Data

Vapi and the GDPR: AI training, data location and DPA

Core: Trains on your data, with no documented way to stop it. EU hosting not documented · DPA in the terms.

Vendor: VapiPhone and voiceChecked on How we check

Verdict

Is Vapi GDPR compliant?

Core

Business

Trains on your data, with no documented way to stop it

EU hosting not documented · DPA in the terms

Price: $29 / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Vapi train on your data?

Trains on your data by default?

Checked

Trains on your data, with no documented way to stop it.

Yes, in de-identified form: Vapi's terms let it use your content to improve its call features (speech recognition, end-of-turn and interruption detection); tailoring beyond that needs your permission. The 2023 privacy policy also allows training

Source: vapi.aiSection 4, paragraph starting 'We use Your Content to' (terms of 14 Sep 2026)Second source: vapi.aiChecked on

Contract

Does Vapi sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA in the terms.

Yes. Vapi's Data Processing Addendum is part of its Terms of Service

Source: vapi.aiOpening paragraph ('these Terms of Service, the DPA and Privacy Policy')Checked on

Processors

Who else handles Vapi data?

Sub-processors (companies that handle the data for them)

Checked

22 listed.

Public. 22 entries: 19 listed for the US and EU, 3 US only (Groq, WorkOS, Databricks); models and voices from OpenAI, Anthropic, Google, xAI, Azure, AWS, ElevenLabs, Deepgram, Cartesia and others, used when selected

Source: security.vapi.aiSubprocessors tableChecked on

EU–US Data Privacy Framework

Checked

Not listed.

No listing found for search term 'Vapi'

Source: dataprivacyframework.govSearch 'Vapi' returned 'Query returned no results'Checked on

Retention

How long does Vapi keep your data?

How long data is kept

Checked

Raw call data is kept for 30 days on Core (14 days on usage-only, 180 on Pro); recording retention is configurable and zero data retention is included; audio streams are not stored

Source: vapi.aiPackage feature lists ('raw data retention')Second source: docs.vapi.aiChecked on

Security

Which certifications and admin controls does Vapi have?

Admin controls for AI

Checked

Limited on Core: up to 2 organisations; role-based access control comes with Pro, SSO with Premier. Model and voice providers are chosen per assistant by the builder

Source: vapi.aiPackage feature lists ('RBAC + ZDR', 'Custom RBAC + ZDR + SSO')Checked on

The vendor doesn't say: switch-off, data location, EU hosting, price.

Alternatives

Vapi alternatives that don't train on your data

Other phone and voice tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Crisp

    Essentials · $95 / mo

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • RingCentral AI Receptionist

    standalone plan · $49 / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Synthflow

    Enterprise · $30,000 / yr

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • BOTfriends X

    See details

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓?✓

  • Parloa AI Agent Management Platform

    enterprise, consumption-based · See details

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓?✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices