Amazon Transcribe vs Smallest.ai Pulse STT

Amazon Transcribe 83

Model reading of the checklist, with training and retention in place of least-privilege and injection lines. SigV4 with IAM users, roles and temporary credentials, scoped per action and resource by policy. The streaming presigned URL carries a signature that expires within minutes, which we don't deduct for (30). Section 50.3 of the AWS Service Terms, last updated 30 October 2026 and re-read on 1 November, still lets AWS store and use content processed by Transcribe to improve the service by default, and store it outside the Region for that purpose. Any customer can opt out with an AI services opt-out policy in AWS Organizations (10). Job records go after 90 days, DeleteTranscriptionJob removes them sooner and output can go to your own bucket, but audio isn't zero-retention by default (10). Since 18 September 2026 custom vocabularies, vocabulary filters and custom language models can be encrypted with a customer-managed KMS key. CloudTrail logs API calls per caller (15). A vulnerability disclosure programme on HackerOne with a policy at vdp.aws.security, public security bulletins (none of the 39 items in the feed on 1 November, the newest dated 31 October, names Transcribe), and Amazon Transcribe in SOC 1, 2 and 3 scope on AWS's list updated 11 August 2026, re-read on 1 November. The security.txt on aws.amazon.com, re-read on 1 November, expires on 16 October 2027 and points to the VDP. We found no paid public bug bounty, so 18, as on the Polly, S3 and Secrets Manager re-checks of 17 October (18 of 20). 30 + 10 + 10 + 15 + 18 = 83.

Smallest.ai Pulse STT 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Amazon Transcribe 80

API reading of the checklist. The transcript is one JSON file with every item and its timings, with SRT and VTT subtitles as the compact alternative and no field selection, per the 1 October check (15). ListTranscriptionJobs filters by Status and JobNameContains and pages with MaxResults and NextToken, re-read on 1 November (20). Typed exceptions per action, each with a recovery hint (20). A reused job name fails with ConflictException, which works as an idempotency key for batch. Streaming has no resume (15). Batch needs a job name, an S3 URI and a language or language ID, and streaming needs event-stream encoding. SDKs in every major language (10).

Smallest.ai Pulse STT 66

API reading of the checklist. Word timestamps, utterances, diarisation, emotion and gender are each opt-in, so the default response is the transcript with metadata (18 of 25). There are no list endpoints for transcriptions to page. Output controls are the opt-in fields and finalisation settings on the socket (10 of 20). Errors carry a status and a machine-readable code or error_code (LANGUAGE_NOT_SUPPORTED_BY_MODEL, AudioTooLong and others) with fixes, but the body comes in two shapes, message or error (15 of 20). Batch calls are synchronous with no idempotency key, and whether a retried file is billed again isn't stated (10 of 20). A file call needs only the model and audio. Official Python and Node SDKs exist, though the Node SDK was last published in May 2025 (13 of 15). Total 66.

Amazon Transcribe 85

Closed service under the AWS Service Terms, last updated 30 October 2026 (15). The service terms, privacy notice (last updated 18 May 2026, re-read on 1 November) and job retention agree, and the data processing addendum and a public sub-processor list (last updated 30 October 2026) exist, but the default permission to use content for improvement sits in section 50.3 of the service terms rather than the Transcribe guide. The DPA's text is per the 1 October check (25). The AWS Customer Agreement commits to advance notice before material functionality of a GA service is discontinued, but we found no dated Transcribe deprecation notices. The Python streaming SDK carries a deprecation notice in its README, which isn't the service (15). Sub-processors and regions disclosed, with region choice per request. Section 50.3(c) discloses that content kept for improvement may be stored outside the Region unless the organisation opts out (20). 15 + 25 + 15 + 20 = 75.

Smallest.ai Pulse STT 71

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration targets, deprecated routes return a Deprecation: true header, and the 30 September changelog removed 14 European codes from the batch enum with a migration to multi-eu. The terms still let Smallest change or discontinue services at any time without notice (15 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 55.

Amazon Transcribe 60

Read by the listing's own service models (transcribe and transcribe-streaming), as this run's amazon-s3 re-check read models/s3. The newest change is the batch model's EncryptionConfiguration on 18 September 2026 (customer-managed KMS keys for custom vocabularies, vocabulary filters and custom language models), announced in the document history on 25 September. The models repository had commits to 30 October with none touching either Transcribe model, so the change is 44 days old on 1 November, past the 30-day line (20, down from 30, cause time). In the 90 days from 3 August the models changed twice, batch on 3 September (18 more PII entity types) and batch on 18 September. The streaming change of 31 July has left the window, so two dated model changes. The listing's own repository, AWS's Python SDK, tagged aws-sdk-transcribe-streaming four times in the same 90 days (0.9.0 on 13 August, 0.10.0 on 20 August, 0.11.0 on 24 August and 0.12.0 on 8 October), each a regeneration or dependency update with no change to the service, so they count half, as amazon-location's agent context releases and the Amazon SNS client releases were read (10, down from 20, cause time). Public document history, AWS re:Post and paid support plans (10). Official SDKs are current, @aws-sdk/client-transcribe and -streaming at 3.1161.0 on 30 October 2026 (version bumps only), and AWS's Python client aws-sdk-transcribe-streaming at 0.12.0 on 8 October (15). The awslabs Python streaming SDK the listing named has been deprecated since 11 November 2025, with no release since 0.6.4 in May 2025, and its replacement is marked pre-alpha and needs Python 3.12 or later (5 of 10). 20 + 10 + 10 + 15 + 5 = 60.

Smallest.ai Pulse STT 73

Read as a model. The newest Pulse changelog entry is dated 2 November 2026 (updated Indic benchmarks), and Pulse 2.0 launched within the period (30). Dated Pulse entries on 30 August, 18, 29 and 30 September, 1, 12, 13 and 21 October and 2 November (20). Public changelog, email support and a Discord server, with no evidence read of how they answer (10 of 15). The Python SDK smallestai 5.14.0 dates from 7 October with 12 releases since 9 August, but the npm Node SDK has not been published since May 2025 (8 of 15). The Python SDK repository runs CI and release workflows, but has no licence file (5 of 10). Total 73.

Amazon Transcribe 75

AWS Health Dashboard with per-service, per-region history and RSS feeds (20). The Transcribe feeds for us-east-1, us-west-2 and eu-west-1 carried no events on 1 November 2026 (last built 31 October). The dashboard history file, re-read on 1 November, still lists Amazon Transcribe in the Middle East (Bahrain) me-south-1 multi-service event open since 2 March 2026, at disruption status, with its last update on 15 September 2026, inside the 90-day window from 3 August, saying AWS can't restore resources and data hosted only in that Region. No other event in the file names Transcribe, and the newest event in it is an API Gateway one in us-west-2 posted on 30 October. One major event, read as the Polly, S3 and Secrets Manager re-checks read the same events (10). Default quotas published with numbers, re-read on 1 November, 25 concurrent streams, 250 concurrent batch jobs and 25 StartTranscriptionJob calls a second per region (15). Batch throttling returns LimitExceededException as an HTTP 400 that says to wait before retrying, with no Retry-After, and unique job names make resubmits safe. Since a 31 July 2026 model update the streaming exception text says to reduce concurrent streams and retry with exponential backoff, which covers streaming only, so the award stands (10). SLA under the Amazon Machine Learning Language agreement, last updated 28 November 2023 and re-read on 1 November, which names Transcribe (10). GA (10). 20 + 10 + 15 + 10 + 10 + 10 = 75.

Smallest.ai Pulse STT 63

BetterStack status page at status.smallest.ai with components for the Global, India and USA APIs (one health check covers the Agents and Models APIs), docs, the app and Electron, and per-component history (20). In the 90 days from 8 August the health checks on the shared API failed in all three regions on 9, 10, 13, 14 and 15 September (about 8, 21, 33, 17 and 64 minutes of flapping), in the Global and India regions on 11 and 17 September (12 minutes each), and in the USA region alone on 1, 3, 5, 12, 21 and 30 September (6 to 62 minutes) and 6 October (12 minutes). Outages in every region at once are read as wide errors, so several majors (0). Standard plan limits published per model, 100 concurrent streaming sessions and 25 batch requests a minute, and the pricing page also says 100 concurrent STT streams (15). 429 is documented with exponential backoff from 500 ms to 30 s and Retry-After when present, and batch calls are synchronous with optional webhooks (15). An infrastructure SLA of 99.99 per cent is named for Enterprise only, with no terms published, and the terms disclaim any availability commitment (5 of 10). Pulse, Pulse 2.0 and Pulse Pro carry no preview label, but eleven language codes are marked Beta (8 of 10). 20 + 0 + 15 + 15 + 5 + 8 = 63.

Amazon Transcribe 30

No x402, MPP or L402 (0). Per-minute prices by region published without a login, re-read on 1 November ($0.006 batch and $0.01 streaming in US East) (20). The pricing page still shows 60 free minutes a month for 12 months, which per the 1 October check applies only to accounts opened before 2025-07-15. Newer accounts get up to $200 in Free Tier credits, and Free Tier FAQ Q4, re-read on 1 November, says a payment method isn't required to sign up for most new customers, though AWS may request one to verify identity. Half, as on the Polly, S3 and Secrets Manager listings (10). A person signs up in a browser. IAM can mint keys by API, but only after a human has an account (0). 0 + 20 + 10 + 0 = 30.

Smallest.ai Pulse STT 40

No x402, MPP or L402 (0). Per-minute prices for each Pulse model published without a login, with two figures for Pulse Pro (20). Pay as you go starts with $10 of trial credits, which the terms also describe, and no page says a card is needed to claim them, read as inworld-tts's free plan was (20). A person signs up in a browser at app.smallest.ai and creates the key in the dashboard, and top-ups go to a card on file (0). Total 40.