Is Vapi safe for work?
Medium risk · 28Vapi · Audio · facts (medium-confidence)
Vapi is medium-risk for default at-work use (28/100): it trains on your data unless you opt out, and holds SOC 2 Type II.
28
Medium risk
Watch out: Vapi's default configuration retains call data and can use it to improve the service; you have to explicitly turn on HIPAA mode to disable storage and training use, and even then you choose HIPAA-compliant providers yourself. Treat it as developer infrastructure that requires deliberate configuration.
Data and compliance facts
- Trains on consumer-tier data
- Opt-out
- Trains on business-tier data
- Opt-out
- Training opt-out available
- Yes
- SOC 2 Type II
- Yes
- ISO 27001
- Unverified
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Unverified
- HIPAA BAA
- Yes
- EU data residency
- Yes
- SSO / SAML
- Unverified
- Data retention
- Default: call recordings, transcripts and logs are retained per the customer's own configuration and may be used to improve the service. With HIPAA mode on, persistence is disabled and nothing is stored.
- Safer tier
- Any plan with HIPAA mode (hipaaEnabled true) enabled and only HIPAA-compliant provider keys configured: a per-assistant configuration flag, not a separate paid tier.
Why it scores 28 out of 100
- +21Trains on your data. Training is on by default on the consumer tier; you must find and set the opt-out.
- +7Trains on business-tier data. Whether even the paid or team tier uses your data for training.