Cloud Run GPUs vs Hugging Face Inference Endpoints

Cloud Run GPUs 84

Closed service under the Google Cloud terms, with Apache-2.0 client libraries (15). The Cloud Data Processing Addendum and the privacy notice cover customer data, per the Document AI listing's 1 November reading; no Cloud Run statement on GPU instance data after shutdown was found (22). The Cloud terms promise 12 months' notice before a backwards-incompatible API change, and driver versions are announced in the release notes (16). Regions per GPU type listed, with Google's subprocessor list and data-location terms (16). 15+22+16+16 = 69.

Hugging Face Inference Endpoints 70

Closed service under clear terms that name Inference Endpoints, with an Apache-2.0 client (20). The security page says payloads and tokens aren't stored and logs are kept 30 days. The privacy policy dates from 28 March 2023 and gives retention as long as necessary, and a data processing agreement requires an Enterprise subscription (20). Instance deprecations are dated to the month in the pricing table and flagged in the provider API, and the TGI maintenance notice is dated. No deprecation policy for the API was found (10). The privacy policy lists 11 subprocessors with countries and the docs and API list deployment regions (18).

Cloud Run GPUs 81

API reading. A public Discovery document for the Cloud Run Admin API v2 (25). No llms.txt; Google's docs answer Markdown only at an unlinked .md.txt address, read as half, as for the Document AI listing (5). The GPU page says when to turn zonal redundancy on or off and the best-practices page when to bake models into images or load them from Cloud Storage (16). The GPU type is a free string in a node selector, with CPU and memory minimums stated in prose (9). gcloud, YAML, Terraform and console steps on each page, and errors follow Google's status model with no Cloud Run GPU error list (11). Versioned API (v1 and v2) and dated release notes (15). 25+5+16+9+11+15 = 81.

Hugging Face Inference Endpoints 73

Public OpenAPI 3.1 documents for the management API (42 paths, 48 operations on 2 November 2026) and the catalogue API (3 operations, per the 8 October check) (25). llms.txt with a Markdown twin of every docs page (10). Every operation has a summary tagged READ, WRITE, PUBLIC or PRO, but only 7 of 48 have a description. The MCP tool table states each tool's purpose and says to call get_recommended_config before create_endpoint (11). 131 typed schemas with required fields and enums for state, type and accelerator. List filters are comma-separated strings (12). Parameters carry examples. The management document lists only 200 responses on 45 of 48 operations, plus 501 on three log routes, while the catalogue document lists 400, 401, 404, 409 and 500 (7). Paths are versioned /v2 and /v3 and the document is version 2.0.0. Inference Endpoints has no changelog of its own. The Hub changelog and the docs repository history are the dated record (8).

Cloud Run GPUs 78

OAuth 2.0 tokens from service accounts under IAM. Google's APIs accept access_token as a query parameter, the 10-point deduction other Google API listings take (20). IAM roles separate viewing, deploying and invoking, and services can require IAM authentication for every call (16). The platform runs your own container and returns its output (10). Cloud Audit Logs record Admin API calls, and request logs go to Cloud Logging (15). Google's vulnerability reward programme, security.txt and certifications (17). 20+16+10+15+17 = 78.

Hugging Face Inference Endpoints 83

OAuth through huggingface.co with read-endpoints and write-endpoints scopes, PKCE and dynamic client registration for the MCP server, and revocable fine-grained access tokens for the API. No documented option to send a token in a URL (30). Read and write scopes are separate, endpoints are private by default, organisations on Team and Enterprise plans can require approval of fine-grained tokens, and the MCP delete tool needs confirm: true. Other write calls have no confirmation step (17). The service returns the output and logs of the owner's own model, not third-party content (10). An audit log route and MCP tool on Pro, Team or Enterprise plans, plus logs and metrics for every endpoint (12). security.txt valid to 2030 with security@huggingface.co, SOC2 Type 2 stated for the Hub and Inference Endpoints, malware and pickle scanning of repositories. No bug bounty was found (14).