Deepgram Speech-to-Text (Nova-3, Flux) vs Smallest.ai Pulse STT

Deepgram Speech-to-Text (Nova-3, Flux) 72

Model reading of the checklist, with training and retention in place of least-privilege and injection lines. Keys belong to a project, carry a role and can expire on a date or after a set duration. Browser JWTs live 30 seconds and travel in a header (30). Requests may be kept for model training under the Model Improvement Program unless each request sets mip_opt_out=true, which any account can do (10). Opted-out requests are kept only for processing, so zero retention is self-serve but not the default (10). Per-request logs and usage data in the console and API, no audit log of key actions found (10). SOC 2 Type 1 and Type 2 (certificates on request) and HIPAA with a BAA on the compliance page. deepgram.com now serves a valid security.txt (Contact security@deepgram.com, Expires 30 September 2027), not found on 30 September. No disclosure policy, bug bounty or public advisories found. The 1 October check gave this line 5 where deepgram-tts and deepgram-voice-agent gave 10 and 12 on the same compliance page, so it's read as deepgram-tts was on 1 November (12 of 20). 30 + 10 + 10 + 10 + 12 = 72.

Smallest.ai Pulse STT 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Deepgram Speech-to-Text (Nova-3, Flux) 80

Statuspage at status.deepgram.com with component history and an RSS feed (20). Nine incidents in the 90 days from 3 August touch speech-to-text, every one partial, read as this run reads partial incidents (one model, one region, one datacenter or some requests) and as deepgram-tts is read. Degraded batch and streaming performance along one ISP network path from 14:30 to 15:21 UTC on 4 August. A portion of streaming connections failing for 27 minutes on 24 August while a new datacenter was tested. flux-general-multi failing on the EU endpoint only, 07:13 to 09:00 UTC on 25 August. Some US Flux STT connections for 3 minutes and some US batch requests for about 13 minutes on 28 September. Two 1 to 2 minute bursts on 30 September. Some batch requests slow or timing out, 19:27 to 21:53 UTC on 22 October. 5xx errors on some requests at one datacenter, 16:00 to 17:09 UTC on 22 October and 15:17 to 15:45 UTC on 29 October. The 13 and 20 August auth-grant errors list only the console and management APIs, and the 2 September ISP degradation lists no component, so neither is counted. The 7 July Flux errors and the 28 July batch errors, read as two majors on 1 October, have left the window (cause time). Minor only (20). Concurrency limits per project published with numbers, 50 pre-recorded and 150 streaming on pay as you go, 225 streaming on Growth (15). Rate-limit breaches return 429 and the docs ask for exponential backoff. Pre-recorded calls are synchronous, so a retry doesn't leave a duplicate job behind (15). No SLA found for self-serve plans (0). Nova-3 and Flux are GA (10). 20 + 20 + 15 + 15 + 0 + 10 = 80.

Smallest.ai Pulse STT 63

BetterStack status page at status.smallest.ai with components for the Global, India and USA APIs (one health check covers the Agents and Models APIs), docs, the app and Electron, and per-component history (20). In the 90 days from 8 August the health checks on the shared API failed in all three regions on 9, 10, 13, 14 and 15 September (about 8, 21, 33, 17 and 64 minutes of flapping), in the Global and India regions on 11 and 17 September (12 minutes each), and in the USA region alone on 1, 3, 5, 12, 21 and 30 September (6 to 62 minutes) and 6 October (12 minutes). Outages in every region at once are read as wide errors, so several majors (0). Standard plan limits published per model, 100 concurrent streaming sessions and 25 batch requests a minute, and the pricing page also says 100 concurrent STT streams (15). 429 is documented with exponential backoff from 500 ms to 30 s and Retry-After when present, and batch calls are synchronous with optional webhooks (15). An infrastructure SLA of 99.99 per cent is named for Enterprise only, with no terms published, and the terms disclaim any availability commitment (5 of 10). Pulse, Pulse 2.0 and Pulse Pro carry no preview label, but eleven language codes are marked Beta (8 of 10). 20 + 0 + 15 + 15 + 5 + 8 = 63.

Deepgram Speech-to-Text (Nova-3, Flux) 75

API reading of the checklist. Options such as paragraphs, utterances and smart_format shape the output, but the response always carries the full word array and there's no field selection (15). The request history endpoint pages and filters by date and status (20). Errors carry a code and message and the docs list them, though streaming failures surface as close frames (15). No idempotency key, and a retried pre-recorded call is billed again (10). Only the audio is required. Official SDKs in six languages, including Python, JavaScript, Go, .NET and Java (15).

Smallest.ai Pulse STT 66

API reading of the checklist. Word timestamps, utterances, diarisation, emotion and gender are each opt-in, so the default response is the transcript with metadata (18 of 25). There are no list endpoints for transcriptions to page. Output controls are the opt-in fields and finalisation settings on the socket (10 of 20). Errors carry a status and a machine-readable code or error_code (LANGUAGE_NOT_SUPPORTED_BY_MODEL, AudioTooLong and others) with fixes, but the body comes in two shapes, message or error (15 of 20). Batch calls are synchronous with no idempotency key, and whether a retried file is billed again isn't stated (10 of 20). A file call needs only the model and audio. Official Python and Node SDKs exist, though the Node SDK was last published in May 2025 (13 of 15). Total 66.

Deepgram Speech-to-Text (Nova-3, Flux) 78

Closed service with clear terms (15). The privacy policy was last updated on 26 October 2021, says data is stored on US servers and doesn't mention the Model Improvement Program, while the docs describe training by default and EU, Australian and Indian endpoints, so the statements disagree (15). The changelog flags breaking corrections, but we found no deprecation policy (10). Sub-processor list at deepgram.com/privacy/subprocessors and four regional endpoints (20). Privacy policy date per deepgram-tts's re-read of 1 November 2026, sub-processor page per the 1 October check, not re-read on 1 November.

Smallest.ai Pulse STT 71

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration targets, deprecated routes return a Deprecation: true header, and the 30 September changelog removed 14 European codes from the batch enum with a migration to multi-eu. The terms still let Smallest change or discontinue services at any time without notice (15 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 55.