docs: add a legal and security documents page

[chiranjeet-vapi]

Description

• Customers frequently ask support where to get the DPA, the subprocessor list, SOC reports, BAA information and the terms of service. The docs only linked the Trust Center from the SOC 2 page.
• Added security-and-privacy/legal-and-security-documents.mdx, a routing page with one table that points each document to where it already lives: the Trust Center, the HIPAA page, or vapi.ai.
• Added the page to the Legal section in docs.yml.
• Also answers the most common follow-ups: how the DPA is accepted and when a countersigned DPA is available, that providers connected with your own keys are outside Vapi's DPA and BAA, the model-training position, audit reports, and how to report a vulnerability.
• The page states no prices.

Evidence

• Public Trust Center at https://security.vapi.ai/: Documents (Customer Data Processing Agreement, penetration test summary), Subprocessors tab, SOC 3 public and SOC 2 Type II under NDA, HIPAA card listing BAA providers, Customer Audit Rights, Terms of Service and Privacy Policy links.
• Vapi's DPA (Sections 7.2 and 9.2) and Terms of Service (Section 4).
• Existing docs: security-and-privacy/soc.mdx, security-and-privacy/hipaa.mdx.

Testing Steps

• fern check (pinned 5.151.1) passes locally
• Check the preview deployment for the new page and the Legal nav entry
• Legal or security owner approves the wording

[lightsage-app]

Lightsage docs evals

Waiting for the staging docs URL before running evals.

Lightsage will start the selected PR evals automatically when GitHub reports a successful docs deployment for this PR. This usually happens within 15 minutes.

Commit: 550d109
Status: waiting for staging docs URL

[stephenvapiai]

A few direct links and wording suggestions for this page. Each one is a suggestion you can commit from the PR.

[chiranjeet-vapi]

Applied all 14 suggestions, thanks. On your three questions:

1. Line 24: each request for a restricted document is approved separately, per customer, after a check that the company is legitimate, with a clickwrap or NDA at request time. Whether one approval covers later downloads, and whether it is per person or per company, is a question for Trust and Safety, so I left the line as is.
2. Line 28: "self-serve" meant plans bought in the Dashboard without an Enterprise agreement or Premier Success Package. I reworded it to say exactly that, and named both on the countersigned DPA sentence too.
3. Line 36: it was a real difference. "Customer data" was the broad claim and "content" is the Terms of Service term for what Vapi may use to improve call features. I changed the first sentence to "your content" so the section uses one term.

Yes, please have Trust and Safety review it once this round is done. Could they also click through the Trust Center item links, since the site returns 200 for any path?