Gladia Speech-to-Text API + MCP vs Smallest.ai Pulse STT

Gladia Speech-to-Text API + MCP 65

Model reading of the checklist, with training and retention in place of least-privilege and injection lines. Plain revocable API keys in the x-gladia-key header. Live sessions connect to a WebSocket URL minted per session by POST /v2/live, which we don't deduct for (20). The pricing page, read on 1 November, says Self-serve, the paid pay-as-you-go plan, is opted in to model training by default with a free opt-out in the profile, and Enterprise is opted out by default. The security page still says only Free plan data is used for training. We score the pricing page's default, as for AWS's default use with an opt-out (10 of 20). Retention is documented and jobs can be deleted, but zero retention needs Enterprise per the retention page (10). Job history through the list endpoint and dashboard, no audit log of key actions found (10). SOC 2 Type 1 and Type 2, a bug bounty programme that doubles as the disclosure route, no security.txt (404 on 1 November) and no public advisories found. The SDKs fixed an API key leak on cross-origin redirects in 2.1.0 (September) and limited list pagination to the configured API in 2.2.0 (13 October), both released. ISO 27001 is in progress, not held (15). 20 + 10 + 10 + 10 + 15 = 65.

Smallest.ai Pulse STT 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Gladia Speech-to-Text API + MCP 75

API reading of the checklist. Add-ons such as summaries, NER and translation are opt-in, so a plain request stays small, but there's no field selection (15). Pre-recorded jobs list with offset, limit and filters (20). Documented error codes, with a 429 for concurrency (15). No idempotency key. The docs warn that a job is already queued once the 200 or transcription.created webhook arrives, which is safe-retry guidance of a sort (10). One required parameter and official SDKs in JavaScript and Python (15). The official MCP server adds 8 tools for async jobs, which this API reading doesn't score.

Smallest.ai Pulse STT 66

API reading of the checklist. Word timestamps, utterances, diarisation, emotion and gender are each opt-in, so the default response is the transcript with metadata (18 of 25). There are no list endpoints for transcriptions to page. Output controls are the opt-in fields and finalisation settings on the socket (10 of 20). Errors carry a status and a machine-readable code or error_code (LANGUAGE_NOT_SUPPORTED_BY_MODEL, AudioTooLong and others) with fixes, but the body comes in two shapes, message or error (15 of 20). Batch calls are synchronous with no idempotency key, and whether a retried file is billed again isn't stated (10 of 20). A file call needs only the model and audio. Official Python and Node SDKs exist, though the Node SDK was last published in May 2025 (13 of 15). Total 66.

Gladia Speech-to-Text API + MCP 70

incident.io status page with per-component uptime bars and incident pages, and an RSS feed read on 1 November (20). One major incident in the 90 days from 3 August, a global Pre-Recorded and Real-Time incident on 23 September 2026 from 07:05 to 08:10 caused by a provider network fault, as read on 1 October. The rest are partial and read as minor, a 20-minute full outage and a timeouts incident on 22 September, slower processing on the afternoon of 23 September, and Europe-only degradations on 2, 10, 14 to 15 (elevated errors and timeouts in Europe from 09:07 on 14 September to 13:58 on 15 September), 21, 22 and 28 September and on 3, 4 and 7 October (Pre-Recorded v2 in Europe) (10). Concurrency limits published with numbers, 25 parallel async jobs plus 300 queued and 30 live sessions on paid plans, 3 and 1 on free (15). The docs say a 429 means the concurrency limit, but we found no backoff guidance or Retry-After (5). The pricing page's plan comparison, read on 1 November, lists a 99.9% uptime SLA for Enterprise (10). solaria-1 and solaria-3 are GA (10). 20 + 10 + 15 + 5 + 10 + 10 = 70.

Smallest.ai Pulse STT 63

BetterStack status page at status.smallest.ai with components for the Global, India and USA APIs (one health check covers the Agents and Models APIs), docs, the app and Electron, and per-component history (20). In the 90 days from 8 August the health checks on the shared API failed in all three regions on 9, 10, 13, 14 and 15 September (about 8, 21, 33, 17 and 64 minutes of flapping), in the Global and India regions on 11 and 17 September (12 minutes each), and in the USA region alone on 1, 3, 5, 12, 21 and 30 September (6 to 62 minutes) and 6 October (12 minutes). Outages in every region at once are read as wide errors, so several majors (0). Standard plan limits published per model, 100 concurrent streaming sessions and 25 batch requests a minute, and the pricing page also says 100 concurrent STT streams (15). 429 is documented with exponential backoff from 500 ms to 30 s and Retry-After when present, and batch calls are synchronous with optional webhooks (15). An infrastructure SLA of 99.99 per cent is named for Enterprise only, with no terms published, and the terms disclaim any availability commitment (5 of 10). Pulse, Pulse 2.0 and Pulse Pro carry no preview label, but eleven language codes are marked Beta (8 of 10). 20 + 0 + 15 + 15 + 5 + 8 = 63.

Gladia Speech-to-Text API + MCP 65

Closed service with an MIT SDK and MCP server and separate terms for Gladia SAS and Gladia Inc. (15). The statements disagree. The security page gives a 12-month default retention with custom policies for customers and says only Free plan data trains models, while the retention page gives 1 year on free, 3 weeks on paid and zero retention only on Enterprise, and the pricing page says Self-serve is opted in to training by default. ISO 27001 is described as in progress (15). Breaking changes are flagged with dates in the changelog, such as SDK 2.0.0 and the move to credit billing on 3 July 2026 with a 6 to 20 July rollout, but no deprecation policy was found (10). Hosting with a French provider is stated, and no sub-processor list was found (10).

Smallest.ai Pulse STT 71

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration targets, deprecated routes return a Deprecation: true header, and the 30 September changelog removed 14 European codes from the batch enum with a migration to multi-eu. The terms still let Smallest change or discontinue services at any time without notice (15 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 55.