Is the contract in your name and you pay the bill yourself and then expense it? Or is the contract in company's name they get full itemized bill from the carrier? If it is the latter, it sucks.
They get the bill directly, but I'm not sure they can have access to the messaging or call data directly. I live in Europe, so I feel like the GDPR addresses this, but now that you mention it, I don't know this for sure.