From 9616e16e4df1599080f491bec7311b1f7abaec4b Mon Sep 17 00:00:00 2001 From: Chiranjeet Mishra Date: Fri, 16 Oct 2026 12:41:27 +0000 Subject: [PATCH 1/3] docs: add a legal and security documents page Routes readers to the Trust Center for the DPA, subprocessor list, SOC reports and pen test summary, and to the existing HIPAA, ToS and privacy pages. --- fern/docs.yml | 2 + .../legal-and-security-documents.mdx | 44 +++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 fern/security-and-privacy/legal-and-security-documents.mdx diff --git a/fern/docs.yml b/fern/docs.yml index a63911bab..cec60eaa9 100644 --- a/fern/docs.yml +++ b/fern/docs.yml @@ -1018,6 +1018,8 @@ navigation: collapsed: true icon: fa-light fa-user-shield contents: + - page: Legal and security documents + path: security-and-privacy/legal-and-security-documents.mdx - page: TCPA consent guidelines path: tcpa-consent.mdx - link: Privacy policy diff --git a/fern/security-and-privacy/legal-and-security-documents.mdx b/fern/security-and-privacy/legal-and-security-documents.mdx new file mode 100644 index 000000000..f58c99417 --- /dev/null +++ b/fern/security-and-privacy/legal-and-security-documents.mdx @@ -0,0 +1,44 @@ +--- +title: Legal and security documents +subtitle: Find Vapi's DPA, subprocessor list, SOC reports, and other compliance documents +slug: security-and-privacy/legal-and-security-documents +description: Where to get Vapi's data processing agreement, subprocessor list, SOC 2 and SOC 3 reports, penetration test summary, BAA information, and terms of service. +--- + +Vapi publishes its security and compliance documentation in the [Vapi Trust Center](https://security.vapi.ai/). Use it to review Vapi's security posture and to request access to documents that are not public. + +## Where to find each document + +| Document | Where to get it | +| --- | --- | +| Data processing agreement (DPA) | Download it from the **Documents** section of the [Trust Center](https://security.vapi.ai/) or from the link in the [Terms of Service](https://vapi.ai/terms-of-service). The DPA incorporates the Standard Contractual Clauses, including the UK Addendum and Swiss adaptations where applicable. | +| Subprocessor list | The **Subprocessors** section of the [Trust Center](https://security.vapi.ai/) lists Vapi's current subprocessors. | +| SOC 3 report | Available in the [Trust Center](https://security.vapi.ai/) without an NDA. | +| SOC 2 Type II report | Request access in the [Trust Center](https://security.vapi.ai/). The report is shared under NDA. See [SOC 2 Type II compliance](/security-and-privacy/soc). | +| Penetration test summary | Request access in the **Documents** section of the [Trust Center](https://security.vapi.ai/). | +| Business Associate Agreement (BAA) | Enable HIPAA compliance in the Dashboard, and Vapi emails you the BAA to sign. See [HIPAA compliance](/security-and-privacy/hipaa). The [Trust Center](https://security.vapi.ai/) lists the providers Vapi holds BAAs with. | +| Terms of service | [vapi.ai/terms-of-service](https://vapi.ai/terms-of-service) | +| Privacy policy | [vapi.ai/privacy](https://vapi.ai/privacy) | +| Data location and data flow | See [EU region](/security-and-privacy/eu-region) and [Data flow](/security-and-privacy/data-flow). | + +Requests for restricted documents are reviewed and approved individually. + +## Signing the DPA + +On self-serve plans, the DPA is incorporated into the Terms of Service by reference, so no separate signature is needed. Downloading the DPA from the Trust Center records your acceptance. A countersigned or modified DPA is available on [Enterprise](https://vapi.ai/enterprise) agreements. + +## Providers you connect with your own keys + +When you connect a provider with your own API key, that provider is not a Vapi subprocessor. It is not covered by Vapi's DPA or BAA, and your own agreement with that provider governs how it handles your data, including training. + +## Model training + +Vapi does not train foundational or general-purpose models on customer data. Enabling [Zero Data Retention](/security-and-privacy/zero-data-retention) or [HIPAA compliance](/security-and-privacy/hipaa) stops Vapi from using your content to improve its call features. + +## Security questionnaires and audits + +Review the answers already published in the [Trust Center](https://security.vapi.ai/) before you send a security questionnaire. Vapi provides its current audit reports, including the SOC 2 Type II report, on written request. Audit rights are set out in the DPA. + +## Contact + +Send security and privacy questions to [infosec@vapi.ai](mailto:infosec@vapi.ai) or [privacy@vapi.ai](mailto:privacy@vapi.ai). Vapi runs a private, invite-only bug bounty program on HackerOne. To report a vulnerability or ask for an invitation, email [infosec@vapi.ai](mailto:infosec@vapi.ai). From 03249806fd5f4c774bcd1e067713ad1115ac3ba5 Mon Sep 17 00:00:00 2001 From: Chiranjeet Mishra Date: Sat, 17 Oct 2026 08:10:24 +0000 Subject: [PATCH 2/3] docs: apply review suggestions on legal and security documents --- .../legal-and-security-documents.mdx | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/fern/security-and-privacy/legal-and-security-documents.mdx b/fern/security-and-privacy/legal-and-security-documents.mdx index f58c99417..0a15a2673 100644 --- a/fern/security-and-privacy/legal-and-security-documents.mdx +++ b/fern/security-and-privacy/legal-and-security-documents.mdx @@ -5,40 +5,44 @@ slug: security-and-privacy/legal-and-security-documents description: Where to get Vapi's data processing agreement, subprocessor list, SOC 2 and SOC 3 reports, penetration test summary, BAA information, and terms of service. --- -Vapi publishes its security and compliance documentation in the [Vapi Trust Center](https://security.vapi.ai/). Use it to review Vapi's security posture and to request access to documents that are not public. +The [Vapi Trust Center](https://security.vapi.ai/) holds Vapi's security and compliance documents. Use it to review Vapi's security posture and to request access to restricted documents. ## Where to find each document | Document | Where to get it | | --- | --- | -| Data processing agreement (DPA) | Download it from the **Documents** section of the [Trust Center](https://security.vapi.ai/) or from the link in the [Terms of Service](https://vapi.ai/terms-of-service). The DPA incorporates the Standard Contractual Clauses, including the UK Addendum and Swiss adaptations where applicable. | -| Subprocessor list | The **Subprocessors** section of the [Trust Center](https://security.vapi.ai/) lists Vapi's current subprocessors. | -| SOC 3 report | Available in the [Trust Center](https://security.vapi.ai/) without an NDA. | -| SOC 2 Type II report | Request access in the [Trust Center](https://security.vapi.ai/). The report is shared under NDA. See [SOC 2 Type II compliance](/security-and-privacy/soc). | -| Penetration test summary | Request access in the **Documents** section of the [Trust Center](https://security.vapi.ai/). | -| Business Associate Agreement (BAA) | Enable HIPAA compliance in the Dashboard, and Vapi emails you the BAA to sign. See [HIPAA compliance](/security-and-privacy/hipaa). The [Trust Center](https://security.vapi.ai/) lists the providers Vapi holds BAAs with. | -| Terms of service | [vapi.ai/terms-of-service](https://vapi.ai/terms-of-service) | -| Privacy policy | [vapi.ai/privacy](https://vapi.ai/privacy) | +| Data processing agreement (DPA) | Download the [Customer Data Processing Agreement](https://security.vapi.ai/item/vapi-customer-data-processing-agreement) from the Trust Center or from the link in the [Terms of Service](https://vapi.ai/terms-of-service). | +| Subprocessor list | The [Subprocessors](https://security.vapi.ai/item/subprocessors) page in the Trust Center lists Vapi's current subprocessors. | +| SOC 3 report | [Download it from the Trust Center](https://security.vapi.ai/?itemUid=b2671060-5c66-4d9c-b70f-af4ab3dbd45a) without a non-disclosure agreement (NDA). | +| SOC 2 Type II report | [Request access in the Trust Center](https://security.vapi.ai/?itemUid=7bfa66da-33ab-49de-8391-e329738a1ae9). The report is shared under NDA. See [SOC 2 Type II compliance](/security-and-privacy/soc). | +| Penetration test summary | [Request access in the Trust Center](https://security.vapi.ai/?itemUid=722b9671-c0d5-4a19-a5f7-0ad8fd81307c). | +| Business Associate Agreement (BAA) | Enable HIPAA compliance in the Dashboard, and the BAA is emailed to you for signature. See [Enabling HIPAA compliance](/security-and-privacy/hipaa#enabling-hipaa-compliance). The [HIPAA page in the Trust Center](https://security.vapi.ai/item/hipaa) lists the providers Vapi holds BAAs with. | +| Terms of service | [Vapi Terms of Service](https://vapi.ai/terms-of-service) | +| Privacy policy | [Vapi Privacy Policy](https://vapi.ai/privacy) | | Data location and data flow | See [EU region](/security-and-privacy/eu-region) and [Data flow](/security-and-privacy/data-flow). | Requests for restricted documents are reviewed and approved individually. ## Signing the DPA -On self-serve plans, the DPA is incorporated into the Terms of Service by reference, so no separate signature is needed. Downloading the DPA from the Trust Center records your acceptance. A countersigned or modified DPA is available on [Enterprise](https://vapi.ai/enterprise) agreements. +On plans you buy in the Dashboard without an Enterprise agreement, the DPA is incorporated into the Terms of Service by reference, so no separate signature is needed. Downloading the DPA from the Trust Center records your acceptance. A countersigned or modified DPA is available on [Enterprise](https://vapi.ai/enterprise) agreements. -## Providers you connect with your own keys +The DPA incorporates the Standard Contractual Clauses, including the UK Addendum and Swiss adaptations where applicable. -When you connect a provider with your own API key, that provider is not a Vapi subprocessor. It is not covered by Vapi's DPA or BAA, and your own agreement with that provider governs how it handles your data, including training. +## Providers you connect with your own API keys + +When you connect a provider with your own [API key](/customization/provider-keys), that provider is not a Vapi subprocessor. It is not covered by Vapi's DPA or BAA. Your own agreement with that provider governs how it handles your data, including whether it trains on that data. ## Model training -Vapi does not train foundational or general-purpose models on customer data. Enabling [Zero Data Retention](/security-and-privacy/zero-data-retention) or [HIPAA compliance](/security-and-privacy/hipaa) stops Vapi from using your content to improve its call features. +Vapi does not train foundation or general-purpose models on your content. Enabling [Zero Data Retention](/security-and-privacy/zero-data-retention) or [HIPAA compliance](/security-and-privacy/hipaa) stops Vapi from using your content to improve its call features. ## Security questionnaires and audits -Review the answers already published in the [Trust Center](https://security.vapi.ai/) before you send a security questionnaire. Vapi provides its current audit reports, including the SOC 2 Type II report, on written request. Audit rights are set out in the DPA. +Review the answers already published in the [Trust Center](https://security.vapi.ai/) before you send a security questionnaire. Vapi provides its current audit reports, including the SOC 2 Type II report, on written request. Audit rights are set out in the DPA and summarized in [Customer Audit Rights](https://security.vapi.ai/?itemUid=d78e37b4-3cb3-4588-b1e3-a976e2bfc730). ## Contact -Send security and privacy questions to [infosec@vapi.ai](mailto:infosec@vapi.ai) or [privacy@vapi.ai](mailto:privacy@vapi.ai). Vapi runs a private, invite-only bug bounty program on HackerOne. To report a vulnerability or ask for an invitation, email [infosec@vapi.ai](mailto:infosec@vapi.ai). +Send security questions to [infosec@vapi.ai](mailto:infosec@vapi.ai) and privacy questions to [privacy@vapi.ai](mailto:privacy@vapi.ai). + +Vapi runs an invite-only bug bounty program on HackerOne. To report a vulnerability or ask for an invitation, email [infosec@vapi.ai](mailto:infosec@vapi.ai). From 550d10907e3274b10a5f0fbbc6e9acb4c4397b7b Mon Sep 17 00:00:00 2001 From: Chiranjeet Mishra Date: Sat, 17 Oct 2026 08:15:23 +0000 Subject: [PATCH 3/3] docs: name the Premier Success Package alongside Enterprise --- fern/security-and-privacy/legal-and-security-documents.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fern/security-and-privacy/legal-and-security-documents.mdx b/fern/security-and-privacy/legal-and-security-documents.mdx index 0a15a2673..ea8105938 100644 --- a/fern/security-and-privacy/legal-and-security-documents.mdx +++ b/fern/security-and-privacy/legal-and-security-documents.mdx @@ -25,7 +25,7 @@ Requests for restricted documents are reviewed and approved individually. ## Signing the DPA -On plans you buy in the Dashboard without an Enterprise agreement, the DPA is incorporated into the Terms of Service by reference, so no separate signature is needed. Downloading the DPA from the Trust Center records your acceptance. A countersigned or modified DPA is available on [Enterprise](https://vapi.ai/enterprise) agreements. +On plans you buy in the Dashboard without an Enterprise agreement or Premier Success Package, the DPA is incorporated into the Terms of Service by reference, so no separate signature is needed. Downloading the DPA from the Trust Center records your acceptance. A countersigned or modified DPA is available on [Enterprise](https://vapi.ai/enterprise) agreements and the Premier Success Package. The DPA incorporates the Standard Contractual Clauses, including the UK Addendum and Swiss adaptations where applicable.