Vapi vs Retell: HIPAA and SOC 2 Compliance Compared (2026)

TL;DR

Vapi and Retell are both capable developer platforms, but a regulated voice AI deployment cannot be selected from a badge or old add-on price. The decisive evidence is the current agreement: who will sign the Business Associate Agreement (BAA), which services and subprocessors it covers, what data is retained, and whether the exact model, voice, telephony, and storage configuration is approved.

Retell currently says it holds SOC 2 Type II and offers a self-service BAA. Vapi's current billing documentation says HIPAA is available as an add-on with any package, subject to a signed BAA and compatible providers; Vapi's public pricing page lists that add-on at $2,000/month. Its HIPAA documentation also says HIPAA mode and Zero Data Retention (ZDR) cannot be enabled together. The older claim of a separate $1,000/month ZDR fee is stale because current Core packaging includes ZDR. Ask both vendors for current written terms before sending protected health information (PHI).

For an agency, there is a second decision beyond security: neither Vapi nor Retell publicly packages a complete turnkey agency portal with custom domain, client workspaces, and rebilling. Their APIs can support a custom build, while third-party wrappers can supply the reseller layer. That changes who the agency must coordinate and which vendors may enter the data path.

This comparison is operational guidance, not legal advice. Your counsel and compliance team should approve the contract and architecture for the intended workflow.

Vapi vs Retell: the short answer

Choose Retell when its self-service BAA, retention controls, and approved providers fit the workload and you want a model-agnostic voice infrastructure platform. Retell publishes component-priced voice usage from $0.07 to $0.31 per minute and gives engineering teams granular control.

Choose Vapi when your developers value its mature orchestration, organisation model, provider choice, and extensive integration surface. Its current public packaging includes a usage-only option and Core at $29/month, with higher tiers and provider/component costs. Its pricing page lists HIPAA at $2,000/month; the billing documentation says the add-on is available with any package. A signed BAA and compatible providers are still required.

Choose a finished agency platform when client branding, account isolation, billing, and one core support relationship matter as much as the raw voice layer. Trillet provides those agency mechanics directly, while BAAs are available on Agency and Enterprise after its standard process.

Does Vapi Support HIPAA and SOC 2?

Vapi's current documentation says HIPAA is available as an add-on with any package, provided the customer signs a BAA and uses compatible providers. Its public pricing page lists the add-on at $2,000/month, while its Enterprise page lists a HIPAA BAA and SOC 2 Type II certification among items negotiated Enterprise plans can include. ZDR is included with Core, but Vapi's HIPAA documentation says HIPAA mode and ZDR are mutually exclusive. Confirm the current price, agreement and configuration before purchase.

Vapi's provider flexibility means the exact deployment matters. A BAA with Vapi does not automatically make an optional or customer-managed model, voice, or telephony provider eligible. Confirm every selected component and the intended data-handling behavior in writing.

Does Retell Support HIPAA and SOC 2?

Yes. Retell currently says it holds SOC 2 Type II and provides a self-service BAA. That is a genuine advantage for a smaller team that wants to begin a healthcare pilot without first negotiating a large enterprise contract. The agency should still confirm that its exact agent, providers, recording and retention settings, telephony, and any added middleware sit inside the approved deployment.

What to Verify for HIPAA

Some platforms, including Trillet, offer a per-agent HIPAA mode. On Trillet Studio, Agency, and Enterprise, enabling it disables recording and post-call storage of that agent's call content on Trillet's servers; customers can switch it on without first signing a BAA. It does not establish what connected systems or subprocessors retain, authorize live PHI processing, or make a workflow compliant. Studio does not offer the BAA pathway; Agency or Enterprise PHI use still requires an executed BAA and covered Order Form. For any vendor, strong security settings are insufficient if the contract is missing or a selected subprocessor is outside its scope.

Ask Vapi and Retell the same questions:

Will you sign a BAA for this account and workload?
Which products, models, voices, storage systems, and telephony routes are covered?
Which subprocessors can access audio, transcripts, metadata, or derived data?
What are the default and configurable retention periods?
Can recordings, transcripts, logs, and model-provider storage be disabled or redacted?
Where is data processed and stored?
What security incident, audit-log, access-control, and deletion commitments appear in the contract?

Do not infer an answer from the dashboard. Get it in the BAA, data processing agreement, order form, or another controlling document.

What SOC 2 Does and Does Not Prove

SOC 2 Type II evaluates whether an organisation's described controls operated over a period. It is useful evidence of a mature control environment. It does not, by itself, make a deployment HIPAA compliant, approve a particular subprocessor, guarantee zero retention, or replace a BAA.

When comparing Vapi and Retell, request the current SOC 2 report under NDA and check:

the legal entity and services inside the report's scope;
the report period and any gap letter;
customer responsibilities and complementary controls;
exceptions noted by the auditor;
whether the actual service and region you will use are covered.

The same discipline applies to Trillet. Trillet holds SOC 2 Type II and ISO 27001, but those certifications do not automatically authorize every workflow. HIPAA-regulated processing requires an executed BAA and an applicable order form that identifies the covered use.

The Compliance Cost Nobody Quotes: The BAA and Subprocessor Chain

Vapi and Retell are model-agnostic developer platforms. That is a genuine strength: engineering teams can choose components that fit quality, latency, and cost targets. It also means the compliance boundary depends on the chosen configuration.

A typical call path can include the application platform, telephony, speech-to-text, a language model, text-to-speech, storage, monitoring, and any middleware the customer adds. Not every supplier has the same role under HIPAA, and telecommunication conduit treatment can be fact-specific. Avoid the simplistic claim that “every component always needs its own BAA.” Instead, map which entities create, receive, maintain, or transmit PHI and have counsel determine the required agreements.

Bring-your-own keys can also shift responsibility. If your business contracts directly with a model or telephony provider, confirm whether that provider sits inside the platform vendor's BAA or under your own agreement.

Do Vapi or Retell Offer Turnkey Agency White-Labeling?

Retell does not publicly offer a full turnkey agency portal, although it provides APIs for custom products and limited chat-widget attribution control. Vapi also exposes APIs and organisations that can support a custom build, but no public first-party turnkey agency portal was found in the current review.

An agency therefore has three routes:

Build its own portal, tenancy, authentication, billing, and support layer.
Use a third-party wrapper and keep the upstream Vapi or Retell relationship that wrapper requires.
Choose a platform whose white-label operating layer is built into the same application.

A wrapper is not automatically non-compliant. The key question is whether it processes regulated data. If it does, include it in the data-flow and contract review. The operational cost is also real: incidents can require coordination between the portal vendor, upstream voice platform, and any directly contracted providers. See the voice AI wrapper vs native platform guide for the architecture and support trade-offs.

How Trillet Approaches Regulated Agency Work

Trillet's white-label capability is built into the same first-party application platform that operates the agents. On the standard managed stack, the agency has one core commercial and support relationship with Trillet, which manages its normal subprocessor relationships. This does not mean Trillet owns every carrier, foundation model, or cloud component, and bring-your-own telephony or custom enterprise deployments can change the relationship map.

Trillet holds SOC 2 Type II and ISO 27001. BAAs are available on Agency and Enterprise after the standard process; they are not an automatic Studio entitlement. Enterprise controls such as dedicated infrastructure, private cloud or on-premises deployment, data residency, SSO/RBAC, and specific SLAs are available only where included in the relevant agreement.

For agencies, the advantage is co-delivery. Trillet can serve as the compliance and infrastructure partner on larger healthcare, legal, financial-services, government, and other high-stakes engagements. That is a more accurate promise than saying the entire subprocessor chain disappears.

Vapi vs Retell vs Trillet: Compliance and Cost at a Glance

Factor	Vapi	Retell	Trillet White-Label
Primary buyer	Developers building a custom product	Developers building a custom product	Agencies operating a branded service
Public pricing	Usage only: $0 package plus $0.05/minute hosting; Core $29/month; Pro has a $999 minimum and 10% hosting fee; Premier custom; provider/component costs additional	$0.07-$0.31/minute component-priced	Studio $99 / Agency $299 with included minutes; then $0.12/minute AI usage
Turnkey agency portal	No public first-party portal found	No public full portal found	Included
HIPAA route	Add-on available with any package; signed BAA and compatible providers required	Self-service BAA published; confirm the covered configuration	BAA available on Agency and Enterprise after standard process
SOC 2	Type II listed in negotiated Enterprise plan documentation; request the current scope	Retell says it holds SOC 2 Type II; request the current report and scope	SOC 2 Type II and ISO 27001 held
Support ownership	Your team owns what it builds	Your team owns what it builds	Trillet supports the hosted application and manages standard subprocessors

The table deliberately avoids declaring a universal compliance winner. The signed contract and actual data flow decide whether a platform is fit for a particular client.

Frequently Asked Questions

Is Vapi HIPAA compliant?

Vapi's current documentation says HIPAA is available as an add-on with any package. The public price is currently $2,000/month; verify it at purchase and confirm the BAA, compatible-provider requirements, retention behavior, total cost, and HIPAA/ZDR exclusivity before processing PHI.

Does Retell offer a BAA for HIPAA?

Yes. Retell currently publishes a self-service BAA and SOC 2 Type II status. Confirm whether the agreement covers the models, voices, telephony, storage, and retention settings you plan to use. Do not assume every possible bring-your-own configuration is covered.

Do Vapi or Retell hold SOC 2 and ISO 27001?

Retell says it holds SOC 2 Type II. Vapi's enterprise documentation lists SOC 2 Type II among items negotiated Enterprise plans can include. Request the current report and scope directly from each vendor, because SOC 2 does not replace a HIPAA BAA. Trillet holds SOC 2 Type II and ISO 27001.

Why can compliance cost more when reselling Vapi or Retell?

The raw platform is only one part of the agency product. A reseller may need to build or buy the portal, manage client isolation and billing, and review every vendor that processes regulated data. That adds engineering, legal, and support work even when the underlying per-minute rate is low.

What is the most compliant option for a regulated agency deal?

There is no universal answer. Choose the option whose current contracts, controls, subprocessors, retention, and deployment boundary match the specific client. Trillet can co-deliver regulated engagements and offers BAAs on Agency and Enterprise after its standard process, but the applicable agreement still controls.

Bottom line

Retell and Vapi are credible first-party developer platforms, not wrappers. Their strength is granular infrastructure control. Their agency trade-off is that you must build or add the reseller operation and remain responsible for validating the complete regulated data path.

If your priority is a branded agency platform with a clearer operating and support boundary, review the Trillet white-label platform, agency white-label pricing, and the white-label voice AI platform guide. In every case, approve the current contracts before production PHI enters the system.

Updated September 2026: verified Retell's self-service BAA and Vapi's current $2,000/month, any-package HIPAA add-on; removed the stale separate-ZDR price; corrected white-label scope; qualified Trillet's BAA availability; and replaced the “single vendor means no subprocessors” claim with a contract-and-data-flow review.