Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions fern/assistants/dynamic-variables.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -162,16 +162,14 @@ You are a helpful assistant, talking with a customer via {{transport.conversatio
{%- endif -%}
```

## HIPAA and Zero Data Retention mode
## Zero Data Retention mode

When HIPAA mode or Zero Data Retention is enabled for your organization or assistant, Vapi does not store any call data, including variable values. This means:
When Zero Data Retention is enabled for your organization or assistant, Vapi does not store any call data, including variable values. This means:

- Variable values passed via `variableValues` are processed during the call but **not persisted** after the call ends
- Call logs, recordings, and transcriptions are not stored
- Variables are only available in real-time during the active call session

This ensures compliance with privacy requirements while still allowing you to personalize conversations with dynamic variables.

<Note>
For more information on enabling HIPAA compliance and understanding data retention policies, see the [HIPAA Compliance](/security-and-privacy/hipaa) documentation.
</Note>
For more information, see [Zero Data Retention (ZDR)](/security-and-privacy/zero-data-retention).
3 changes: 2 additions & 1 deletion fern/assistants/structured-outputs-quickstart.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
title: Structured outputs quickstart
subtitle: Get started with structured data extraction in 5 minutes
description: Set up structured data extraction from calls in a few minutes. Create a schema, link it to an assistant, test extraction, and configure HIPAA-safe storage settings.
slug: assistants/structured-outputs-quickstart
---

Expand Down Expand Up @@ -655,7 +656,7 @@ When accessing via API, this data is nested inside the structured output object

### Understanding the default behavior

When your organization or assistant has HIPAA mode enabled (`hipaaEnabled: true`):
When your organization or assistant has HIPAA mode enabled:
- **Structured outputs are NOT stored** - Results are generated but not persisted in Vapi's systems
- **Limited visibility** - You cannot view outputs in the Dashboard's Call Logs or Insights
- **Privacy first** - This ensures sensitive data is not retained
Expand Down
10 changes: 3 additions & 7 deletions fern/assistants/structured-outputs.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
title: Structured outputs
subtitle: Extract structured data from conversations using AI-powered analysis
description: Extract structured, schema-defined data from voice calls using AI-powered analysis. Covers field types, extraction timing, limitations, and HIPAA storage behavior.
slug: assistants/structured-outputs
---

Expand Down Expand Up @@ -761,14 +762,9 @@ if (data.result === null) {
## HIPAA compliance

<Warning>
**Important for HIPAA-enabled organizations:**
**Important for HIPAA-enabled organizations:** When HIPAA mode is enabled, structured outputs are generated normally but **not stored** by default, to protect PHI. You can still receive them via webhooks during the call.

If your organization has HIPAA compliance enabled (`hipaaEnabled: true`), structured outputs are **disabled by default** to protect PHI (Protected Health Information).

To use structured outputs with HIPAA compliance:
- Contact the Vapi team to enable structured outputs
- Ensure you understand the implications for PHI handling
- Follow all HIPAA compliance best practices when extracting sensitive health data
To store a specific structured output that doesn't contain PHI, see [HIPAA Compliance & Storage Settings](/assistants/structured-outputs-quickstart#hipaa-compliance-storage-settings) for the full walkthrough and safe/unsafe use cases.
</Warning>

## Limitations
Expand Down
5 changes: 3 additions & 2 deletions fern/customization/transcriber-fallback-plan.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
title: Transcriber fallback configuration
subtitle: Configure fallback transcribers that activate automatically if your primary transcriber fails.
description: Configure fallback transcribers so calls keep working if your primary speech-to-text provider fails. Covers automatic fallback, manual fallback, and HIPAA-compliant provider options.
slug: customization/transcriber-fallback-plan
---

Expand Down Expand Up @@ -83,7 +84,7 @@ Manual fallbacks give you full control over which providers Vapi tries, and in w
</Steps>

<Note>
If HIPAA or PCI compliance is enabled on your account or assistant, only **Deepgram** and **Azure** transcribers will be available as fallback options.
If HIPAA compliance is enabled on your account or assistant, only [HIPAA-compliant transcribers](/security-and-privacy/hipaa#hipaa-compliant-providers) **Deepgram**, **Azure**, and **Soniox**, will be available as fallback options.
</Note>

### Configure via API
Expand Down Expand Up @@ -195,7 +196,7 @@ Each transcriber provider supports different configuration options. Expand the a
- **Combine both** for maximum reliability—manual fallbacks run first, auto fallback catches anything they miss.
- Use **different providers** for manual fallbacks to protect against provider-wide outages.
- Consider **language compatibility** when selecting fallbacks—ensure all fallback transcribers support your required languages.
- For **HIPAA/PCI compliance**, ensure all fallbacks are compliant providers (Deepgram or Azure) and review data routing implications before enabling auto fallback.
- For **HIPAA compliance**, ensure all fallbacks are [compliant providers](/security-and-privacy/hipaa#hipaa-compliant-providers) (Deepgram, Azure, or Soniox) and review data routing implications before enabling auto fallback.

## FAQ

Expand Down
2 changes: 1 addition & 1 deletion fern/enterprise/plans.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ slug: enterprise/plans

If you're building a production application on Vapi, we can help you every step of the way from idea to full-scale deployment.

#### Enterprise Plans include:
#### Enterprise Plans can include, depending on your negotiated contract:

- Unlimited concurrency and higher rate limits
- Reserved capacity on our weekly deployment cluster
Expand Down
27 changes: 12 additions & 15 deletions fern/security-and-privacy/data-flow.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
title: Data Flow
subtitle: Understand how data flows through Vapi when using custom storage and custom models
description: How data flows through Vapi's voice pipeline. What's processed in real time, what's stored by default, and how custom storage or custom model servers change where data lives.
slug: security-and-privacy/data-flow
---

Expand Down Expand Up @@ -127,7 +128,7 @@ Vapi runs proprietary real-time models that make conversations feel natural. The
| **Filler Injection** | Adds natural speech patterns ("um", "like", "so") |

<Warning>
Orchestration models process data in real-time but do **not persist** the audio or intermediate results. All processing is **ephemeral**. Only final transcripts and call logs are stored (unless HIPAA mode is enabled).
Orchestration models process data in real-time but do **not persist** the audio or intermediate results. All processing is **ephemeral**. Only final transcripts and call logs are stored.
</Warning>

### 4. Language Model (LLM)
Expand Down Expand Up @@ -338,15 +339,15 @@ The **Orchestration Layer** (endpointing, interruption detection, emotion detect

| Artifact | Default Location | Custom Storage Supported | HIPAA Mode |
|----------|-----------------|--------------------------|------------|
| **Call Recordings** | Vapi | ✅ Yes | Not stored on Vapi |
| **Transcripts** | Vapi | ✅ Yes | Not stored on Vapi |
| **Call Logs** | Vapi | ✅ Yes | Not stored on Vapi |
| **Call Recordings** | Vapi | ✅ Yes | ✅ Yes |
| **Transcripts** | Vapi | ✅ Yes | ✅ Yes |
| **Call Logs** | Vapi | ✅ Yes | ✅ Yes |
| **Product Usage Metrics** | Vapi | ❌ No | Vapi only |
| **System Logs** | Vapi | ❌ No | Vapi only |
| **Structured Outputs** | Vapi | ✅ Yes (via webhook) | Configurable |

<Warning>
**HIPAA Mode Important Notice:** When HIPAA mode is enabled (`hipaaEnabled: true`) and no custom storage is configured, Vapi will **not store** call recordings or transcripts. This data will be lost after the call ends. To retain call data in HIPAA mode, you **must** configure a custom storage bucket.
**HIPAA Mode Storage:** When HIPAA mode is enabled, call recordings, transcripts, and call logs are stored by default in Vapi's private HIPAA-compliant storage. Configuring custom storage is optional. It redirects storage to your own infrastructure instead of Vapi's, but is not required to retain data. See [HIPAA Compliance](/security-and-privacy/hipaa).
</Warning>

---
Expand All @@ -358,8 +359,8 @@ Even with maximum custom configuration, certain data passes through Vapi's orche
| Data Type | Processing | Retention |
|-----------|-----------|-----------|
| Raw audio streams | Real-time routing to Transcriber/Voice | **Ephemeral** (not stored) |
| Transcribed text | Orchestration analysis, LLM routing | Call logs (unless HIPAA) |
| LLM responses | Filler injection, Voice routing | Call logs (unless HIPAA) |
| Transcribed text | Orchestration analysis, LLM routing | Call logs |
| LLM responses | Filler injection, Voice routing | Call logs |
| Emotion metadata | Passed to LLM context | **Ephemeral** |
| Call signaling | SIP/WebSocket management | Metadata only |

Expand Down Expand Up @@ -393,15 +394,11 @@ Even with maximum custom configuration, certain data passes through Vapi's orche
- No custom server setup required
</Accordion>

<Accordion title="HIPAA compliance">
- Enable `hipaaEnabled: true`
- **Important:** Configure custom storage to retain call recordings and transcripts
- Use only HIPAA-compliant providers (Deepgram, Azure, OpenAI, Anthropic, ElevenLabs)
<Accordion title="HIPAA compliance">
- Enable HIPAA mode for your organization in the Dashboard
- Custom storage is optional; call recordings, transcripts, and logs are retained by default in Vapi's private HIPAA-compliant storage
- Use only HIPAA-compliant providers. See [HIPAA compliant providers](/security-and-privacy/hipaa#hipaa-compliant-providers)
- See [HIPAA Compliance](/security-and-privacy/hipaa)

<Warning>
Without custom storage configured, HIPAA mode will result in **no call recordings or transcripts being stored**. Data will be lost after call completion.
</Warning>
</Accordion>
</AccordionGroup>

Expand Down
Loading
Loading