Circleback vs MeetStream

Circleback 77

Graded on the hosted REST API and MCP server with the hosted lines. incident.io status page at status.circleback.ai with four components, none of them the API (20). Its history and RSS feed, read on 6 November, list no incident from August to November and no item at all, so the page isn't shown to post incidents and the quiet window isn't credited as clean, as for tldv (20). Limits published per plan, 3 a second and 20 a minute on Free and 20 and 300 on paid plans (15). 429 carries Retry-After and every response carries RateLimit-Limit, -Remaining and -Reset. No idempotency key or safe-retry guidance for writes (12 of 15). No SLA found in the Terms or on the pricing page (0). The API has no beta label (10). 20+20+15+12+0+10 = 77.

MeetStream 45

Graded on the hosted REST API and MCP server with the hosted lines. No public status page was found, linked or at status.meetstream.ai (0), so no incident history could be read (5). Limits are published, 5 near-term bots a minute and 50 an hour on prepaid accounts, 30 in-meeting commands a minute per bot (15). 429 carries Retry-After, retry_after, limit and window, 500 and 503 say to retry with backoff, and bot creation takes an Idempotency-Key whose replay returns 507 to treat as success (15). No SLA found in the Terms or on the pricing page (0). Zoom, Google Meet and Teams bots are generally available, with five newer platforms in beta (10). 0+5+15+15+0+10 = 45.

Circleback 61

OAuth with dynamic client registration and two scopes on MCP, and API keys that are read-only or read and write, shown once (28 of 30). Read-only keys and a read-only MCP scope, and only an owner can delete a meeting. No confirmation step on the API for shares or deletes (14 of 20). Transcripts, notes and emails are participant-written text, and no prompt-injection guidance was found (0). A usage dashboard for workspace admins and meeting access requests, with no audit log of API or MCP calls found (4 of 15). SOC 2 Type II, EU-U.S. Data Privacy Framework certification, HIPAA, an external penetration test report on the security portal and a valid security.txt. No bug bounty found (15 of 20). 28+14+0+4+15 = 61.

MeetStream 42

A key grants full access to its workspace's bots and data, and workspaces separate keys. MCP sign-in is OAuth, which mints a key per connection. No scopes or read-only keys found (15 of 30). delete_bot_data needs confirm: true and is marked destructive, and remove_bot keeps recordings, with no read-only mode (10 of 20). Transcripts, chat and audio come from meeting participants, and no prompt-injection guidance was found (0). A dashboard bot detail page and signed webhooks, with no audit log of API calls found (5 of 15). ISO 27001 certified (630036), SOC 2 Type 2 under audit, HIPAA with a BAA, a trust centre and HMAC-signed webhooks. No security.txt (404) or bug bounty found (12 of 20). 15+10+0+5+12 = 42.

Circleback 72

28 MCP tools (15 for 11 to 30), plus 5 for the read-only scope that leaves write tools failing. The API lists return pages with filters (20 of 25). Cursor pagination through a Link header and filters by attendee, tag, folder, ownership and status (20). Errors carry a message and a code such as RATE_LIMITED (16 of 20). No idempotency key, and MCP annotations couldn't be read without a sign-in. Read-only keys and scope keep writes off (8 of 20). Few required parameters. The only official client is the Node CLI, with --json output (8 of 15). 20+20+16+8+8 = 72.

MeetStream 88

19 MCP tools (15), plus 2 because media come back as links rather than inline files (17 of 25). Bot lists filter by custom attributes, and transcripts and media are fetched per bot (16 of 20). Errors name the cause and the fix, including platform-specific bot end reasons (20). Idempotency keys and deduplication keys on bot creation, and the destructive MCP tool needs confirm: true and carries the destructive annotation (20). Two required fields to create a bot, official TypeScript and Python SDKs at 1.x and a CLI (15). 17+16+20+20+15 = 88.

Circleback 70

Closed service with clear terms, effective 7 April 2026, naming Circleback AI, Inc. under Delaware law (15 of 30). The security page says customer data isn't used to train models, retention settings are documented per data type with permanent deletion, the Terms delete data when an account is deleted, and a DPA and BAA are published. The Privacy Policy dates from 15 July 2024 and gives no periods (22 of 30). No deprecation policy or dated deprecation notice found (0 of 20). US processing under the Data Privacy Framework is stated. Sub-processors weren't found outside the DPA, which wasn't read in full (10 of 20). 15+22+0+10 = 47.

MeetStream 57

Closed service with clear terms of 7 August 2026 naming MeetStream Corp. (15 of 30). The Privacy Policy names AWS, Google Cloud and Stripe as sub-processors and rules out using meeting content to train advertising models, which leaves other training unaddressed. Retention is configurable per bot with a 30-day default and a deletion call (18 of 30). Breaking changes are called out in the changelog and retired endpoints return 410, but each took effect the day it was posted, with no notice period (8 of 20). Sub-processors named, data locations not stated (10 of 20). 15+18+8+10 = 51.

Circleback 30

No x402, MPP or L402 (0). Seat prices are public, $15 and $25 a user a month, with nothing priced per call (10). The Free plan includes API, MCP and CLI access with 30 days of history and costs nothing. A card isn't mentioned for it (20). A person signs up in a browser and creates a key or approves OAuth (0). 0+10+20+0 = 30.

MeetStream 40

No x402, MPP or L402 (0). Per-hour prices are public, $0.35 per bot hour, $0.10 for transcription and $0.05 per GB a month of storage past 30 days (20). $5 free credit with no card required (20). Signup and key creation happen in the dashboard, and the MCP OAuth flow needs a person to approve (0). 0+20+20+0 = 40.