didlogic Voice API vs jambonz

didlogic Voice API 38

Release notes dated by month, the newest September 2026 (click-to-call API and WebSocket calls), about 37 to 67 days before this check (20). Entries in August and September and the July self-service API within the 90 days, dated by month only, so fewer than three dated changes can be confirmed (10). Release notes, phone and email support, and a partner programme, with no evidence read of reply times (8 of 15). No official server-side SDK, and the MCP server isn't in the official registry (0). No package to assess (0). 20+10+8+0+0 = 38.

jambonz 78

Releases read from depth-200 clones on 4 November. @jambonz/sdk was tagged v0.11.0 on 24 October, v0.12.0 on 27 October and v0.12.1 on 29 October, jambonz-python-sdk v0.4.0 on 24 October, and jambonz-api-server and jambonz-feature-server v0.9.15 on 23 October (30). From 6 August that is at least five tags across the listed packages and servers, with the 11.1.5 and 11.1.6 release notes of 24 September and 4 October per the 8 October check (20). Of the 30 newest open issues and pull requests on jambonz-feature-server, 10 had a comment per the 8 October check. GitHub's pages were not re-read (10 of 25). The Node.js SDK is current and the Python SDK is still marked Alpha (12 of 15). The API server runs lint and tests in CI on every push and pull request. We did not see the latest run's result (6 of 10). 30 + 20 + 10 + 12 + 6 = 78.

didlogic Voice API 87

Public OpenAPI 3.0.3 file with 53 operations (25). llms.txt and Markdown pages (10). Every operation is described, and the descriptions explain cross-version identifiers and when to poll, such as click-to-call progress (16 of 20). Typed request bodies with required fields and enums in the spec (12 of 15). Examples, a standard error envelope ({"errors":{"base":[...]}}) and 401, 403, 404 and 422 responses on most operations (12 of 15). Paths versioned v1 and v2, and release notes dated by month (12 of 15). 25+10+16+12+12+12 = 87.

jambonz 53

Per the 8 October check, not re-read on 4 November under the terms pause. OpenAPI 3.1 files and an AsyncAPI 2.6.0 file on docs.jambonz.org were read on 8 October, but no page read then or since was recorded as linking them as visible downloads, and the docs host is now paused, so they aren't counted as a published contract (0). llms.txt, per-section indexes and every page as Markdown (10). The verb pages explain use at length. Operation descriptions in the API reference are mostly one line (12 of 20). Enums for call status, direction and mid-call actions and required fields are marked in the reference. to, call_hook, tag and amd are objects, a partial held (11 of 15). The SDK and verb pages carry code examples. Errors are a single msg string, a partial held (8 of 15). The Node.js SDK adds /v1 to the base URL it is given, and the changelog is dated with component version tables (12 of 15). 0 + 10 + 12 + 11 + 8 + 12 = 53.

didlogic Voice API 26

Graded on the hosted API and MCP server with the hosted lines. The footer's network status page carries no components or incidents, and no other status page was found (0). No readable incident history (5). Rate limits are given only for recording lookups (one a second, one lookup a minute) (5 of 15). Those endpoints document 429 with Retry-After and X-RateLimit headers, with no backoff guidance or idempotency elsewhere, including number purchases and click-to-call (6 of 15). The site claims 99.999 per cent voice uptime, but no SLA was found in the Terms (0). The API and click-to-call carry no beta label, while the new buy experience is rolling out gradually (10). 0+5+5+6+0+10 = 26.

jambonz 38

Graded as a hosted service, the API on jambonz.cloud, which the docs name as the simplest way to start. jambonz's Terms of Use (updated 13 October 2026) bar automated software that crawls or indexes any page of the website, so jambonz pages are per the 8 October check, not re-read on 4 November under the terms pause. No status page is linked from jambonz.org, the docs or the jambonz.cloud landing page (0), so there is no readable incident history (5). Rate limits are published with numbers, 600 requests per 5 minute fixed window per client IP address on the docs page, while the 11.1.6 notes of 4 October 2026 give 4,000 call creations and 600 call status reads a minute per account, a disagreement held as a partial (13 of 15). The API server's code sets standardHeaders on its limiter, so responses carry RateLimit-* headers including the reset, and a client over a limit receives 429. No backoff guidance or idempotency key was found for the REST API (10 of 15). No uptime SLA was found for jambonz.cloud. Support SLAs are sold only with Enterprise support for self-hosted systems (0). The REST and WebSocket APIs carry no beta label (10). 0 + 5 + 13 + 10 + 0 + 10 = 38.

didlogic Voice API 46

Revocable bearer keys created in the portal, each with full account access by the vendor's own warning. MCP OAuth mints a separate key per sign-in (18 of 30). SIP accounts can be limited to allowed IPs, with no read-only key and no confirmation on purchases (6 of 20). Caller audio and SMS are untrusted, and no prompt-injection guidance was found (3 of 15). Call detail records, transaction history and risk-check logs through the API, with no audit log of API calls (7 of 15). ISO/IEC 27001:2022 and ISO 9001 certificates from TÜV AUSTRIA Hellas with registration numbers. No security.txt or bug bounty found (12 of 20). 18+6+3+7+12 = 46.

jambonz 40

Docs readings are per the 8 October check, not re-read on 4 November under the terms pause. Bearer API tokens belong to an account or a service provider and carry expires_at and last_used fields. They can be created by API. No scopes and no delete operation appear in the published reference (18 of 30). No read-only key and no confirmation step before dialling were found. Call capacity limits can be set per account (4 of 20). Calls carry untrusted caller speech into the agent and llm verbs. The docs cover webhook signing with Jambonz-Signature and basic authentication, and no prompt-injection guidance was found in the pages read (5 of 15). Recent calls expose SIP traces, pcap files and Jaeger traces, and alerts can be pushed to a webhook, Slack, PagerDuty or email since 11.1.6. No log of API or portal actions was found (9 of 15). No security.txt, disclosure policy, bug bounty or certification was found. No SECURITY.md is in the API server, feature server, Node.js or Python SDK repositories (4 November clones), and osv.dev lists no advisory for jambonz. The 11.1.5 notes describe fixes from a security review, held as a partial (4 of 20). 18 + 4 + 5 + 9 + 4 = 40.

didlogic Voice API 58

Closed service with long, clear terms naming DID Logic PTE. LTD. in Singapore (15 of 30). The privacy policy commits to data minimisation and says call content isn't monitored except for requested recording, but gives no retention periods (12 of 30). No deprecation policy, though the docs explain backward-compatible identifier changes (5 of 20). Twelve points of presence are claimed, with no sub-processor list or data locations found (5 of 20). 15+12+5+5 = 37.

jambonz 52

Per the 8 October check for the privacy policy and docs, not re-read on 4 November under the terms pause. The API server, feature server and SDKs are public under MIT. The product on jambonz.cloud and in the self-hosted packages is jambonz Commercial, which needs a licence key and whose terms forbid modifying its proprietary portions, while the docs still call jambonz open source (20 of 30). The privacy policy is dated 4 May 2021. It gives 30 days for usage data and an opt-out for call detail records. It says audio is never stored on jambonz servers, and the 11.1.6 notes of 4 October 2026 say support keeps SIP and RTP from calls for a few days, with an opt-out added in that release. No DPA was found (10 of 30). No deprecation policy was found. Removals are announced in the release that makes them, such as SMPP and five speech vendors in July and August 2026 (6 of 20). No sub-processor list was found. The policy says servers are in the United States and names a third-party billing partner. Telemetry from self-hosted instances is listed field by field (7 of 20). 20 + 10 + 6 + 7 = 43.