SOC 2 Type II Compliance

Vapi, as a Voice Agent Platform, is a SOC 2 Type II-attested service organization and undergoes annual third-party audits to validate its compliance with the framework. SOC 2 (Service Organization Control 2) is an independent audit framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates how service providers manage and protect customer data.

Vapi SOC 2 Type II attestation and compliance cover all customers using Vapi’s services, including both Pay-Go and Enterprise plans; therefore, every customer using Vapi’s platform is covered without any additional activation.

Type I vs. Type II

• SOC 2 Type I evaluates whether security controls are properly designed at a specific point in time
• SOC 2 Type II (Vapi’s attestation) evaluates whether those controls are not only properly designed but also operating effectively over an extended period (typically 12 months)

Type II provides greater assurance because it demonstrates consistent, ongoing effectiveness of security controls rather than just their existence at a single moment.

Vapi’s SOC 2 Type II Coverage

Our attestation report includes three main Trust Service Criteria:

• Security: Protection against unauthorized access (logical and physical)
• Availability: System accessibility for operation and use as committed
• Confidentiality: Protection of confidential information as committed

Every annual Vapi audit covers Vapi’s infrastructure, policies, procedures, and operational controls across our entire platform.

Customers on any plan can request access to our SOC 2 Type II report and other security documentation through our Customer Trust Portal at https://security.vapi.ai/.