Cloud Run GPUs vs Runpod

Cloud Run GPUs 84

Closed service under the Google Cloud terms, with Apache-2.0 client libraries (15). The Cloud Data Processing Addendum and the privacy notice cover customer data, per the Document AI listing's 1 November reading; no Cloud Run statement on GPU instance data after shutdown was found (22). The Cloud terms promise 12 months' notice before a backwards-incompatible API change, and driver versions are announced in the release notes (16). Regions per GPU type listed, with Google's subprocessor list and data-location terms (16). 15+22+16+16 = 69.

Runpod 64

Per the 1 October check, not re-read on 4 November (terms bar automated access to runpod.io). Closed service under Delaware terms; the Python SDK is MIT (20). Sync results are kept 1 minute and async 30 minutes, and the docs claim GDPR compliance for EU regions, but no retention periods for pod disks or volumes after deletion and the DPA sits behind trust-centre access (15). Dated notices, REST v1 retiring on 15 November 2026 (announced 18 August) and GraphQL in early 2027; one model endpoint got two weeks' notice (15). 31 regions named with data-centre codes; subprocessor list not found (10).

Cloud Run GPUs 70

Hosted reading. Google Cloud's status page with a JSON incident feed (20). In the 90 days from 8 August 2026 the feed names Cloud Run in three multi-product incidents, a service outage on 20 August (15:40 to 19:20 UTC, 27 products, global and us-west1), a network degradation in us-central1-b on 1 September and a europe-west2 disruption on 20 October. One major (10). Resource limits and GPU quota are published with numbers (3 GPUs a region by default), but no request rate for the Admin API was found on the quotas page (10). Google's client libraries retry with backoff and the Admin API takes etags, while no GPU-specific retry guidance was found (10). An SLA for GPU services, 99.95% with zonal redundancy and 99.5% without (10). GPU services generally available since 7 April 2025 (10). 20+10+10+10+10+10 = 70.

Runpod 57

Better Stack page at uptime.runpod.io with per-service and per-region history, per the 1 October check, not re-read on 4 November (Runpod's terms bar automated access to runpod.io and its subdomains) (20). Incident line kept at 0. The 1 October reading counted several majors, among them US-IL-1 without power for 6 hours 10 minutes on 14 and 15 August and serverless API errors for 1 hour 25 minutes on 6 September. The window since 1 October is unread, so the recorded award stands (0). The REST v2 OpenAPI file, in the copy Runpod keeps in its MCP repository (synced with production on 27 October), says limits are per user across every /v2 route, with minute, hour and day windows, and gives "minute";q=180;w=60, "hour";q=3600;w=3600, "day";q=43200;w=86400 as the policy header (15). The same file documents 429 with Retry-After and RateLimit headers, and the Python SDK's error guide (2.1.0, 3 November) honours Retry-After, backs off with jitter and does not retry other errors because a failed response can follow a successful mutation. Safe-retry guidance with no idempotency keys (12). No SLA found (0). Serverless and REST v2 are GA; batch jobs are beta (10). 20 + 0 + 15 + 12 + 0 + 10 = 57.

Cloud Run GPUs 78

OAuth 2.0 tokens from service accounts under IAM. Google's APIs accept access_token as a query parameter, the 10-point deduction other Google API listings take (20). IAM roles separate viewing, deploying and invoking, and services can require IAM authentication for every call (16). The platform runs your own container and returns its output (10). Cloud Audit Logs record Admin API calls, and request logs go to Cloud Logging (15). Google's vulnerability reward programme, security.txt and certifications (17). 20+16+10+15+17 = 78.

Runpod 67

API keys can be All, Read Only or Restricted per serverless endpoint, and can be disabled or deleted; the hosted MCP signs in with OAuth. The GraphQL docs still show the key as ?api_key= in the URL per 1 October, which costs 10 (20). Read-only keys and per-endpoint restrictions, and the REST v2 file names a read or write scope for each operation; no confirmation for destructive calls found (15). Runs your own containers and returns their output (10). REST v2 now lists GET /v2/audit-logs (scope audit:read), an account or organisation audit trail of who acted on which resource, with filters and a retention window; no per-call API request log (12). security.txt valid until 31 January 2027, and the trust centre lists SOC 2 Type 2, SOC 3, ISO 27001 and HIPAA, per 1 October; no bug bounty, and osv.dev lists no advisory for runpod (10). 20 + 15 + 10 + 12 + 10 = 67.