Hello, I have a question about enabling HIPAA on an assistant (as opposed to enabling HIPAA on the org)... With

hipaaEnabled = true

on the assistant

compliancePlan

would that guarantee that no user data was used for model training? By Vapi and also by the external providers? My stack is Deepgram/OpenAI/ElevenLabs. I'm currently using my own ElevenLabs API key, with the other 2 going through Vapi's accounts.. Will I also need my own Deepgram API key to set

mipOptOut

to true in the Deepgram config, or is that covered by the HIPAA-enabled setting in the assistant? Thanks!

Our https://vapi.ai/pricing includes unlimited concurrency, higher rate limits, and features like hands-on support, a shared Slack channel, HIPAA BAA and SOC 2 certifications, Single Sign-On (SSO) support (Okta, Azure AD, SAML, OIDC), and Role-Based Access Control (RBAC). If this sounds like it could meet your needs, please contact our sales team via this link: https://vapi.ai/sales. Once submitted, our sales team will reach out after reviewing your requirements!

I'm asking about the setting on the

assistant

config, rather than the HIPAA add-on or enterprise plan

To enable the HIPAA compliance in the assistant, it prevent storing information on vapi hosting. This not works for elevelabs, openai, gemini, etc.. You must manage the hosting for audio, transcription, logs, etc..

Thanks @GeraDeluxer , its sounds like i need to use personal API keys for Deepgram etc to guarantee the user data isn't used for model training. Along with the HIPAA assistant setting

Hey TimG, HIPAA ensures zero retention, so your data won't be stored in vapi. But we don't have control over the APIs and stack you use. For example, Deepgram/OpenAI/ElevenLabs can still use the data according to their terms and policies. But we ensure that VAPI won't either store or utilize that data for training purposes with HIPAA.

Hey Sarthak, thanks for the reply - that's great to have clarity. For Deepgram and ElevenLabs i will use my own API keys. Do you know if the Vapi/OpenAI agreement allows OpenAI to train on user data? As far as I can tell all OpenAI API usage defaults to not training on user data, unless the API key holder explicitly opts in. Do you know what Vapi's arrangment is with OpenAI?

Hey TimG, we do not explicitly opt in for any kind of model training. You can also find a relevant document https://security.vapi.ai/ that includes all DPA and other relevant documents.