It's a fair question. Closed voice AI platforms mean your call recordings, transcripts, and infrastructure decisions all live outside your company's control. For healthcare providers, banks, law firms, or anyone handling sensitive data, that's not a minor inconvenience — it's a compliance blocker.
This post gives you a direct answer on self-hosting Vapi and Retell, explains why both platforms are built the way they are, and maps out what genuinely self-hostable options actually exist.
Key Takeaways
- Neither Vapi nor Retell offers true self-hosting; orchestration stays closed and vendor-controlled, including enterprise "on-premises" setups
- Enterprise VPC or BYOC is not self-hosting: core logic still runs proprietary, vendor-owned code
- Genuine self-hosting needs public source code and a Docker path you fully control
- Open-source platforms like Dograh AI fill this gap for data-sensitive teams
Can You Self-Host Vapi or Retell? The Direct Answer
Here's the short version: no, not in any meaningful sense. Vapi and Retell are proprietary, closed-source SaaS products. There's no public repository, no installable package, and no license that lets you run either platform's core orchestration engine independently.
"Self-hosting" gets thrown around loosely. Genuine self-hosting means:
- Running the speech-to-text, LLM, text-to-speech, and orchestration layers on infrastructure you fully own
- Having zero dependency on the vendor's servers for a call to actually function
- Access to source code you can audit, modify, or deploy anywhere
What you CAN configure with Vapi or Retell:
- Bring-your-own API keys for STT, LLM, and TTS providers
- Custom LLM endpoints
- Bring-your-own-telephony (BYOC)
None of these move the core orchestration off the vendor's cloud. Even Vapi's own local development documentation requires tunneling through ngrok back to Vapi's hosted API just to test your webhook. If local testing needs a public tunnel back to the vendor, the cloud dependency runs deep.
Both vendors advertise something adjacent. Vapi's FAQ states they "support on-premise deployments for large Enterprises". Retell's security docs describe managed cloud, dedicated VPC, or on-premises deployment.
Neither page publishes pricing, a deployment architecture, or an installation package. The tier is gated behind "Contact Sales." What's deployed is still closed, proprietary software: a private instance of their black box, not open, auditable code. That is a different arrangement than true self-hosting.
Compare that to platforms explicitly built to be self-hostable under an open license. Dograh AI, for example, ships its full orchestration stack under a BSD 2-Clause license on GitHub, deployable via Docker in a matter of minutes. That's the structural difference: one is a sales conversation, the other is a git clone.
Why Vapi and Retell Don't Offer Self-Hosting
There are practical business reasons neither platform ships a downloadable version, and none of them are secret.
Revenue model. Both platforms monetize primarily through per-minute usage billing. Retell's public pricing runs $0.07 to $0.31 per minute depending on the agent configuration. Vapi charges $0.05/min for hosting plus pass-through model costs. Self-hosting would eliminate that recurring revenue entirely. There's no reason to give away the meter.
IP protection. The orchestration logic (interruption handling, latency tuning, endpointing, turn-taking) is the actual product. It's what separates a voice agent that feels natural from one that talks over you or lags awkwardly. That logic stays closed because it's the competitive moat.
Support complexity. Operating one controlled cloud environment is straightforward. Supporting arbitrary customer infrastructure (different OS versions, network configs, GPU availability) introduces far more variables than most engineering teams want to own.
Compliance-by-certification instead. Rather than opening the source, both vendors invest in certifications so customers sign a contract instead of removing the vendor from the data path:
- Vapi states it holds SOC 2 Type II certification, is HIPAA compliant with a required BAA, and is GDPR compliant
- Retell states SOC 2 Type 1 and Type 2 certification, plus HIPAA and GDPR compliance with self-signable BAAs at no extra fee
That's a reasonable approach for a closed platform. But it means you're trusting the vendor's infrastructure and accepting per-minute pricing at scale, rather than owning the deployment yourself. For some teams, that trade is fine. For others, especially regulated ones, it's the exact thing they're trying to avoid.
What Are Your Real Options for Self-Hosted Voice AI
If closed platforms won't work for your compliance or cost model, you've got three realistic paths.
Option 1: DIY Component Stacking
Assemble your own stack from open-source pieces: Whisper for speech-to-text, Llama or Qwen for the LLM, Kokoro or Chatterbox for text-to-speech. Then write the orchestration code that stitches it all together.
- Whisper and Chatterbox ship under MIT license
- Qwen3 and Kokoro use Apache 2.0
- Llama 4 uses Meta's custom Community License, with attribution and acceptable-use conditions
This gives you maximum control and zero platform fees. But you're now the platform team: interruption detection, latency tuning, and failure handling all become your responsibility. Expect months of engineering work before anything is production-ready.
Option 2: Self-Hostable Open-Source Platform
Deploy a pre-built orchestration stack under an open license, running entirely on infrastructure you control. This is the gap Dograh AI was built to fill. It's licensed under BSD 2-Clause and deployable via Docker. A visual no-code workflow builder lets you design call flows without writing orchestration logic from scratch.
- Connects to locally hosted models including Whisper, Kokoro, Llama, Voxtral, Qwen, and Chatterbox
- Supports bring-your-own-key for STT, LLM, and TTS providers
- Docker setup initializes in a few minutes, with PostgreSQL handling data storage on your own infrastructure
Option 3: Fully Managed Private Cloud
A vendor deploys and operates the entire voice agent stack inside your cloud environment (AWS, GCP, Azure, or on-prem) instead of theirs. You get data sovereignty without needing an in-house DevOps team to maintain it. Dograh offers this model directly, handling orchestration, upgrades, and reliability while your data never leaves your environment.
How to spot genuine self-hostability, regardless of vendor:
- Is there public source code you can inspect?
- Is there a documented Docker or deployment path?
- Does call data avoid round-tripping through the vendor's own servers?
If any of those three fail, you're not looking at self-hosting. You're looking at a dedicated instance of someone else's closed software.
Common Workarounds and Their Real Limits
Teams often try to bridge the gap with partial fixes. Here's where they fall short.
- BYOC/BYOK (bring your own carrier/keys): Reduces lock-in for telephony and model billing, but orchestration still runs on the vendor's servers—you've changed their supplier, not the vendor.
- Enterprise VPC or "dedicated instance" offerings: Usually expensive, slow to procure through sales, and still run the vendor's proprietary code. You're renting a more isolated version of the same stack.
- BAA/DPA agreements: A BAA or DPA manages legal risk. It does not deliver true data sovereignty—the vendor still processes your data, just under contract.
Is Self-Hosting Right for You?
Self-hosting isn't the right call for every team. It depends on your data sensitivity and engineering capacity.
Best fit when you:
- Operate in regulated industries (healthcare, fintech, legal, government) where dropping vendor BAAs/DPAs shrinks compliance scope
- Have ML/DevOps capacity and want full model flexibility with no per-minute fees at scale
You can wait if you:
- Are still validating the use case
- Run low call volume with no sensitive data
- Need speed-to-launch more than full stack ownership
If you fall in the first camp, a self-hostable platform or managed private cloud closes the compliance gap without requiring you to build an orchestration engine from scratch.
Frequently Asked Questions
Is Vapi AI free or paid?
Vapi is not free. New users get limited trial credit, but usage is billed per minute across orchestration, STT, LLM, and TTS once credits run out.
Is Vapi open source?
No. Vapi's orchestration code, dashboard, and infrastructure are proprietary and closed, so self-hosting isn't possible.
Is Retell AI open source or self-hostable?
No. Retell is a closed, pay-as-you-go SaaS platform with no public source code or self-hosted deployment package.
What's the difference between BYOC and true self-hosting?
BYOC only changes which telephony or API keys get used. True self-hosting means the entire orchestration stack runs on infrastructure you own.
Is there a genuinely self-hostable alternative to Vapi and Retell?
Yes. Dograh AI is open source under a BSD 2-Clause license and deploys via Docker, so you keep full control over data and infrastructure.
Can I self-host voice AI without a large engineering team?
DIY component stacking needs strong ML/DevOps skills. Self-hostable platforms with visual builders (such as Dograh AI), or fully managed private cloud options, remove most of that burden.
