RAG and retrieval tools that state HIPAA compliance
The INITE Atlas lists 10. By use, the list opens with Pinecone, Zilliz, Qdrant, Weaviate and Reducto.
The vendor states HIPAA compliance on its own trust, security or privacy page; some offer a BAA. Their statement, read with the date; we did not audit it.
Where each one says so
| Tool | Where it says so | Price | Visits/mo |
|---|---|---|---|
 PineconeFrom $20/mo | offers a BAApinecone.io/securityread Oct 7, 2026 | From $20/mo | 91k |
 ZillizFree plan · From $197/mo | zilliz.com/trust-centerread Oct 7, 2026 | Free plan · From $197/mo | 12.3k |
 QdrantFree plan | offers a BAAqdrant.tech/securityread Oct 7, 2026 | Free plan | 7.9k |
 WeaviateFree plan · From $45/mo | weaviate.io/securityread Oct 7, 2026 | Free plan · From $45/mo | 5.3k |
 ReductoFrom $10 per use | docs.reducto.ai/security/policiesread Oct 7, 2026 | From $10 per use | 2.9k |
 UnstructuredFree plan · From $0.02 per use | trust.unstructured.ioread Oct 7, 2026 | Free plan · From $0.02 per use | 2.8k |
 turbopufferFrom $16/mo | offers a BAAturbopuffer.com/docs/securityread Oct 7, 2026 | From $16/mo | 1.5k |
 VectaraFrom $100,000/yr | vectara.com/legal/privacy-policyread Oct 7, 2026 | From $100,000/yr | 1k |
 Ragie ConnectFree plan · From $100/mo | ragie.ai/privacy-policyread Oct 8, 2026 | Free plan · From $100/mo | 133 |
 OctopodaFree plan · From $19/mo | octopodas.com/securityread Oct 8, 2026 | Free plan · From $19/mo | 5 |
How we read a tool
No votes, no reviews, no vendor claims. Every week a crawler reads each tool's own site and a few public registries, and the words on the card are bands over what it read.
- Use: visits to the site (estimated), installs from npm and PyPI, presence in Chrome's usage report.
- Activity: the newest release on GitHub, npm or PyPI; the newest dated page on the site; open roles on a public jobs board.
- Price: the vendor's own pricing page, read with the date. A figure is printed only when it is on that page.
- The line and the use cases are written by us from the homepage, one tool at a time, and refused when they repeat the vendor's marketing.
How AI assistants read each site — the reading vendors ask us about — is on each tool's own visibility page.
How we read every tool → · By INITE Atlas Desk
Cookies
Before we count this visit
Analytics and ad measurement tell us which pages and which of our ads do their job: Google Analytics and Google Ads, the Meta pixel, Yandex Metrica, and one first-party id of our own. Nothing is stored until you answer, and declining changes nothing about the site.