Vulavula, a Lelapa AI product, provides African-language speech and language AI, including transcription and translation for contact-centre and enterprise workflows through APIs.
The core API capability was independently executed and credential lifecycle controls were tested. Current public information also corrects part of the original governance gap. This is stronger than a Tier 1 evidence profile. Recommend Tier 2: live API capability and self-service key management were directly verified; Tier 3 remains unsupported without deeper enterprise controls/deployment evidence.
The reviewer completed self-service sign-in, generated API keys, executed a live translation call, and tested key rotation and revocation. The original review recorded missing governance features such as MFA, SSO, usage visibility and a POPIA statement.
The current Lelapa AI product pages expose Vulavula API documentation and describe multilingual speech-to-text and translation. The current enterprise page now states POPIA-compliant and ISO-aligned positioning, so the old governance observation should not be presented as current fact.
Enterprise controls such as MFA/SSO and detailed usage governance were not fully verified in the original test.
The review covered API onboarding and a live language call, not a complete enterprise deployment.
These images formed part of the evidence pack considered during verification. Full-standard records retain the contributor's factual caption for each screenshot.
The verified result is the official public checkpoint record. For earlier-standard reviews, these findings may have been reconstructed from preserved evidence during Sandbox Africa’s 2026 audit; they are not presented as if the contributor originally completed a structured worksheet. Contributor-submitted checkpoint wording is shown only where explicit public reviewer attribution has been enabled.
Checking for dead links, infinite loading screens, or "Coming Soon" landing pages masquerading as live products.
The reviewer accessed the live Vulavula service and current product documentation remains available.
Can a user or enterprise actually sign up, or is it gated behind broken "Contact Sales" forms?
Self-service Google sign-in reached a working API key quickly without sales intervention.
Does the application actually do what it claims to do? (e.g. a payment gateway completing a test transaction, a logistics app's routing engine working.)
A live translation call returned valid output and credential rotation/revocation were exercised.
Assessing the logical flow, responsiveness, and basic accessibility of the platform.
The self-service API onboarding and credential-management flow was usable in the reviewed scope.
Load speeds, uptime reliability, and basic stress responses.
The reviewer measured sub-second warm-call latency and a few seconds on cold start for the exercised translation call.
Availability, clarity, and functionality of API documentation and webhooks.
Open API documentation, multiple API keys, rotation and revocation were directly verified.
SSL certification, basic encryption standards, and data handling transparency.
Credential controls were verified, but the original assessment did not establish MFA, enterprise SSO or a complete governance/security posture; newer provider claims require separate reassessment before being treated as verified.
Claiming verifies company ownership and enables a response or additional evidence. It does not permit editing of the independent review.
