Open-source voice AI is voice agent software whose code is published under a license that lets anyone read and change it. For a hospital or a bank, it means checking what the software does with each call instead of trusting a contract. It can run on the team's own servers, but it is not compliant by itself.
Key Takeaways
- Open source is a license to read and change the code that runs calls.
- Where calls run and which models hear them are choices beyond the license.
- Open code gives your reviewers evidence, and the rules still apply to you.
This post is part of our guide to open-source voice AI agents, where open code is evidence a regulated team can check for itself. Below, we explain the term and the questions to ask a vendor, using Dograh, the open-source AI voice agent platform we build, as the example.
What open-source voice AI means
Open-source voice AI is software for phone and web voice agents whose code is published under a license that lets anyone read and change it. That license is what makes it open source. The Open Source Initiative keeps the list of approved licenses, and a project counts as open source when its code uses one of them.
Some products publish their code under terms that limit commercial use or hosting, such as the Business Source License or the Server Side Public License. That is source-available code. You can read it, but you may not be free to run it the way your business needs, so check the license before anything else.
Dograh's code is on GitHub under the BSD 2-Clause license, which is on that list. A security reviewer can read exactly what the platform does with a call, down to where it stores the recording.
What open source does not promise
Open source tells you what you may do with the code, and leaves several things to you. It is not free to run. Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost). Dograh Cloud has a 1¢-a-minute platform fee. The platform is self-hostable, never self-hosted by default, and the cloud version suits a team that wants to start before its servers are ready.
And it is not private by default. Dograh is the orchestration layer that runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. If those models are hosted services, the audio reaches those providers. Every phone call passes through a carrier. Telemetry is on by default in the Docker setup. To switch it off, run ENABLE_TELEMETRY=false ./start_docker.sh and delete POSTHOG_API_KEY from docker-compose.yaml, since the start script ignores a telemetry setting in .env.
Why it matters to regulated buyers
A regulated team has to show its work, and open code lets it see the work first. Writing about open source in regulated industries, the Linux Foundation put it as "transparency is the primary currency". A team that has to explain how a system treats patient or account data can point to the code that does it.
Data location blocks projects too. In Cloudian's 2026 survey of 203 enterprise IT decision-makers, 58% said data residency concerns had directly delayed or scaled back AI initiatives. A platform the team can run in its own data centre or cloud account removes one of those blockers. Government agencies face the same question when citizen data must stay in-country.
Some voice vendors say closed source is the safer choice, because their voice models are trained on licensed recordings in a private environment. Training data is a fair thing to ask about, and it is a question about one model. A closed product installed in your private cloud moves the servers, yet your team still cannot read it. With open code, you read the platform and still choose any model whose license and training data you trust.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Questions to ask any voice AI vendor
Two answers decide most reviews, and an open-source platform lets you check both yourself. The first is who can read the code that handles a call, and where recordings and transcripts are stored. The second is which speech and language models hear the audio, and under whose contract.
The contracts follow the data. Under the Health Insurance Portability and Accountability Act (HIPAA), a vendor that handles patient information for you generally needs a business associate agreement (BAA), as HIPAA's business associate rules set out. Self-hosting means no BAA with Dograh is needed. Model providers may need their own when they handle patient information, and the phone carrier may need one, depending on what it stores. If the servers run in a cloud account, that cloud provider needs a BAA as well. Confirm how this applies to your setup with counsel.
The rules themselves, from health privacy to call recording consent, are in our guide to compliant AI voice agents. For a deployment built around them, see self-hosted voice AI for regulated industries.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
How to start an evaluation
Start with the license file, then the install. Our post on BSD-licensed voice AI explains what Dograh's license lets you build and ship.
Then run the platform yourself. A local Docker install and a browser test call take an afternoon, and our tutorial on how to self-host a voice AI agent with Docker walks through it. Write down every outbound connection the install makes before you connect a phone number or a model. That list is what your security reviewer will ask for first.
Glossary
- Approved license
- A license on the Open Source Initiative's list, such as BSD 2-Clause or the AGPL. Code under one of them can be read, changed and run by anyone, within that license's conditions.
- Source-available code
- Terms that publish the code but limit how you may use it, often banning competing hosted services. The Business Source License and Server Side Public License are examples, and neither is on OSI's list.
- Business associate agreement (BAA)
- The HIPAA contract a healthcare organization signs with a vendor that handles patient information for it. It sets the vendor's duties, but it does not move the organization's own liability.
