Smallest.ai Pulse STT vs Soniox Speech-to-Text

Smallest.ai Pulse STT 52

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Plain sk_ keys per organisation, shown once, revoked at once and deletable, with one key per environment advised. The docs say a key grants full account access, and no scope is offered. Short-lived access tokens (wat_, 30 to 900 seconds) cover only inference routes and can't mint tokens (22 of 30). The error reference documents the key as a ?token= query parameter for browser WebSockets, and the token guide passes access tokens as ?api_key= on the STT socket, so 10 off (12 of 30). The terms (21 October 2026) say Smallest won't use user content or input to train or improve its services. The privacy policy (18 September 2026) lists improving the services with machine learning as a use of usage data and doesn't address uploaded audio or text either way (15 of 20). Zero data retention and the x-expire-content header are Enterprise only, or a $1,000 a month HIPAA add-on on pay as you go. Other plans keep content readable in logs and the dashboard, with no retention period published (5 of 15). Usage is tracked per key, request rows sit in a dashboard log viewer, and every response carries x-request-id. No audit log of key actions was found (10 of 15). security.txt is valid to 31 December 2026 and the site footer claims SOC 2, GDPR and HIPAA compliance, while the pricing page lists SOC 2 compliance only on Enterprise. No bug bounty, disclosure policy or public advisories found (10 of 20). Total 52.

Soniox Speech-to-Text 87

Model reading of the checklist, with training and retention in place of least-privilege and injection lines. "Every API key in a project has a list of permissions": real-time STT, async STT and Files with Read and Write levels, model listing, usage and temporary keys, with permission_denied for anything else, and temporary keys that are restricted and expire. Keys go in the WebSocket handshake rather than the URL (30). Customer audio and transcripts are never used for training, per the 1 October check (20). Audio and transcripts aren't retained by default, and async files and transcripts auto-delete after 30 days or on a delete call, per the 1 October check (15). Per-request usage logs with request IDs, duration, tokens and cost (10). SOC 2 Type 2 and ISO/IEC 27001:2022, and the Python SDK's SECURITY.md gives a disclosure route with no acknowledgement time, as soniox-tts. No security.txt (404) and no bug bounty (12). 30+20+15+10+12 = 87.

Smallest.ai Pulse STT 40

No x402, MPP or L402 (0). Per-minute prices for each Pulse model published without a login, with two figures for Pulse Pro (20). Pay as you go starts with $10 of trial credits, which the terms also describe, and no page says a card is needed to claim them, read as inworld-tts's free plan was (20). A person signs up in a browser at app.smallest.ai and creates the key in the dashboard, and top-ups go to a card on file (0). Total 40.

Soniox Speech-to-Text 20

No x402, MPP or L402 (0). Token prices published without a login, with Soniox's own per-hour estimates (20). No free credits for new sign-ups since 2025-10-27 (0). A person signs up in a browser (0).

Smallest.ai Pulse STT 63

BetterStack status page at status.smallest.ai with components for the Global, India and USA APIs (one health check covers the Agents and Models APIs), docs, the app and Electron, and per-component history (20). In the 90 days from 8 August the health checks on the shared API failed in all three regions on 9, 10, 13, 14 and 15 September (about 8, 21, 33, 17 and 64 minutes of flapping), in the Global and India regions on 11 and 17 September (12 minutes each), and in the USA region alone on 1, 3, 5, 12, 21 and 30 September (6 to 62 minutes) and 6 October (12 minutes). Outages in every region at once are read as wide errors, so several majors (0). Standard plan limits published per model, 100 concurrent streaming sessions and 25 batch requests a minute, and the pricing page also says 100 concurrent STT streams (15). 429 is documented with exponential backoff from 500 ms to 30 s and Retry-After when present, and batch calls are synchronous with optional webhooks (15). An infrastructure SLA of 99.99 per cent is named for Enterprise only, with no terms published, and the terms disclaim any availability commitment (5 of 10). Pulse, Pulse 2.0 and Pulse Pro carry no preview label, but eleven language codes are marked Beta (8 of 10). 20 + 0 + 15 + 15 + 5 + 8 = 63.

Soniox Speech-to-Text 77

Instatus page at status.soniox.com with per-region components and a paged history (20). Minor incidents only since 6 August, with 70 minutes of failed API key creation in the console on 24 August, failed new WebSocket connections to stt-rt.eu.soniox.com between 12:50 and 13:03 UTC on 25 August (existing connections unaffected), and 45 minutes of real-time overload in the Japan region on 8 September ("some customers", partial). October and November have no notices (20). Limits published with numbers, 100 requests a minute, 10 concurrent streams, a connection limit derived from them and a fixed 300-minute stream cap (15). The errors reference documents limit_exceeded as HTTP 429 on REST and the STT WebSocket with what to do for each limit, "retry with exponential backoff" for 503 service_unavailable, and resubmitting failed async jobs, which aren't auto-retried. No idempotency key, so safe-retry guidance without one (12), as soniox-tts. No SLA found (0). stt-rt-v6 and stt-async-v6 are active and the v5 models deprecated, with no preview label (10). 20+20+15+12+0+10 = 77.

Smallest.ai Pulse STT 92

OpenAPI 3.1 for the HTTP routes and AsyncAPI 2.6 for the STT socket, with query parameters and event schemas (25). llms.txt and a Markdown copy of every page (10). Model cards and a compare page say which model suits which audio, and fields say where they're ignored (Pulse Pro ignores redaction), but several changelog entries correct response fields the reference had wrong, such as the diarisation shape and a redacted_entities array that doesn't exist (15 of 20). Typed query parameters with enums, defaults and required marks, though booleans are string enums that must be lowercase (13 of 15). Examples in curl, Python and JavaScript, and the reference lists 400, 401, 403, 413, 422 and 429 bodies with known code values (14 of 15). Versioned /v1 paths, a deprecations page and a dated Pulse changelog (15). Total 92.

Soniox Speech-to-Text 85

docs.soniox.com/openapi.yaml, OpenAPI 3.1.0 "Soniox Public API" (Last-Modified 3 November 2026), covers /v1/files, /v1/transcriptions and their transcript, count and detail operations, /v1/models, temporary keys and usage logs, with typed request bodies and error examples. No AsyncAPI file for the WebSocket (25). llms.txt with Markdown pages (10). Guides state purpose and say when to use the real-time or async API (15). Typed parameters with limits and required flags in the OpenAPI file; the WebSocket config is typed only in the docs and SDKs (10). Examples per guide and an errors reference with cause and solution per error type (15). Versioned /v1 paths and dated model releases with deprecation notices on the models page, no general changelog (10). 25+10+15+10+15+10 = 85.

Smallest.ai Pulse STT 71

Closed service with clear terms naming Smallest Inc. under California law (15). The ZDR page is specific about what each mode keeps, but the terms' no-training clause and the privacy policy's machine-learning use of usage data sit side by side, the privacy policy gives no retention periods, and the policy doesn't mention the DPA a footer link points to (15 of 30). A deprecations page gives statuses, dates and migration targets, deprecated routes return a Deprecation: true header, and the 30 September changelog removed 14 European codes from the batch enum with a migration to multi-eu. The terms still let Smallest change or discontinue services at any time without notice (15 of 20). Two regions named (Mumbai and Oregon) with region-pinned hosts, and only Google Analytics and Fullstory named among third parties, with no sub-processor list found (10 of 20). Total 55.

Soniox Speech-to-Text 76

Closed service with clear terms, last updated 2026-06-29, and an Apache-2.0 Python SDK (15). The security page, limits page and pricing page agree on no training, no default retention and 30-day async deletion (25). Model retirements are dated and old names route to the new model (v5 to v6 on 15 December 2026), though the October 2025 retirement of the preview models was described as accelerated (15). A data residency page names region-specific domains for the US, EU, Japan and India, and no sub-processor list was found (15).