3 of the 22 capabilities tracked on both differ.
| Measure | Bland AI | Vapi |
|---|---|---|
| Starts at | Usage only | Sales-gated |
| Charged per | The workspace | Not published |
| AI billed at | $0.11 per minute | $0.01 per AI interaction |
| Included, where the other says no | 0 capabilities | 0 capabilities |
3 of the 22 capabilities tracked on both products differ.
| Capability | Bland AI | Vapi |
|---|---|---|
| Live chat | IncludedEnterprise only per the compare table, though the billing docs publish the rate anyway at $0.01 per agent message. The widget carries both voice and chat and uses the same pathways, personas and memory as the phone channel. | IncludedBuild, at $0.005 a message. A Chat API with streaming and non-streaming modes, an OpenAI-compatible endpoint, session management, and a drop-in web widget that runs in chat or voice mode from one script tag. |
| Voice | IncludedStart. Voice is the product, billed per connected minute. | IncludedBuild. Voice is the product, billed at $0.05 a minute of connected call time on top of provider cost. |
| SMS | IncludedEnterprise only, priced at $0.02 per message in the billing docs. US numbers need A2P registration, and BYOT numbers must have their A2P campaign set up in Twilio because Bland cannot yet do it. | IncludedBuild, billed on the same $0.005 a message meter as chat. Requires a 10DLC-approved Twilio number, and inbound SMS is documented as US only. |
| Capability | Bland AI | Vapi |
|---|---|---|
| Resolution over knowledge base | IncludedCounted rather than metered: 10 knowledge bases on Start, 50 on Build, 100 on Scale, unlimited on Enterprise, with no per-query charge. Built from an uploaded file, raw text or a sitemap crawl. | IncludedA query tool retrieves from knowledge bases built in Vapi, billed as a knowledge-base line in the call cost array. A custom knowledge base server is the documented alternative, and keeps the corpus out of Vapi entirely. |
| Action-taking (API calls) | IncludedTools call external APIs mid-conversation, webhook nodes fetch data inside a pathway, and secrets hold credentials without hardcoding them. Expanded call logs show every webhook URL, status code and response payload after the fact. The Custom Code node, which runs JavaScript inside a pathway, is Enterprise. | IncludedTools are first-class and versioned: an API Request tool with configurable retries, custom function tools, client-side tools in the web SDK, argument encryption, and a tool rejection plan. Squad handoffs carry a contextEngineeringPlan controlling how much conversation and how many tool results move to the next assistant. |
| Handoff to human | IncludedWarm Transfers and Live Transfers are both Enterprise on the compare table. Cold transfer to a number is available lower down and bills the transferred leg at the plan's transfer rate, or free on your own Twilio. | IncludedBlind transfer, warm transfer, assistant-based warm transfer, dynamic destinations and on-hold specialist transfer are each documented separately. Nothing published says the $0.05 hosting meter stops when a call reaches a human. |
| Guardrails & citations | IncludedBoth Enterprise on the compare table. Guard rails run on every AI and user response in production and come in two shapes: time-based rules that must fire (AI disclosure, self-introduction, recording disclosure, default window 30 seconds) and content rules that must not. Citations extract structured values from transcripts with the quoted source text and timestamp attached. | Not published |
| Multilingual AI | Included17 languages named on the current voice generation plus 10 marked experimental. The docs index claims 40+ out of the box, which is not the same number as the enumerated list. Live Translation streams audio and returns translated speech between supported pairs. | Via middlewareDelivered by whichever third-party transcriber you select rather than by Vapi, which ships no speech recognition of its own and publishes no language count. The docs compare providers instead: Deepgram 100+ languages with auto-detection, Google STT 125+, Gladia 110+, AssemblyAI 18, while Azure, Whisper, Speechmatics and Talkscriber carry many languages but cannot detect them. So whether an agent can switch language mid-call is a consequence of a configuration choice, and the documented way to tell the agent it is multilingual is to list the languages in your own system prompt. |
| Capability | Bland AI | Vapi |
|---|---|---|
| Voice agent | IncludedTelephony arrives three ways: numbers bought from Bland at $15 a month, your own Twilio account, or SIP trunks from Genesys, Five9, NICE CXone, Amazon Connect or Talkdesk. SIP traffic bills at the standard voice rate with no SIP surcharge. | IncludedTransport is modular: SIP, WebSocket, WebRTC via LiveKit or Daily, or PSTN through an imported Twilio, Telnyx, Plivo, Vonage, DIDWW, Zadarma, didlogic or Amazon Chime number. Up to five free Vapi US numbers per account, US area codes only. |
| IVR replacement | IncludedA named solution page, and pathways handle DTMF button presses as call events. Bland says the platform was built phones-first, which shows in features like custom dialing that picks the outbound number to maximise pickup. | Not published |
| Real-time transcription | IncludedBland's own speech-to-text rather than Deepgram or a reseller, which is why no transcription vendor appears in the sub-processor list. Live transcripts stream in the Active tab of call logs, and a separate endpoint returns a corrected transcript re-derived from the recording afterwards. | IncludedStreaming recognition from a choice of eleven transcriber providers, or your own over a WebSocket. Both the caller and the assistant are transcribed, which is why a minute of call is two channels of audio on the provider bill. |
| Call summarization | IncludedAn AI summary is generated per call and returned on the call object, so it comes out with the export rather than living only in the dashboard. | IncludedCall analysis produces a summary and schema-defined structured outputs after the call, attached to the call record and readable through the API. Under HIPAA mode structured outputs are not stored unless each one is explicitly opted in. |
| Capability | Bland AI | Vapi |
|---|---|---|
| Automated QA coverage | IncludedEvals grade real calls at scale with configurable LLM judges, and every call carries automatic metrics for agent quality, transcription quality, sentiment, silence, interruptions and repetition, with issues flagged by severity. A human review workflow sits alongside it: assignee, status, QC tags and threaded notes. No export path is documented for Evals output. | IncludedScorecards grade every call automatically by awarding points when structured outputs meet conditions you define, landing in call.artifact.scorecards within seconds of call end. No per-call charge is published for grading, unlike Retell's $0.10 a minute. API only for now, by the vendor's own admission. Evals and AI-driven simulations sit alongside for pre-production testing. |
| Capability | Bland AI | Vapi |
|---|---|---|
| Raw data export | IncludedRare in this category: an actual export button, not just an API. Export Calls in the call logs header mails a CSV, respects the filters on screen, spans up to 180 days and lets you include or exclude individual fields. | API onlyEverything comes out through the API or a mirrored bucket; there is no export UI. Recordings and logs are served as 302 redirects to short-lived signed URLs against a private bucket, so a cached URL stops working. |
| Capability | Bland AI | Vapi |
|---|---|---|
| SAML SSO | IncludedEnterprise only. Both OIDC and SAML 2.0, with a setup wizard covering Okta, Azure AD, Google Workspace and Auth0. Users from a verified domain are provisioned automatically on first login. | IncludedEnterprise only, marked "-" against Build on the pricing page. SAML 2.0 or OIDC against any IdP, with Google Workspace, Microsoft Entra ID and Okta named. |
| SCIM provisioning | Not published | NoStated outright in the SSO documentation: "Vapi does not support SCIM provisioning." Members sign themselves up and an administrator invites them, so removing a leaver is a manual step even on an SSO contract. |
| Role-based access control | Not published | IncludedThe pricing page prints RBAC as a Scale row with "-" against Build, while the SSO documentation describes the three roles as ordinary organization behaviour. Which of the two governs a Build account is not resolved by anything published. |
| HIPAA / BAA | IncludedBAA is Enterprise only, blank on all three published columns. HIPAA eligibility is claimed without a tier, but a regulated buyer cannot sign the agreement that makes it usable at a published price. | Paid add-on$2000/mo add-on, priced identically on Build and Scale, or included by negotiation on an Enterprise subscription. A signed BAA is required first, started by emailing security@vapi.ai. Organization-wide with no per-assistant exception, not settable through the API, and mutually exclusive with Zero Data Retention. |
| SOC 2 | IncludedNo plan gate on the certification. Type I and Type II, with quarterly third-party penetration tests in scope. The report itself is behind the Trust Portal, and the pricing FAQ adds that compliance documentation is available under NDA on Enterprise. | IncludedThe trust center lists SOC 2 with reports behind an access request, while the pricing page prints SOC2 as a Scale-only row. The certification is account-wide; the report and the contractual commitment are what the enterprise tier buys. |
| GDPR | IncludedNo plan gate. A public DPA incorporates the 2021 EU Standard Contractual Clauses and the UK IDTA, and covers CCPA, the Colorado, Connecticut, Virginia and Utah statutes and the Swiss FADP alongside GDPR. Sub-processor changes carry 14 days notice and an objection right. | IncludedListed on the trust center alongside CCPA. The compliance page names its legal bases, enumerates data subject rights including portability, publishes its third-party processors, and covers transfers to the United States under standard contractual clauses. A full subprocessor register is public, with each entry showing purpose and processing location, which is more than most of this census publishes. |
| Data residency | IncludedEnterprise only for selection, though the regions themselves are documented publicly: Oregon, Canada Central, Sydney and Ireland, each with its AWS region and static egress IPs. Owning the models is what makes the claim different from a wrapper's, since inference runs on hardware in the region rather than routing to a US provider cloud. | IncludedAn isolated EU region exists (dashboard.eu.vapi.ai, api.eu.vapi.ai, sip.eu.vapi.ai) with its own outbound IP block, and an organization belongs to exactly one region. It is closed to new self-serve signups: EU support and self-serve growth are frozen until 2027, feature parity with the US is not guaranteed, and EU residency is reachable only through sales. |
| Data retention policy | IncludedNo plan gate in the API reference. recording_lifespan_days is set per organization from 1 to 1825 days, or -1 to disable retention. It governs recordings only; no equivalent control is documented for transcripts, pathway logs or extracted variables. | IncludedFixed rather than configurable on Build: 14 days of call history, 30 days of chat history. Custom on Scale. Per-assistant artifactPlan flags switch recording, logging and transcription off individually, and PCI mode deletes recordings and transcripts permanently when no bucket or webhook is configured. |
| Right-to-erasure tooling | IncludedUnder the DPA, Bland deletes or returns all Customer Personal Data at the end of the Services on request, excluding backups which it isolates from further processing. The request window is 14 days from cessation, by email to security@bland.ai. | IncludedBy request to support@vapi.ai under GDPR and CCPA. The privacy policy states that retention depends on the customer's configuration and that data is deleted on request, while also reserving the right to retain recordings, transcripts and logs to train and improve the AI models. |
| Capability | Bland AI | Vapi |
|---|---|---|
| REST API | IncludedNo plan gate. A dashboard API key works from Start. | IncludedNo plan gate. A private key from the dashboard works on Build. |
| Webhooks | IncludedPost-call webhooks fire after a call ends and can be fetched, created or resent through the API. Payloads are verifiable by HMAC signature, and Enterprise adds asymmetric JWT signing. The CLI forwards webhooks to localhost without ngrok. | IncludedServer URLs with authenticated server events, an end-of-call-report event, campaign pre-dial webhooks, and local development tooling in the CLI. |
| SDKs | Includedbland-cli from npm covers the whole account and emits JSON on every read command. It bundles a local MCP server and Bland hosts a remote one. A Web Agent SDK embeds an agent in a browser. No first-party Node or Python server library is documented. | IncludedServer SDKs for TypeScript and Python, real-time SDKs for web, iOS, Flutter, React Native and a vanilla script tag, an official CLI, and a docs MCP server. Custom transcriber, custom LLM and custom TTS servers are each documented, so every pipeline stage except the proprietary orchestration layer can run on your own infrastructure. |
| Published rate limits | IncludedPartly. org_rate_limit is documented with a default of 5, and the send-call reference enumerates five 429 classes including a 10-second floor between calls to the same number and separate limits for new accounts and international dialing. There is no per-endpoint table, and none of it covers the read endpoints used to extract data. | Not publishedNo rate limit appears on the API reference. The enterprise page sells "higher rate limits" as a negotiated term, which confirms a Build ceiling exists without naming it. |
Both entries last checked Sep 9, 2026.
2 of 9 not published by Bland AI, checked
2 of 9 not published by Vapi, checked