Hey team — founder of Masker.dev here. We’re a Rust-based runtime PHI/PII redaction layer for voice AI (sub-100ms, fail-closed, audit-logged) aimed at healthcare builders on Vapi who need HIPAA coverage end-to-end. I’m planning to ship the integration as a custom transcriber over the WebSocket interface — Masker sits in front of Deepgram/Azure and redacts PHI on the audio + transcript stream before anything is stored or sent downstream. Two quick questions before I build: 1. Is the custom transcriber WebSocket the right primitive for this, or would something like a custom STT proxy / pre-LLM middleware hook be more idiomatic? Anything on the roadmap re: a redaction/middleware layer I should know about? 2. For HIPAA-mode assistants, are non-Deepgram/Azure custom transcribers currently allowed, or is the compliance gate strictly the published subprocessor list at security.vapi.ai? Want to make sure customers on  hipaaEnabled  can actually point at us. Happy to share a demo + arch diagram with anyone interested. Also keen to hear from other healthcare builders here about pain points — we’re talking to design partners ahead of GA on May 30

Hey! Really appreciate the detailed writeup and excited to see someone building specifically for HIPAA-focused Vapi users. Let me give you the clearest answers I can: 1. Architecture: Yes, the custom transcriber WebSocket is the right primitive for what you're describing. That's exactly the hook for plugging in your own STT layer. There's no native pre-LLM middleware or redaction hook in Vapi today, so sitting at the transcriber layer is the most idiomatic approach. On the roadmap question, I honestly don't have visibility into that, so I wouldn't want to steer you wrong there. 2. HIPAA mode compatibility: I want to be upfront with you on this one. In HIPAA mode, Vapi currently only allows STT, LLM, and TTS providers that are on our signed BAA / published subprocessor list at [security.vapi.ai](http://security.vapi.ai). Because [Masker.dev](http://Masker.dev) isn't on that list, customers with

hipaaEnabled: true

wouldn't be able to point at you as their transcriber within Vapi's BAA scope today. That's the hard gate, not a config workaround. Whether there's a path to getting Masker on the subprocessor list is a compliance and partnership-level question that's outside what I can answer from support. Your best bet would be reaching out via the contact options at [security.vapi.ai](http://security.vapi.ai) or through the community Discord where Vapi team members are active. Happy to keep helping on the integration side as you build! Regards, Chiranjeet Vapi Support

Thanks Chrianjeet, I will reach out to them over security.vapi.ai

Hey! Honestly not sure if there's a separate intake for partner vs. customer inquiries there, I wouldn't want to guess and send you to the wrong place. I'd just go through the same contact form and make it clear upfront that it's a subprocessor/partner inquiry. That context should be enough for them to route you correctly. And thank you, that genuinely means a lot! Good luck with the design partner conversations. Regards, Chiranjeet Vapi Support

Hey, @navi How is it going today? Maybe is there any chance work with you as a dev?