Cerebrium vs GPUsMarket

Cerebrium 60

Service account tokens expire after up to one year (or never, if set to 0), are limited to 1 to 50 named projects and are revoked by deleting the account. Inference API keys are separate and can be deleted. No per-action scopes, and the CLI's SECURITY.md says tokens sit in plaintext in a config file with mode 0644 (20 of 30). Users have owner, member and billing roles, but tokens have no read-only form, and disable_auth defaults to true, so deployed endpoints answer without a token unless the owner changes it (5 of 20). Runs the owner's code and returns its output (10). Docs readings per the 8 October check, not re-read on 4 November. Audit log of 22 actions with actor, IP address and outcome, in the dashboard and over the API, on Standard (7 days) and Enterprise (30 days) only (12 of 15). SOC 2 Type II announced on 8 July 2026, HIPAA BAA on request, a trust centre, and disclosure to security@cerebrium.ai. No security.txt and no bug bounty found (13 of 20). No advisory for cerebrium on OSV on 4 November. 20 + 5 + 10 + 12 + 13 = 60.

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Cerebrium 70

Public OpenAPI 3.0 spec for the management API with 94 operations on 73 paths. Deployed endpoints take whatever the owner's function defines (25). llms.txt and a .md twin of every docs page (10). Operation descriptions are one line each. The guides say when to use the protected tier, async runs or a custom runtime (12 of 20). Required fields are marked, but the spec has no enums (valid values such as member and billing sit in prose) and several arrays and objects are untyped (7 of 15). The guides carry many worked examples. The spec has no examples and documents only 400 and 401 errors with a message string (8 of 15). Paths are versioned v2, v3 and v4 and CLI releases are dated on GitHub, but the spec version is a fixed 1.0.0 and no platform changelog was found (8 of 15). Docs and spec per the 8 October check, not re-read on 4 November. 25 + 10 + 12 + 7 + 8 + 8 = 70.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Cerebrium 48

Graded as a hosted service. Status page at status.cerebrium.ai with 11 components and 90 days of history, per the 8 October check, not re-read on 4 November (cerebrium.ai's terms bar robots and automatic means) (20). The 8 October reading covered the window to that day. Since 6 August it held degradations of 5 hours 7 minutes on 19 August (US, upstream) and 7 hours 20 minutes on 2 September (EU, provider network), both partial; 9 October to 4 November is unread, so the line keeps its recorded award (10). No request rate limits found. Plans publish concurrency caps of 5 GPUs and 500 containers on Hobby and 30 and 1,000 on Standard (5 of 15). No 429 or backoff guidance for callers found. Webhook forwarding retries failed deliveries and the docs ask for idempotent webhook receivers, partly met, kept (3 of 15). No SLA found. The 99.9 and 99.999 per cent uptime figures on the site are claims without terms (0). Endpoints, the CLI and the REST API are GA, while multi-region deployment and checkpointing are marked beta (10). Docs and status per the 8 October check, not re-read on 4 November. 20 + 10 + 5 + 3 + 0 + 10 = 48.

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Cerebrium 64

Closed service with published terms. The CLI is MIT (20). The docs say request and log data is deleted after 7 days on Hobby and 30 on Standard, that customer data is not used for training, and that a DPA is available on request. The privacy policy gives no retention periods, the pricing page shows both 1 day and 7 days of log retention for Hobby, and the docs still say SOC 2 Type I (15 of 30). No deprecation policy or dated notices found (0). Regions and some providers (AWS regions, Crusoe, Nebius) are named in the docs and status page, and Datadog, BugSnag and Stripe are named in passing, but no subprocessor list was found. The CLI's BugSnag error reporting is on by default and sends the user ID from the token and the project ID; cerebrium config telemetry disable, CEREBRIUM_TELEMETRY_DISABLED and, since 24 August, DO_NOT_TRACK turn it off. Its enable help says no personal data is sent, which the user ID contradicts; that is charged once, as the misleading-claim deduction, not on this line (10 of 20). Docs and policies per the 8 October check, not re-read on 4 November; terms re-read on 4 November. 20 + 15 + 0 + 10 = 45.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.