Developer platform for building and deploying voice agents, such as phone agents that resolve customer support calls, with configurable voice, flow and telephony.
The EU region requires the Premier Success Package. WorkOS and Databricks subprocessors are US-hosted; agree the full processing boundary.
Certificates and audit reports
SOC 2 Type II attestation (Security, Availability, Confidentiality; period 1 Jul 2025–31 Jul 2026; report under NDA) plus public SOC 3; PCI DSS v4.0.1 listed; 2025 third-party penetration test summary
Trust Center: auditor not named; SOC 2/SOC 3 are attestations, not certifications. PCI DSS scope/assessor not given. HIPAA, GDPR, CCPA listed but are laws, not certifications (HIPAA add-on $2,000/month with BAA per pricing page). No ISO 27001.
Additional data conditions
Subprocessors and underlying models
Sub-processors: Microsoft Azure, OpenAI, Cloudflare, Supabase, Groq, WorkOS (auth, US), Databricks (US; may process customer data for service delivery, analytics and product improvement), Soniox (optional STT, US/EU). Customer-selected providers (BYOK) incl. OpenAI, Anthropic, Azure OpenAI, Google Gemini, Groq, DeepSeek, xAI etc.; STT Deepgram, Gladia, AssemblyAI, Speechmatics; TTS ElevenLabs, Cartesia, PlayHT etc.; transport Twilio, Telnyx, Plivo, LiveKit, Daily
Trust Center sub-processor list plus data-flow docs https://docs.vapi.ai/security-and-privacy/data-flow. Optional providers disabled by default and not treated as sub-processors by Vapi.
Retention and deletion
Recordings: configurable retention; transcripts/call logs stored on Vapi by default; optional Zero Data Retention (no recordings, transcripts, messages, summaries, structured outputs retained; billing/usage metadata kept); custom bucket storage possible
ZDR: 'stops Vapi from storing call content after a call ends'; 'ZDR and HIPAA mode are mutually exclusive'; dashboard-only setting; no extra purchase. Data-flow page: no default periods, deletion procedure not described.
Export
Call logs via API and dashboard; recordings/transcripts/logs to customer bucket (AWS S3, GCP, Cloudflare R2, Supabase, Azure Blob); structured outputs and end-of-call report via webhook
FAQ: 'No, Vapi does not support on-premise deployments.' Data-flow: EU region 'available only with the Premier Success Package'.
Organisation fit
Self-serve: $0 start, pre-paid $0.05/min hosting plus pass-through model costs, no minimum minutes; Core $29/month; Pro 10% of hosting fee with $999/month minimum; Premier custom via direct sales
A written comparison of up to three AI offerings · €195 net
You get the facts that matter for your decision, each with its source, the questions to ask each vendor and a cost estimate based on your own numbers. First you agree your three most important criteria with Sten Franke.
We deliver your brief by email within a maximum of five working days after payment is confirmed and we have agreed the question and minimum information needed to begin. ETHORITY confirms the start date and delivery date and delivers earlier when the reviewed brief is ready. Missing optional information is recorded and assessed; it does not require you to research the solution yourself. Review before delivery and email support are included.
ETHORITY®