What'sApp is based on Signal's protocol, so it's probably secure against random internet hackers. But it's owned by Facebook, so assume that it's telling facebook everything you say and who you say it to. Signal itself can be trusted a bit more (to the extent that you trust OWS more than facebook. I personally trust OWS a lot more than facebook).