Azure AI Speech speech-to-text vs Smallest.ai Pulse STT

Azure AI Speech speech-to-text 85

Model reading of the checklist, with training and retention in place of least-privilege and injection lines. Two regenerable resource keys for rotation, or Microsoft Entra ID tokens with Azure role-based access, which Microsoft recommends (30). Less 10 because the Realtime route for MAI-Transcribe-2-Streaming, added on 1 October 2026, documents an api-key query-string parameter on the WebSocket URI, using the same resource key, still so on the page updated 7 October and re-read on 1 November. The speech-to-text REST, fast, batch and Speech SDK docs take the key in a header only, so the deduction is applied once. SAS URLs for batch audio are scoped tokens for the customer's own storage, not the Speech credential, and aren't deducted (20). Microsoft doesn't use customer audio to train its models, per the 1 October check, not re-read since (20). Real-time and fast transcription audio isn't stored, and batch output stays until deleted or timeToLive expires, per the data privacy page updated 2026-08-26 and re-read on 1 November (15). Azure Monitor and the activity log record resource actions, though we didn't confirm per-request Speech logging (10). The MSRC disclosure policy, Microsoft's Azure bounty programme, SOC 2 and ISO 27001 reports, and public advisories. An MSRC search on 1 November found no CVE for the Azure Speech service (the Speech entries are Windows Speech components and Chromium). The microsoft.com security.txt passed its Expires date on 2026-09-23 and was still expired on 1 November, which we note without deducting, as on 5 and 17 October (20). 20 + 20 + 15 + 10 + 20 = 85.

Smallest.ai Pulse STT 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Azure AI Speech speech-to-text 90

Azure status page with post-incident reviews (20). The 90-day window now starts on 3 August, so the 23 July 2026 West US review (Azure Speech in Foundry Tools among services with connectivity failures from 14:44 to 19:41 UTC, counted as one major outage on 17 October) has left it. Two reviews remain on 1 November. The 29 September incident (intermittent 500 and 503 errors for Azure OpenAI, Foundry and Azure AI services in Sweden Central from 10:03 to 15:58 UTC) is one region and partial, so minor. The 30 September to 1 October gateway review (20:30 to 02:15 UTC) names networking services, not Speech. Nothing newer is listed. Minor incidents only (20). Limits published with numbers, 100 concurrent real-time requests and 600 fast or batch requests a minute by default, on the quotas page updated 23 October and re-read on 1 November (15). 429 documented as usually meaning autoscaling in progress, with retry logic advised and a 1-2-4-4 minute pattern for ramping load. Fast transcription is synchronous, so a retry doesn't duplicate a job (15). Covered by Microsoft's online services SLA, per the 1 October check (10). Fast transcription, batch and real time are GA. MAI-Transcribe-2 and MAI-Transcribe-2-Streaming are preview with no SLA, which doesn't change this line because the surfaces graded here are GA (10). 20 + 20 + 15 + 15 + 10 + 10 = 90.

Smallest.ai Pulse STT 63

BetterStack status page at status.smallest.ai with components for the Global, India and USA APIs (one health check covers the Agents and Models APIs), docs, the app and Electron, and per-component history (20). In the 90 days from 8 August the health checks on the shared API failed in all three regions on 9, 10, 13, 14 and 15 September (about 8, 21, 33, 17 and 64 minutes of flapping), in the Global and India regions on 11 and 17 September (12 minutes each), and in the USA region alone on 1, 3, 5, 12, 21 and 30 September (6 to 62 minutes) and 6 October (12 minutes). Outages in every region at once are read as wide errors, so several majors (0). Standard plan limits published per model, 100 concurrent streaming sessions and 25 batch requests a minute, and the pricing page also says 100 concurrent STT streams (15). 429 is documented with exponential backoff from 500 ms to 30 s and Retry-After when present, and batch calls are synchronous with optional webhooks (15). An infrastructure SLA of 99.99 per cent is named for Enterprise only, with no terms published, and the terms disclaim any availability commitment (5 of 10). Pulse, Pulse 2.0 and Pulse Pro carry no preview label, but eleven language codes are marked Beta (8 of 10). 20 + 0 + 15 + 15 + 5 + 8 = 63.

Azure AI Speech speech-to-text 20

No x402, MPP or L402 (0). Per-hour prices published without a login, though the page needs JavaScript and the Retail Prices API is the readable source (20). The F0 tier gives 5 real-time hours a month but an Azure subscription needs a card (0). A person signs up in a browser (0). MAI-Transcribe-2-Streaming's introductory $0.54 an hour appears only in Microsoft AI's launch post. No Azure meter for it was found in the Retail Prices API on 5 October, 17 October or 1 November, which doesn't move this line because the other per-hour prices are published. The East US meters for real time ($1), fast ($0.36) and batch ($0.18) an hour were unchanged on 1 November. 0 + 20 + 0 + 0 = 20.

Smallest.ai Pulse STT 40

No x402, MPP or L402 (0). Per-minute prices for each Pulse model published without a login, with two figures for Pulse Pro (20). Pay as you go starts with $10 of trial credits, which the terms also describe, and no page says a card is needed to claim them, read as inworld-tts's free plan was (20). A person signs up in a browser at app.smallest.ai and creates the key in the dashboard, and top-ups go to a card on file (0). Total 40.

Azure AI Speech speech-to-text 86

Closed service under Microsoft's product terms, with an MIT samples repository (15). The data privacy page, the privacy statement and the product terms agree on no storage for real time, retention until deletion for batch and no training (25). The data privacy page, re-read on 1 November and still dated 26 August, doesn't name the MAI streaming model. Dated retirements, REST API v3.0 and the v3.2 previews on 2026-03-31 and MAI-Transcribe-1 deprecated on 2026-08-20, under Microsoft's published lifecycle policy. The versions page now says 2024-05-15-preview will be retired on a date to be announced (20). Regions chosen per resource and a public sub-processor list (20). 15 + 25 + 20 + 20 = 80.

Smallest.ai Pulse STT 71

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration targets, deprecated routes return a Deprecation: true header, and the 30 September changelog removed 14 European codes from the batch enum with a migration to multi-eu. The terms still let Smallest change or discontinue services at any time without notice (15 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 55.

Azure AI Speech speech-to-text 80

The speech-to-text OpenAPI document for GA version 2025-10-15 is in Microsoft's public REST API specs, re-read on 1 November with 67 operations (25). No llms.txt found (0). Operation descriptions state purpose, and the speech-to-text overview says when to use real time, fast or batch (15). Batch request bodies are typed with enums and required fields, but fast transcription takes its options as a JSON string in the multipart definition field, documented but untyped on the wire (10). The REST reference carries examples and error responses per operation, per the 5 October check, not re-read on 1 November (15). Dated api-version values (current GA 2025-10-15, on the versions page updated 19 October) and monthly release notes (15). MAI-Transcribe-2-Streaming's WebSocket events are documented in prose and examples only, with no machine-readable contract, which leaves the graded REST surface unchanged. 25 + 0 + 15 + 10 + 15 + 15 = 80.

Smallest.ai Pulse STT 92

OpenAPI 3.1 for the HTTP routes and AsyncAPI 2.6 for the STT socket, with query parameters and event schemas (25). llms.txt and a Markdown copy of every page (10). Model cards and a compare page say which model suits which audio, and fields say where they're ignored (Pulse Pro ignores redaction), but several changelog entries correct response fields the reference had wrong, such as the diarisation shape and a redacted_entities array that doesn't exist (15 of 20). Typed query parameters with enums, defaults and required marks, though booleans are string enums that must be lowercase (13 of 15). Examples in curl, Python and JavaScript, and the reference lists 400, 401, 403, 413, 422 and 429 bodies with known code values (14 of 15). Versioned /v1 paths, a deprecations page and a dated Pulse changelog (15). Total 92.

Azure AI Speech speech-to-text 75

API reading of the checklist, per the 5 October check, not re-read on 17 October. Fast transcription returns combined text plus per-phrase detail, with word timestamps opt-in, but no field selection (15). Batch transcriptions and files list with top, skip and a next link (20). Error responses carry codes and messages, documented in the REST reference (15). No idempotency key on batch creation (10). Fast transcription needs a key, a file and a locale. Speech SDKs in C#, C++, Java, JavaScript, Python, Go, Objective-C and Swift (15). 15 + 20 + 15 + 10 + 15 = 75.

Smallest.ai Pulse STT 66

API reading of the checklist. Word timestamps, utterances, diarisation, emotion and gender are each opt-in, so the default response is the transcript with metadata (18 of 25). There are no list endpoints for transcriptions to page. Output controls are the opt-in fields and finalisation settings on the socket (10 of 20). Errors carry a status and a machine-readable code or error_code (LANGUAGE_NOT_SUPPORTED_BY_MODEL, AudioTooLong and others) with fixes, but the body comes in two shapes, message or error (15 of 20). Batch calls are synchronous with no idempotency key, and whether a retried file is billed again isn't stated (10 of 20). A file call needs only the model and audio. Official Python and Node SDKs exist, though the Node SDK was last published in May 2025 (13 of 15). Total 66.