chiranjeet-vapi · Oct 16, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/fern/docs.yml b/fern/docs.yml
@@ -1018,6 +1018,8 @@ navigation:
             collapsed: true
             icon: fa-light fa-user-shield
             contents:
+              - page: Legal and security documents
+                path: security-and-privacy/legal-and-security-documents.mdx
               - page: TCPA consent guidelines
                 path: tcpa-consent.mdx
               - link: Privacy policy

diff --git a/fern/security-and-privacy/legal-and-security-documents.mdx b/fern/security-and-privacy/legal-and-security-documents.mdx
@@ -0,0 +1,48 @@
+---
+title: Legal and security documents
+subtitle: Find Vapi's DPA, subprocessor list, SOC reports, and other compliance documents
+slug: security-and-privacy/legal-and-security-documents
+description: Where to get Vapi's data processing agreement, subprocessor list, SOC 2 and SOC 3 reports, penetration test summary, BAA information, and terms of service.
+---
+
+The [Vapi Trust Center](https://security.vapi.ai/) holds Vapi's security and compliance documents. Use it to review Vapi's security posture and to request access to restricted documents.
+
+## Where to find each document
+
+| Document | Where to get it |
+| --- | --- |
+| Data processing agreement (DPA) | Download the [Customer Data Processing Agreement](https://security.vapi.ai/item/vapi-customer-data-processing-agreement) from the Trust Center or from the link in the [Terms of Service](https://vapi.ai/terms-of-service). |
+| Subprocessor list | The [Subprocessors](https://security.vapi.ai/item/subprocessors) page in the Trust Center lists Vapi's current subprocessors. |
+| SOC 3 report | [Download it from the Trust Center](https://security.vapi.ai/?itemUid=b2671060-5c66-4d9c-b70f-af4ab3dbd45a) without a non-disclosure agreement (NDA). |
+| SOC 2 Type II report | [Request access in the Trust Center](https://security.vapi.ai/?itemUid=7bfa66da-33ab-49de-8391-e329738a1ae9). The report is shared under NDA. See [SOC 2 Type II compliance](/security-and-privacy/soc). |
+| Penetration test summary | [Request access in the Trust Center](https://security.vapi.ai/?itemUid=722b9671-c0d5-4a19-a5f7-0ad8fd81307c). |
+| Business Associate Agreement (BAA) | Enable HIPAA compliance in the Dashboard, and the BAA is emailed to you for signature. See [Enabling HIPAA compliance](/security-and-privacy/hipaa#enabling-hipaa-compliance). The [HIPAA page in the Trust Center](https://security.vapi.ai/item/hipaa) lists the providers Vapi holds BAAs with. |
+| Terms of service | [Vapi Terms of Service](https://vapi.ai/terms-of-service) |
+| Privacy policy | [Vapi Privacy Policy](https://vapi.ai/privacy) |
+| Data location and data flow | See [EU region](/security-and-privacy/eu-region) and [Data flow](/security-and-privacy/data-flow). |
+
+Requests for restricted documents are reviewed and approved individually.
+
+## Signing the DPA
+
+On plans you buy in the Dashboard without an Enterprise agreement or Premier Success Package, the DPA is incorporated into the Terms of Service by reference, so no separate signature is needed. Downloading the DPA from the Trust Center records your acceptance. A countersigned or modified DPA is available on [Enterprise](https://vapi.ai/enterprise) agreements and the Premier Success Package.
+
+The DPA incorporates the Standard Contractual Clauses, including the UK Addendum and Swiss adaptations where applicable.
+
+## Providers you connect with your own API keys
+
+When you connect a provider with your own [API key](/customization/provider-keys), that provider is not a Vapi subprocessor. It is not covered by Vapi's DPA or BAA. Your own agreement with that provider governs how it handles your data, including whether it trains on that data.
+
+## Model training
+
+Vapi does not train foundation or general-purpose models on your content. Enabling [Zero Data Retention](/security-and-privacy/zero-data-retention) or [HIPAA compliance](/security-and-privacy/hipaa) stops Vapi from using your content to improve its call features.
+
+## Security questionnaires and audits
+
+Review the answers already published in the [Trust Center](https://security.vapi.ai/) before you send a security questionnaire. Vapi provides its current audit reports, including the SOC 2 Type II report, on written request. Audit rights are set out in the DPA and summarized in [Customer Audit Rights](https://security.vapi.ai/?itemUid=d78e37b4-3cb3-4588-b1e3-a976e2bfc730).
+
+## Contact
+
+Send security questions to [infosec@vapi.ai](mailto:infosec@vapi.ai) and privacy questions to [privacy@vapi.ai](mailto:privacy@vapi.ai).
+
+Vapi runs an invite-only bug bounty program on HackerOne. To report a vulnerability or ask for an invitation, email [infosec@vapi.ai](mailto:infosec@vapi.ai).