Deepgram Self-Hosted Is Now FIPS 140-3 Compliant

For many federal and regulated buyers, the evaluation ends before it starts. The models are accurate enough. The latency is fine. Then a security reviewer asks one question: is the cryptography FIPS validated? If the answer is no, the deployment is over, no matter how good everything else is.

This shuts out emergency dispatch, defense, and other federal agencies handling sensitive citizen data. The organizations running some of the highest-stakes voice workloads in the world are also the ones held to the strictest rules about how software handles cryptography. For them, FIPS 140-3-validated cryptography is a procurement gate.

That changes with our latest self-hosted release. Deepgram now supports a FIPS 140-3-compliant configuration, so passing FIPS review no longer forces a choice between compliance and the strongest speech models.

The cryptography is built on modules validated under NIST's Cryptographic Module Validation Program, and it covers the full deployment path, connected or air-gapped. Your security team reviews a known, documented boundary backed by the Federal Information Processing Standards (FIPS).

Crucially, FIPS compliance maintains full feature parity. FIPS and standard environments share identical APIs, deployment workflows, and Nova-2/Nova-3 models, with no difference in performance. Because FIPS is an inherent deployment property, it requires no model downgrades, separate SKUs, or compliance surcharges.

Turning it on is a config change. Set FIPS mode in both your API and Engine config:

[fips]
mode = "enabled"

The deployment comes up with OpenSSL in FIPS mode:

engine [fips] mode=enabled   -> openssl_fips_enabled=true, has_fips_encryption=true

Two things are worth confirming before you cut over, because in FIPS mode the deployment enforces both strictly:

• Everything that connects to the API must support TLS 1.3. The FIPS API accepts TLS 1.3 only and rejects TLS 1.2 and non-FIPS ciphers. That's enforced by the FIPS build we ship (TLS 1.2 is disabled in our FIPS OpenSSL configuration), so any SDK, load balancer, or upstream service in your client path that can't negotiate TLS 1.3 will fail to connect. Verify the end-to-end route from client to API and confirm it before you switch over.
• Your models have to be the FIPS-encrypted builds. The FIPS Engine loads FIPS-encrypted models with file format .dgv2 and will not read the standard model files you already have on disk. Before you cut over, pull the FIPS versions of the models you run so the Engine has something to load. Both Nova-2 and Nova-3 are presently supported model architectures.

The FIPS-compliant deployment guide walks through the full setup end to end.

Until now, running a high-accuracy speech model fully self-hosted on your own cloud or bare-metal environment, with FIPS-validated cryptography, hasn't been available off the shelf, leaving teams to self-integrate open models and own the compliance work themselves.

So the buyer who needs FIPS-compliant Voice AI in their own air-gapped or FedRAMP environment had nowhere to go.

We closed this gap because self-hosting has been a first-class Deepgram product for years. The deployment is a set of components we build and operate ourselves: the API, the inference engine, and the licensing path between them, all running in containers on infrastructure you control. Because we own that whole surface, we could route its cryptography through a FIPS-validated module and make FIPS part of the product itself. A vendor that only ships model weights, or only runs in its own cloud, has no comparable surface to validate.

This release is one step toward a larger goal: Deepgram's voice AI running wherever it has to, with no compromise to get there. The same models, deployable in the managed cloud, in your own cloud, or entirely on your own infrastructure, each with the security and compliance posture that supports your user demands.

FIPS-compliant self-hosted Deepgram Voice AI is a concrete move in that direction. It runs with or without outbound connectivity: connected deployments reach Deepgram's License Proxy for licensing, and fully air-gapped deployments use the FIPS Billing image for offline license validation. What's next: Flux STT joining Nova-2 and Nova-3 in FIPS scope.

FIPS-compliant self-hosted is part of the enterprise self-hosted tier.

• Read the self-hosted deployment docs →
• Read the FIPS-compliant deployment guide →
• Talk to our team about federal and regulated deployments →

If voice is part of a regulated system you're building, the cryptography question no longer ends the conversation. You can deploy the models you actually want, on your own infrastructure, and clear the gate.