Vapi vs Retell Compliance: HIPAA, SOC 2 and GDPR (2026)

Vapi vs Retell compliance: what you must check before you sign

You compare Vapi and Retell and the sales pages all say the same thing: secure, enterprise ready, compliant. The real question is narrower. Which certificate or contract do you get on which plan, at what price, and does it cover the whole call path from phone line to speech model? This guide walks through HIPAA, SOC 2 and GDPR for voice AI platforms and shows where Famulor fits as the first choice for teams that operate in the EU.

A voice agent touches more personal data than most software. It records a voice, transcribes it, sends text to a language model, speaks the answer back and often writes the result into a CRM or calendar. Every one of those steps is a processor you have to be able to name. That is why a single "we are compliant" line on a pricing page is never enough.

The three frameworks in plain words

HIPAA: a contract plus controls

HIPAA applies in the US when you handle protected health information on behalf of a covered entity such as a clinic or insurer. If a voice agent hears a patient name together with a symptom or an appointment reason, that is protected health information. The vendor must sign a Business Associate Agreement (BAA), and every sub-processor that touches the data needs the same cover. Without the BAA, a "HIPAA ready" feature list does not protect you.

SOC 2 Type II: an audit of the vendor

SOC 2 is an independent audit against trust criteria such as security and availability. Type I checks that controls are designed well at one point in time. Type II checks that they actually operated over a period, usually six to twelve months. It tells you the vendor runs disciplined processes. It does not say anything about how you configure your agent, what you store in prompts or how long you keep recordings.

GDPR: a legal basis, a contract and a location

For callers in the EU the key documents are a data processing agreement, a list of sub-processors, a lawful basis for recording and a clear answer to where audio and transcripts are stored. The EU AI Act adds a transparency duty: people should be told that they are talking to an AI. A US certificate does not replace any of this.

Vapi: SOC 2 Type II and a paid HIPAA add-on

Vapi documents an annual SOC 2 Type II audit. According to its documentation, the audit covers all customers, including pay-as-you-go accounts. HIPAA works differently. Vapi lists a HIPAA add-on at $2,000 per month and a Zero Data Retention add-on at $1,000 per month on its pricing page. Its support documentation also states that for the core voice pipeline (speech to text, language model, text to speech) you may only select providers that are themselves HIPAA compliant. Third-party integrations stay available, but you carry the compliance work for them.

The practical effect is that a clinic with a small call volume pays a fixed compliance fee before the first minute is billed. That can be fair for a hospital group. It is a large share of the budget for a two-chair dental practice.

The chart shows the two add-ons side by side. If a team needs both, the monthly fee adds up to $3,000, which is $36,000 over twelve months before any usage cost (2,000 + 1,000 = 3,000; 3,000 x 12 = 36,000).

Retell: HIPAA self-service claims and what to verify

Retell states on its own pages that it supports HIPAA with a Business Associate Agreement and that call data runs on SOC 2 Type II certified infrastructure. Independent reviews are less consistent. Some describe the BAA as an enterprise feature, and one review says that Retell does not prominently publish its own SOC 2 Type II report. GDPR is described briefly on Retell's pages, with consent and access rights, but detailed documents are not easy to find in public.

We cannot verify contract terms from the outside, and neither can you from a blog. Treat every public claim, including ours, as a starting point for a due diligence request. Ask Retell for three things in writing: the current SOC 2 report or bridge letter, the BAA template with its plan conditions, and the list of sub-processors with their locations.

Famulor: EU hosting, DSGVO by design, transparent about SOC 2

Famulor is built for the EU market. Data is hosted in Frankfurt, the platform is designed around DSGVO and the transparency notice for AI calls is part of the product. SOC 2 Type II is in progress, and we say so openly instead of printing a badge. For teams in Germany, Austria and Switzerland that is usually the question that decides the project: where is the audio stored, and who signs the processing agreement?

The same principle applies to US health data. If you need a BAA for protected health information, clarify that with the Famulor team in the project phase, together with the speech and language providers you plan to use. Our enterprise page shows how we handle security reviews and contracts, and the pricing page lists the current plans.

Side by side: what each vendor publishes

Read the table as a list of questions, not as a ranking. Cells marked "verify" or "ask" mean that public information is thin and you should request documents. The comparison of price and features between the two US platforms is covered in our Retell vs Vapi comparison.

What the compliance work really costs

Compliance cost has three parts. The first is the visible fee, like the Vapi add-ons above. The second is the provider restriction: if only HIPAA-ready speech and language models are allowed, you lose some of the newest models and voices. The third is internal work, such as legal review, a records of processing entry and staff training. The third part is the same on every platform.

For the usage side, Famulor charges €0.15 per minute on pay as you go, and the plans start from €0.05 per minute. Use the calculator to compare your own volume against a fixed monthly compliance fee.

Four mistakes teams make with voice AI compliance

They treat a certificate as a permission

A SOC 2 report proves that the vendor runs controlled processes. It does not give you a lawful basis to record a call. The legal basis, the consent text and the retention rule remain your job, whichever platform you pick.

They forget the sub-processors

A voice agent is a chain. The carrier transports the call, a speech model transcribes it, a language model answers and a voice model speaks. A clinic in Munich that uses a compliant platform but routes audio through a provider without a processing agreement has a gap, and the regulator will find the weakest link first.

They test with real callers

Run the first weeks with colleagues and fake patient data. Check that the AI notice plays, that the recording consent is captured and that a deletion request really removes audio and transcript. Famulor includes quality tools that help you review calls before you go live.

They ignore the prompt

Prompts and knowledge bases can contain personal data too. Keep names, policy numbers and internal notes out of prompts, and load them at call time through a tool call instead. That keeps the stored configuration clean and makes audits simpler.

A short example: a physiotherapy practice with six therapists wants an agent that books appointments. Callers say their name and often a complaint such as "back pain after surgery". That sentence is health data. The practice needs a processing agreement with the platform, a clear retention period and a notice at the start of the call. It does not need a separate audit badge to start, but it does need every processor on the list to be named and contracted.

A five step due diligence checklist

1. Classify the data. Decide whether calls contain health data, payment data or only contact data. The answer sets the framework.
2. Request the documents. SOC 2 report, BAA or DPA, sub-processor list, retention policy.
3. Map the call path. List every processor and its location. Remove any that cannot sign.
4. Set retention and redaction. Decide how long audio and transcripts live and who can read them.
5. Run a test with fake data. Test the consent message, the AI notice and the deletion request before real callers arrive.

Regulated industries add their own layers. Our guides on PCI compliant phone payments and the debt collection compliance playbook show how this works in practice.

Moving from Vapi or Retell without losing your setup

If a compliance review shows that your current platform does not fit your market, switching is less work than it sounds. Famulor imports assistants from both platforms, including prompts and settings. See the pages for the Vapi migration and the Retell migration, and the AI call center page for what a production setup looks like.

Conclusion: choose by documents, not by badges

Vapi gives you a clear, priced HIPAA path. Retell publishes strong claims that you should verify. Famulor gives EU teams hosting in Frankfurt, a DSGVO based design and an honest SOC 2 status. None of these replaces your own legal review. The fastest way to decide is to send the same five questions to every vendor and compare the written answers.

The next step is simple: book a demo, bring your call flow and ask us for the security documents of your use case.

FAQ

Is Vapi HIPAA compliant?

Vapi offers HIPAA support as a paid add-on, listed at $2,000 per month, and restricts the core voice pipeline to HIPAA compliant providers. You still need a signed BAA and must handle compliance for third-party integrations yourself.

Does Retell AI have SOC 2 Type II?

Retell says its call data runs on SOC 2 Type II certified infrastructure. Independent reviews are mixed on whether Retell itself publishes a report, so request the current report in writing.

What is the difference between HIPAA and SOC 2?

HIPAA is a US law for health data that requires contracts and safeguards. SOC 2 is a voluntary audit of a vendor's controls. A SOC 2 report does not make you HIPAA compliant.

Do I need a BAA for a voice agent?

Yes, if the agent handles protected health information for a US covered entity. The BAA must also be backed by agreements with every sub-processor in the call path.

Is a US voice AI platform GDPR compliant?

It can be, but only with a data processing agreement, valid transfer mechanisms and a clear data location. Check the sub-processor list and where audio and transcripts are stored.

Does Famulor host data in the EU?

Yes. Famulor hosts in Frankfurt and is designed around DSGVO, including the transparency notice for AI calls.

Is Famulor SOC 2 certified?

SOC 2 Type II is in progress. We state this openly so that you can plan your review around the real status.

Do I have to tell callers they speak to an AI?

In the EU the AI Act requires transparency. Best practice is a short notice at the start of the call, which Famulor supports as a built-in announcement.

How long should I keep call recordings?

Only as long as you need them for a defined purpose. Many teams use short retention periods and delete audio after transcription. Set this per workspace and document it.