encrypted apps keep the content from the carrier too. The exceptions are archiving apps that regulated employers install deliberately, and the small number of consumer spyware products that some employers install improperly.

This guide explains what each layer exposes: the device in hand, the carrier account, the backup, the management profile, archiving software, and the messaging app itself. It then covers the law, which is friendlier to the employer than most employees expect for the device and less friendly than most employers expect for personal accounts, and what to do if you use a company phone for anything personal. For personal phones with work apps, see can my employer monitor my personal phone.

The short answer by message type

The six ways messages become visible

1. The device in hand. The employer owns the phone and may demand it back at any time, including at termination or during an investigation. If they know or can reset the passcode, every message stored on it is readable. On a supervised iPhone or a fully managed Android device, the organization can remotely clear the passcode. Deleted texts are frequently recoverable with forensic tools for weeks afterward. This, not remote surveillance, is how most employers actually come to read an employee's texts.
2. The carrier account. The company is the subscriber. AT&T, Verizon and T-Mobile account portals show, for each line, the numbers called and texted, times and durations, and data usage. They do not show message content. US carriers retain SMS content briefly if at all (historically from zero to a few days, with some retaining longer for troubleshooting) and release it only under subpoena or warrant, not to the account holder. So the employer can see that you exchanged 240 texts with one number last month, but not what they said.
3. Backups. This is the layer people miss. An iPhone signed into an Apple Account the company created, with iCloud Backup or Messages in iCloud on, puts every SMS and iMessage in a cloud account the company can log into. An Android phone signed into a Google Workspace account with Messages backup enabled does the same. A phone that backs up to a company laptop leaves a readable copy there. If the Apple Account or Google account is yours, the employer has no access to the backup, which is one reason many companies now require a managed Apple Account or Workspace account on company phones.
4. The management profile. Mobile device management (Intune, Jamf, Workspace ONE, Google Endpoint Management, Kandji) controls the device but does not read messages. Apple's management framework exposes device name, model, serial number, installed apps, OS version, storage, compliance state, and on supervised devices location when queried and web traffic if a filter is installed. It has no API for message content, call logs or photos, and Apple has refused to add one. Android Enterprise is similar for the work profile, and on a fully managed device exposes app inventory and policy state but not SMS content. A supervised or fully managed phone is heavily controlled, and still not a message reader.
5. Archiving and monitoring apps. Regulated employers install apps whose explicit purpose is to capture messages. Smarsh, Global Relay, TeleMessage, MirrorWeb and Theta Lake capture SMS, and in some configurations WhatsApp and iMessage, on company phones for retention under Securities and Exchange Commission and Financial Industry Regulatory Authority rules. Some do it with a carrier integration for SMS, some with a dedicated messaging app employees must use, and some with an on-device agent on Android (iOS does not permit third-party apps to read the SMS database, so iPhone capture usually works through the carrier or a company messaging app instead). Employees in those firms know, because they are told to use the app and attest to it annually. Outside regulated industries, a handful of employers install consumer monitoring products built for parents, which can forward SMS and app notifications; these need the phone rooted or jailbroken for full access, break with each OS update, and are the one case where "my employer reads my texts" is literally true.
6. The messaging platform. Anything sent through Teams, Slack, Google Chat, Zoom Chat or work email is stored on the employer's tenant and is readable by administrators without touching the phone, usually through compliance search tools that keep an audit trail. Our guide to Teams and Slack messages covers what administrators can and cannot see, including direct messages.

SMS, iMessage, RCS, WhatsApp and Signal compared

The apps differ in where the content exists, which determines who can get at it.

• SMS and MMS are unencrypted and pass through the carrier. Content is readable by anyone with the device, any backup, an archiving integration at the carrier, or an on-device agent on Android. Metadata is on the bill.
• iMessage is end-to-end encrypted between Apple devices. The carrier never sees it. Apple can read it only if the messages are in an iCloud backup without Advanced Data Protection, and the employer can read it only if that backup belongs to an account they control or they hold the unlocked phone. Messages in iCloud with Advanced Data Protection on are unreadable even to Apple.
• RCS replaced SMS as the default on Android and arrived on iPhone in 2024. Google Messages encrypts RCS end to end between its users, and cross-platform encryption rolled out from 2025 under the Universal Profile 3.0 standard. Content falls back to the carrier only when a conversation drops to SMS. Backups and the device remain readable.
• WhatsApp is end-to-end encrypted by default, but its cloud backups to iCloud or Google Drive are not unless the user turns on end-to-end encrypted backup. On a company phone backing up to a company account, an unencrypted WhatsApp backup is readable. WhatsApp also offers business accounts with compliance archiving for regulated firms, which capture content with the employee's knowledge.
• Signal stores messages only on the device, offers no cloud backup, and supports disappearing messages. The only way to read Signal messages on a company phone is to hold the unlocked phone. That is why the federal government's 2025 controversy over officials using Signal for work was about record-keeping law, not about anyone intercepting the messages.

None of this makes a company phone safe for private conversation. Every one of these apps is readable by whoever holds the unlocked device, and the device belongs to the employer.

What the law allows

• The employer may search its own phone. For private employers, no federal law prevents an employer from examining a device it owns, and the policies most employees sign say the device may be inspected at any time. Public employers are constrained by the Fourth Amendment, but the Supreme Court held in City of Ontario v. Quon (2010) that a police department's review of an officer's text messages on a department-issued pager was a reasonable, work-related search even though many of the messages were personal, because the audit had a legitimate purpose (checking whether the character limit was too low) and was not excessive in scope. Quon is the case every employer-side lawyer cites, and it is a public-sector case that private employers have an easier time with.
• Reading stored messages is governed by the Stored Communications Act (18 U.S.C. 2701), which prohibits accessing a facility through which an electronic communication service is provided without authorization. Messages stored on a device the employer owns are not in a "facility" in the statute's sense, and courts have generally allowed employers to read them. Messages stored in a personal cloud account are different: logging into an employee's personal iCloud, Google or WhatsApp account using credentials seen on the device is unauthorized access, and employers have paid for it; see the personal account cases in can my employer read my personal email.
• Real-time interception is governed by the Wiretap Act (18 U.S.C. 2511) and state equivalents. An archiving app that captures messages as they are sent is an interception, lawful under the consent exception when the employee has agreed to the policy, which is why regulated employers obtain signed attestations. Covert interception without consent, including consumer spyware installed on a phone the employee was told was private, has produced criminal referrals and civil liability, and in the twelve all-party-consent states the other party to the conversation has not consented either.
• State notice laws. New York, Connecticut and Delaware require written notice before electronic monitoring of telephone, email and internet use, which includes company phones. California's privacy law gives employees of covered employers a right to know what is collected. Our state-by-state guide has the statutes.
• Carrier records. The subscriber may obtain its own account records, including the numbers texted, without any process. Content is not available to the subscriber; the carrier releases content only to government with a warrant or, in some cases, a subpoena, under the Stored Communications Act's provider provisions.

Regulated industries: archiving is the point

In banking, broker-dealers, investment advisers and parts of insurance and health care, the employer is required to keep business communications and is punished when it cannot. Between September 2022 and 2024 the Securities and Exchange Commission and the Commodity Futures Trading Commission collected more than $2.5 billion in penalties from over 40 firms, including JPMorgan, Goldman Sachs, Morgan Stanley, Citigroup, Bank of America and Wells Fargo, for employees conducting business over personal texts, WhatsApp and Signal that were not archived. The response across the industry has been company phones with archiving apps, bans on personal messaging apps for business, and annual attestations. In those firms, the employer does read texts on the company phone, routinely, by sampling and by keyword search, and every employee has signed a document saying so. The same logic applies to health care under HIPAA, where a text containing patient information on an unmanaged phone is a reportable breach, and to government under records laws.

Personal texts on a company phone

If you text your partner, your doctor or your lawyer from a company phone, you should assume the employer can read those messages if it decides to, and that it will if there is ever a dispute, an investigation or a lawsuit in which the phone is relevant. Two further consequences are less obvious. First, communications with a lawyer from a company device may lose attorney-client privilege; courts have split, with the policy you signed and whether you knew of the monitoring as the deciding factors, and the safer assumption is that privilege is at risk. Second, in litigation the employer's phone is the employer's evidence; messages on it are subject to preservation and production, including personal ones that happen to be relevant. The reverse is also true: a wrongful termination claim often turns on texts a manager sent from a company phone.

How to tell what your phone is doing

1. Whose account is it signed into? iPhone: Settings, then your name at the top. If the Apple Account email is a company address or one you did not create, the company controls backups. Android: Settings, Google, then the account list; a Workspace account with a company domain is the company's.
2. Is it supervised or fully managed? iPhone: a line at the top of Settings reads "This iPhone is supervised and managed by [organization]," and Settings, General, VPN and Device Management lists what the organization can do. Android: Settings, Security, then Device admin apps or "Managed by" in the About section.
3. Is a messaging or archiving app installed? Look for Smarsh, Global Relay, TeleMessage, MirrorWeb, Movius, CellTrust or a company-branded messaging app, and for a messaging app you were told to use instead of the default. On Android, check which app is set as default SMS app under Settings, Apps, Default apps.
4. Are backups on? iPhone: Settings, your name, iCloud, then iCloud Backup and Messages in iCloud. Android: Settings, Google, Backup. WhatsApp: Settings, Chats, Chat Backup, and whether end-to-end encrypted backup is on.
5. Is the phone jailbroken or rooted? You would usually know, but a phone that was issued to you already set up is the case to check; our detection guide covers the signs.

What to do

• Keep personal messages off the company phone. Carry your own, or accept that the company phone is a work tool whose contents belong to work. This is the entire solution and there is no partial version of it that works.
• If you must use it personally, prefer Signal or iMessage with a personal Apple Account, turn off cloud backup for messages, and understand that the device in hand still exposes everything.
• Never sign a company phone into your personal Apple Account or Google account if you can avoid it; it mixes your personal backups and purchases into a device the employer can wipe or examine.
• Before returning the phone, if policy permits, back up and remove personal data, and sign out of personal accounts. Do not wipe a phone that is subject to a legal hold or investigation; that can be spoliation and is a firing offense in itself.
• If you are the employer: say in the policy that the device may be inspected, that no expectation of privacy exists on it, and whether messages are archived; obtain a signed acknowledgment; use a managed Apple Account or Workspace account rather than asking employees to use their own; never install consumer spyware; and never log into a personal account whose password you saw on the device. Our cell phone policy guide has the clauses.

Key takeaways

• Standard mobile device management (Intune, Jamf, Workspace ONE, Google) controls a company phone but has no access to message content; Apple and Google do not expose it.
• The employer can read texts by taking the phone back, by restoring a backup tied to a company-controlled Apple or Google account, or through an archiving app installed deliberately in regulated industries.
• The carrier account shows numbers, times and counts for every text, but not content; carriers release content only to law enforcement with legal process.
• iMessage, WhatsApp and Signal are end-to-end encrypted and unreadable in transit, but all are readable on the unlocked device, and WhatsApp and iMessage are readable in unencrypted cloud backups.
• A private employer may inspect a phone it owns; City of Ontario v. Quon (2010) allowed even a public employer's work-related review of personal texts. Logging into a personal cloud account seen on the device is a Stored Communications Act violation.
• Regulators collected more than $2.5 billion from financial firms in 2022 to 2024 for unarchived texts and WhatsApp messages, which is why those employers now capture messages on company phones by policy.
• Keep personal messages on a personal phone. Communications with a lawyer from a company device may lose privilege, and the phone is the employer's evidence in any dispute.