by having a permanent/persistent notification. for example KeePass2Android does it pretty well. (usually when the battery saver kicks in it kills these semi-foreground things.)
when the phone starts the user has to first start the app though (and I found this to be true for Signal, Skype and probably for WhatsApp too)