Inworld Realtime TTS-2 vs Smallest.ai Lightning TTS

Inworld Realtime TTS-2 60

No OpenAPI or other machine-readable file was found. llms.txt and the API reference don't link one and the usual paths redirect to pages (0). llms.txt, llms-full.txt, a Markdown twin of every page and a keyless docs MCP server (10). The models page says which model suits what, the Reasoning guide says where it runs and where it doesn't yet (WebSocket, Realtime, batch), and the reference marks fields each model ignores (17 of 20). Typed fields with enums for encoding, deliveryMode, reasoning and timestampType, a sample-rate range, per-endpoint text limits and a 600-character cap on reasoningContext (14 of 15). Examples in curl, Python, JavaScript and the CLI, with one 4XX example and the concurrency error, and no TTS error list (9 of 15). Versioned /v1 paths and dated TTS release notes, but the notes have no entry for the 28 October Reasoning launch and model update, and models have no dated snapshots (10 of 15). Total 60.

Smallest.ai Lightning TTS 92

OpenAPI 3.1 for the sync and SSE routes and AsyncAPI 2.6 for the WebSocket, with request and event schemas (25). llms.txt and a Markdown copy of every page (10). A transport guide, model cards and the compare page say which model and transport suit which job, but changelog entries correct the language lists and enums the docs and spec carried (15 of 20). Typed fields with enums for model, sample rate, language and output format, an 8,000-character limit and pattern rules on session_id and request_id (14 of 15). Examples in curl, Python and JavaScript, with error bodies on the reference and a shared error page (13 of 15). Versioned /v1 paths, a dated Lightning changelog and dated preview checkpoints (15). Total 92.

Inworld Realtime TTS-2 61

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Workspace API keys, deleted to revoke, with separate keys per environment advised, single-use client tokens valid 15 minutes, and a Realtime-only key type. No key can be limited to TTS, because write toggles cover only the Voice and Router APIs (25 of 30). The Terms (11 June 2025) say Inworld won't train generally available models on customers' non-public Materials, except feedback and content flagged for trust and safety. The Privacy Notice (18 January 2026) lists training AI models among its uses and covers voice data, while excluding data processed for enterprise customers (12 of 20). Zero data retention is Enterprise only or a Growth add-on. No retention period is published for other plans, async results are kept about 7 days, and whether the Reasoning model's step is covered isn't stated (6 of 15). Usage is attributed per key, and a Performance page (Builder and above) shows errors, latency and throttling. The Logs page sits behind the Portal login and wasn't read (8 of 15). SOC 2 Type II, HIPAA and GDPR claimed on the security page, with the trust centre unread. A vulnerability report form exists. No security.txt (404) and no bug bounty found (10 of 20). Total 61.

Smallest.ai Lightning TTS 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Inworld Realtime TTS-2 63

Closed service with clear terms naming Theai, Inc. dba Inworld AI, and MIT client packages on npm (15). The zero data retention page is specific about what is kept, but the Terms' no-training clause and the Privacy Notice's training use sit side by side without a reconciling sentence, and the privacy retention section gives no periods apart from up to three years for voice-derived biometric data (14 of 30). Dated discontinuation of inworld-tts-1 with automatic rerouting and release-stage definitions, but no written notice policy, and the 28 October update replaced inworld-tts-2 in place (12 of 20). US headquarters with isolated EU and India regions on Enterprise. No sub-processor list was found in the docs, and the trust centre wasn't read (10 of 20). Total 51.

Smallest.ai Lightning TTS 70

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration steps, and earlier models answer 410 with a pointer. The notice for the default lightning_v3.1, dated 2 November, gives 28 days before voices change and v3.1 clones stop working, and the terms let Smallest discontinue services without notice (12 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 52.