Amazon Polly vs Smallest.ai Lightning TTS

Amazon Polly 83

Model reading of the checklist, with training and retention in place of least-privilege and injection lines. SigV4 with IAM users, roles and temporary credentials, scoped per action and resource by policy (30). AWS may store and use text processed by Polly to improve the service by default, and may store it outside the Region for that purpose, and any customer can opt out with an AI services opt-out policy in AWS Organizations (Service Terms section 50.3, Last Updated 30 October 2026, re-read on 1 November) (10 of 20). Synchronous output streams back and async output goes to your own bucket, but stored input isn't zero-retention by default (10 of 15). CloudTrail logs API calls per caller (15). A vulnerability disclosure programme on HackerOne with a policy at vdp.aws.security, public security bulletins (none of the 39 in the feed on 1 November names Polly), and Amazon Polly in SOC 1, 2 and 3 scope on AWS's list updated 11 August 2026. The security.txt on aws.amazon.com is valid to 2027-10-16 and points to the VDP. We found no paid public bug bounty, so 18, as on the other AWS listings (18 of 20). 30 + 10 + 10 + 15 + 18 = 83.

Smallest.ai Lightning TTS 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Amazon Polly 80

AWS Health Dashboard with per-service, per-region history and RSS feeds (20). The Polly us-east-1 feed carried no events on 1 November 2026 (built 00:39 PDT), and the dashboard history file read that day has no event naming Polly other than the Middle East (Bahrain) me-south-1 multi-service event open since 2 March 2026, where Amazon Polly sits at the same disruption status S3 carries in the UAE event. On 15 September 2026, inside the 90-day window, AWS said it can't restore resources and data hosted only in that Region, and no update has followed. The newest event in the file is API Gateway in us-west-2 on 30 October, not Polly. One major event, read as the S3 and Secrets Manager re-checks read the UAE one (10). The 15 September update leaves the window after 14 December. Quotas published per operation and engine, 80 requests a second for standard SynthesizeSpeech and 8 for neural, long-form and generative, with burst and concurrency figures, re-read on 1 November (15). Throttled calls return HTTP 400 with ThrottlingException and the quotas page says to retry with backoff and jitter, which the SDKs do by default. Synthesis has no side effects, so a retry is safe (15). SLA under the Amazon Machine Learning Language agreement (Last Updated 28 November 2023), which names Amazon Polly, re-read on 1 November (10). GA (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.

Smallest.ai Lightning TTS 58

BetterStack status page at status.smallest.ai with components for the Global, India and USA APIs (one health check covers the Agents and Models APIs), docs, the app and Electron, and per-component history (20). In the 90 days from 8 August the health checks on the shared API failed in all three regions on 9, 10, 13, 14 and 15 September (about 8, 21, 33, 17 and 64 minutes of flapping), in the Global and India regions on 11 and 17 September (12 minutes each), and in the USA region alone on 1, 3, 5, 12, 21 and 30 September (6 to 62 minutes) and 6 October (12 minutes). Outages in every region at once are read as wide errors, so several majors (0). Limits are published with numbers but disagree. The limits page says one TTS request at a time per account with up to five sockets, the Lightning v3.1 Pro card says 10 concurrent and the pricing page says 15 streams and 100 requests a minute on pay as you go (8 of 15). 429 is documented with exponential backoff from 500 ms to 30 s and Retry-After when present, and the limits page tells clients to expect 429s at the concurrency ceiling (15). An infrastructure SLA of 99.99 per cent is named for Enterprise only, with no terms, and the terms disclaim any availability commitment (5 of 10). lightning_v3.1_pro is stable and only the dated checkpoint is preview (10). 20 + 0 + 8 + 15 + 5 + 10 = 58.

Amazon Polly 82

API reading of the checklist. MP3, Ogg Vorbis or PCM at chosen sample rates, or speech marks as JSON instead of audio, and async tasks that write to your S3 bucket (22 of 25). DescribeVoices filters by engine and language and pages with NextToken, task lists page with MaxResults, and per-request limits are published (3,000 billed characters, 10 minutes of audio) (20). Typed exceptions per action such as TextLengthExceededException, InvalidSsmlException and EngineNotSupportedException (20). Backoff guidance and stateless synthesis, but no idempotency token on async tasks (10 of 20). Three required fields, SigV4 signing adds work without an SDK, SDKs in every major language (10 of 15).

Smallest.ai Lightning TTS 72

API reading of the checklist. Eight output formats, a choice of sample rate and word timestamps only when asked (22 of 25). Voices are listed per model and the docs say they filter by language and accent. Paging wasn't confirmed (14 of 20). Errors carry error and message fields with a shared status-code guide, without TTS-specific codes (14 of 20). Synthesis is stateless and request_id is echoed for correlation, but there is no idempotency key and billing of a retried request isn't stated (10 of 20). Two required fields, text and voice_id, but the default model retires on 30 November. Official Python and Node SDKs, with the Node SDK last published in May 2025 (12 of 15). Total 72.

Amazon Polly 30

No x402, MPP or L402 (0). Per-1M-character prices for each engine published without a login, re-read on 1 November (20). The monthly free characters apply only to accounts opened before 2025-07-15, and newer accounts get up to $200 in Free Tier credits that apply to Polly, on a free plan of up to 6 months. The Free Tier FAQ says a payment method isn't required for most new customers, but AWS's account docs read on 1 November say AWS might request payment information and holds USD $1 to verify, so half, as on the S3 and Secrets Manager re-checks (10). A person signs up in a browser. IAM can mint keys by API, but only after a human has an account (0). 0 + 20 + 10 + 0 = 30.

Smallest.ai Lightning TTS 40

No x402, MPP or L402 (0). Per-character prices for both models published without a login (20). Pay as you go starts with $10 of trial credits, which the terms also describe, and no page says a card is needed to claim them, read as inworld-tts's free plan was (20). A person signs up in a browser at app.smallest.ai and creates the key in the dashboard, and top-ups go to a card on file (0). Total 40.

Amazon Polly 80

Closed service under the AWS Service Terms, last updated 30 October 2026, with section 50.3 on Polly unchanged (15). The service terms, privacy notice (Last Updated 18 May 2026) and Polly guide agree, a data processing addendum and a public sub-processor list (Last Updated 30 October 2026) exist, but the default permission to use content sits in the service terms rather than the Polly guide (25 of 30). Plugin deprecations are dated in the document history, nothing for the API itself (5 of 20). Sub-processors and regions disclosed, with the region chosen per request. Section 50.3 of the service terms discloses that text kept for service improvement may be stored outside that Region unless the organisation opts out (20).

Smallest.ai Lightning TTS 70

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration steps, and earlier models answer 410 with a pointer. The notice for the default lightning_v3.1, dated 2 November, gives 28 days before voices change and v3.1 clones stop working, and the terms let Smallest discontinue services without notice (12 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 52.