Rime Prism vs Vaani Developer Platform

Rime Prism 70

Closed service with clear terms from Rime Labs, Inc., which say Rime doesn't train on input or output except for a voice model the customer asks for, and which put beta services on an as-is basis. The SDK is MIT (15 of 30). The privacy policy (effective 22 August 2025) states zero retention by default, 90 days of server logs and no training on customer data, and the security page and docs agree. All three describe text in and audio out metered by characters, and none says how Prism's caller audio, transcripts or the stored conversation are handled, or how call data sent for fine-tuning is kept. The DPA at rime.ai/dpa couldn't be reached from our network (15 of 30). No written deprecation policy. Arcana's cloud retirement was dated in the changelog with 17 days' notice (10 of 20). A sub-processor list with locations, all in the United States, and the Prism endpoint stated as US East (us-east-2) (18 of 20).

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

Rime Prism 40

No x402, MPP or L402 (0). $0.08 a minute on Flex and $0.064 on Scale, published without a login (20). $50 of usage a month on the Free plan, Prism included, with no card (20). The free month for early sign-ups in Rime's launch announcement wasn't scored. A person signs up in a browser to get a key (0).

Vaani Developer Platform 22

No x402, MPP or L402 (0 of 40). The ₹1 ($0.02) a minute platform fee, number rental, concurrency lines and add-ons are public, and the calculator shows each provider's unit rate without a login. Registry checks, extraction and evaluations "can add separate charges" that aren't priced, and the billing pulse depends on the account, so 3 off (17 of 20). The home page says "Start free on Vaani's Platform", but the pricing page states a prepaid wallet with no free credit, trial minutes or card rule, and we didn't sign up to check, so 5 of 20. A person signs up with email verification at platform.vaani.dev and creates keys in the dashboard (0). 0+17+5+0 = 22.

Rime Prism 41

Graded as a hosted API on its launch day. status.rime.ai redirects to an incident.io page at rimestat.us with Text-to-speech API and Platform API components, but no Prism component on 28 October 2026 (10 of 20). Prism launched that day, so there is no incident history for it. The two incidents on the page, on 3 and 5 September, were text-to-speech partial degradations (5 of 30). The errors page publishes per-session numbers (55 seconds a turn, 60 seconds of queued speech, 120 seconds or 512 tokens a reply, 5 minutes idle, 1 MiB a message), but no concurrency limit per account or key, and a full server answers 503 (8 of 15). Overload is documented as capacity_exceeded, unavailable, a 503 refusal and close code 1001, each with a retry-after-backoff instruction, and the tools guide says to make each tool safe to run once and never rerun a call with an unknown outcome. No Retry-After header is mentioned (13 of 15). SLAs are an Enterprise item and none is published (0). The changelog calls Prism available, but all four SDKs Rime recommends are 0.1.0 alpha releases, the Pipecat path uses a pinned preview, and the pricing page says half duplex at launch (5 of 10).

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

Rime Prism 69

No OpenAPI or AsyncAPI file for the WebSocket API was found in llms.txt or the reference (0 of 25). llms.txt and a Markdown twin of every page (10). The overview says what Prism handles, what it doesn't (text-only replies, sampling settings, a choice of language model, ending the caller's turn) and when a pipeline fits better, and a chart says when to use the SDK, LiveKit, Pipecat or the raw WebSocket (18 of 20). The WebSocket reference types every client and server event field with defaults and allowed values, refuses unknown fields with invalid_client_event naming the field, and takes tool parameters as JSON Schema. The schemas exist only as tables, not a file (13 of 15). Python and Node.js examples on each guide, and an errors page that lists 41 codes with cause, scope and what to do, plus HTTP refusals and close codes (15). A dated changelog with an RSS feed, a version field in session.created (such as 20261023a) and pinned SDK versions. The path carries /v1, with no version policy for the event set found (13 of 15).

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

Rime Prism 56

Graded as a hosted API. One Rime API key per request, sent as a Bearer header on the upgrade. Prism reads no query parameters and the docs say not to put the key in the URL. No scopes, no read-only keys and no ephemeral tokens for client devices were found, the same key also covers text-to-speech and speech-to-text, and rotation isn't described beyond creating tokens in the dashboard (20 of 30). tool_choice is auto only, so a backend can't force a call, but it can remove a tool mid-call with session.update. The prompting guide says Prism can call a tool before the caller confirms and to keep confirmation rules in tool code. The launch pages say every reply is text before speech so guardrails can check it, but the docs describe no step that holds a reply for checks (10 of 20). Prism takes untrusted caller audio and tool results. The docs say to confirm outcomes from the agent's own records, not the reply text, with no explicit prompt-injection guidance (6 of 15). Request, session and correlation IDs for support and token usage on each response.done. No per-call log or audit trail in the dashboard was found (6 of 15). SOC 2 Type II since May 2025, HIPAA compliance since February 2024 with an audit in March 2026, and a vulnerability disclosure policy linked from the security page. security.txt answered 404 and no bug bounty was found (14 of 20).

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

Rime Prism 73

Scored as a model API. A 65,536-token context, with truncation set to leave out the oldest turns by default, a configurable retention_ratio, a prism_truncation report on each reply, prism.conversation.get to read the stored history and conversation.item.delete to trim it (20 of 25). Replies are capped at 120 seconds or 512 tokens and can't be set lower. max_response_output_tokens, temperature and text-only replies are refused. Up to 16 labels per reply for routing. No lists to page (8 of 20). Errors carry code, scope, owner, param and a correlation_id, and the docs tell clients to branch on code and scope, never on message (20). Client events are matched by event_id, a repeated identical tool result is acknowledged, and Prism records late results. Prism doesn't deduplicate requests, a dropped connection doesn't resume, and the client replays history into a new session (12 of 20). Short instructions are enough to start, the voice defaults to astra and interruption is on. Official SDKs in Python, Node.js, Go and Rust, all alpha, plus LiveKit and Pipecat quickstarts (13 of 15).

Vaani Developer Platform 64

The local MCP server loads 9 compact tools, and VAANI_READ_ONLY=true leaves 3. Transcripts are cut at 20,000 characters by default with a note. The REST API has no field selection or summaries, so 3 off (22 of 25). Call history pages by page and page_size up to 200 with no filters. The MCP agent filter runs client-side on one page. Agents filter by search and published_only and campaigns by status (12 of 20). Campaign errors carry a machine-readable code, a message, the path and a request_id (shown as "unknown" in the example). Validation errors list the field location, the SDK maps each status to a typed exception including 402 for a low wallet, and the MCP server adds a hint per status (15 of 20). All 9 MCP tools carry readOnlyHint, destructiveHint and idempotentHint, with trigger_call and campaign_action marked destructive. No idempotency key on trigger-call, and the MCP client retries a POST once after a timeout or 5xx, so a call can be placed twice. The webhook docs say to deduplicate by event id (8 of 20). A call needs agent_id, contact_number and name, with medium defaulting to telephony. One official SDK, Python, sync and async. The npm package is an MCP server, not an SDK (7 of 15). 22+12+15+8+7 = 64.