Cloudflare AI Gateway vs Tencent Hy4

Cloudflare AI Gateway 74

Closed service under the Self-Serve Subscription Agreement and service-specific terms with a section for Workers AI and AI Gateway. Each model page links the provider's terms, ai-gateway-provider is MIT and the OpenAPI repository is BSD-3-Clause (16 of 30). The service terms, the logging and Zero Data Retention pages, the DPA (version 6.4, 3 April 2026) and the privacy policy of 4 November 2025 were read. The privacy policy gives retention criteria, not periods. The terms take third-party models outside the DPA, while the sub-processor list names five model providers for AI Gateway, and the two are hard to square (17 of 30). No deprecation policy was found. Deprecated endpoints carry notices with no dates, and section 8 of the agreement lets Cloudflare modify or discontinue a service without notice (6 of 20). The sub-processor list, last updated 1 October 2025, names Google, Anthropic, OpenAI, xAI and Groq for AI Gateway with locations. The catalogue on 9 October 2026 also carries models from Alibaba, ByteDance, MiniMax and others that the list does not name (12 of 20). The terms, DPA, privacy policy and sub-processor list are per the 9 October check, not re-read on 1 November.

Tencent Hy4 52

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. Closed service under the TokenHub terms, but Tencent's release headline calls Hy4 open source while the weights and system card are only promised 'in the coming days', with no licence stated, and tencent/Hy4 didn't answer on Hugging Face on 11 November (14 of 30). Terms and FAQ agree inputs aren't used for training; the privacy policy renders only with JavaScript and wasn't read (15 of 30). Dated retirement notices and shutdown fields (13 of 20). Processing generally in mainland China for the China site, Singapore for the international one (13 of 20). Every benchmark in the release is Tencent's own or a partner's. 14 + 15 + 13 + 13 = 55.

Cloudflare AI Gateway 66

Hosted reading. www.cloudflarestatus.com is a Statuspage with AI Gateway, Workers AI and API as separate components (20). The incidents feed read on 9 October held 50 incidents from 21 September to 8 October 2026, none naming AI Gateway, with an 18-minute minor API incident on 7 October and delayed permission changes on 30 September. On 1 November the host's history.atom held only scheduled maintenance for 2 to 6 November, and the history page loads by script. Whether the incidents posted from 16 to 31 October name AI Gateway wasn't read for this listing (cloudflare-r2, cloudflare-workers-ai and cloudflare-email-service read that list for their own components only), and 3 August to 20 September and 9 to 15 October went unread too. An unread window isn't credited, so the line rests on the 21 September to 8 October reading alone, as on 9 October (10 of 30). Unified Billing traffic is limited to 200 requests per 60 seconds per gateway, re-read on 1 November, the Cloudflare API to 1,200 requests per five minutes per token, and BYOK traffic has no gateway limit (15). Over-limit and over-budget requests return 429, the Cloudflare API returns retry-after and Ratelimit headers for its own limit, and retries with backoff and model fallbacks can be set per request or per gateway. No Retry-After was found for the gateway's own 429, and nothing separates a rate-limit 429 from a spend-limit 429 (11 of 15). No SLA naming AI Gateway was found. The Enterprise SLA lists service-specific SLAs for R2, Queues and Workers only (0). The core product carries no beta label, and Machine Payments is in beta (10). 20 + 10 + 15 + 11 + 0 + 10 = 66.

Tencent Hy4 46

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. No public status page (0) and so no incident record to read (5 of 30). Per-model rate limits only in the console and DescribeModelQuota (8 of 15). Six 429 codes, Retry-After and backoff advice (13 of 15). The TokenHub SLA promises 99.5% a month, and Hy4 is Tencent's own model, so the third-party exclusion doesn't apply (10). Released as hy4 on 4 November, a separate id from hy4-preview, with no preview label (10). 0 + 5 + 8 + 13 + 10 + 10 = 46.

Cloudflare AI Gateway 63

x402 is in beta on POST /ai/run since 30 September 2026 for four open models of 241 in the catalogue. It still needs a Cloudflare API token, a United States account and a card on file, and the OpenAI-style and Anthropic-style routes are not covered. We did not call it (12 of 40). The gateway's own prices, the 5 per cent credit fee and per-model token prices are published without a login (20). Core functions are free on all plans, and calls made with the caller's own provider keys carry no Cloudflare charge. We did not sign up to confirm that no card is asked for (20). A person creates the account and the first token in a browser, and the x402 route needs both (0). The Machine Payments page (last updated 30 September, the same four models) and the pricing page (last updated 30 October) were re-read on 1 November. 12 + 20 + 20 + 0 = 52. Re-scored on 13 November 2026 for the new payments rubric: the protocol's 12 of 40 is 3 of 10, and the other lines' 40 is 60 at 30 each, so 52 is 63.

Tencent Hy4 45

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. No machine payment protocol (0). The price page, updated 9 November, lists ¥6 input, ¥0.3 cached and ¥18 output per million tokens, with Hy4 billed at 50% until 31 December 2026 (20). TokenHub's campaign of 1M free tokens per language model, read on 1 November, isn't confirmed for hy4 on the price page, so half (10 of 20, a judgement call). A person signs up with real-name verification (0). 0 + 20 + 10 + 0 = 30. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 30 is 45.

Cloudflare AI Gateway 73

Router, read on the model lines (tool use, structured output, caching, context, batch, SDKs, errors). Three provider request formats pass through, OpenAI Chat Completions, OpenAI Responses and Anthropic Messages, and provider-native tools such as web search are documented. Tool behaviour depends on the routed model (15 of 20). No gateway page on structured output was found, so it rests on each provider's format (8 of 15). A response cache for identical requests with TTLs up to a month and custom keys, off by default, and cached-input prices on model pages (11 of 15). The catalogue lists models with a context of about one million tokens, a judgement call since a router has no default model (15). Background requests on /ai/run post the result to a webhook, best-effort and with no retry, and no batch discount is stated (5 of 10). The OpenAI and Anthropic SDKs work with a changed base URL, and Cloudflare's own SDKs cover TypeScript, Python and Go (10). Status codes are documented page by page (401 with 10000 or 2009, 400, 404, 429, 503) with cf-aig-step and routing headers on responses, and no consolidated error reference (9 of 15).

Tencent Hy4 86

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. Function calling is marked for hy4 in the model list (18 of 20). Structured output marked (13 of 15). Cache-hit price published, ¥0.3 against ¥6 input (14 of 15). 1M-token context with 960K input and 64K output (15). Batch at half price covered Hy3 and Hy4 preview on 1 November; whether it covers hy4 wasn't re-read (3 of 10). OpenAI and Anthropic SDKs with a changed base URL, plus Tencent Cloud's SDK and CLI for the control plane (8 of 10). Errors with code, messages, upstream status and request ID (15 of 15). 18 + 13 + 14 + 15 + 3 + 8 + 15 = 86.

Cloudflare AI Gateway 80

Router, read on the model lines. Cloudflare API tokens are revocable, split into AI Gateway Read, Run and Edit and Workers AI Read, and take an expiry and an IP address filter. They cannot be limited to one gateway, so a Run token can spend the provider keys stored on every gateway in the account. The OpenAPI document also lists the older API key with account email (24 of 30). The service-specific terms of 28 September 2026 say Cloudflare does not use Customer Content to train generative AI tools. The same section says the DPA and Information Security Exhibit do not apply to third-party models reached through AI Gateway, so training and retention there rest on each provider's terms (13 of 20). Prompts and responses are logged by default. Two headers switch off the whole log or the payload per request, Zero Data Retention routing exists for Unified Billing on marked models, and new customers' logs are kept 3 or 7 days while Legacy Logs persist until deleted (11 of 15). Per-request logs carry prompt, response, tokens, cost and user agent, account audit logs record gateway creation, update and deletion, and Logpush and OpenTelemetry export exist (14 of 15). security.txt, re-read on 1 November, names a HackerOne programme and a disclosure policy, with no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), ISO 27018 and ISO 27701, with a scope of the Cloudflare global cloud platform, which doesn't name AI Gateway. 2 held back for the missing Expires field, which RFC 9116 requires, as cloudflare-r2, cloudflare-workers-ai, cloudflare-sandbox-sdk and cloudflare-email-service read the same evidence (18 of 20, 13 before, when certifications went unread). Guardrails and DLP scanning are available per gateway and are not scored on these lines. 24 + 13 + 11 + 14 + 18 = 80.

Tencent Hy4 71

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. Bearer keys limited by model, service, IP range and token quota, long-lived with no rotation (26 of 30). The terms say inputs aren't used to train Tencent Cloud's own models, and Hy4 is first party, so no third party's terms apply (14 of 20). Retention only as long as the service needs, no periods (7 of 15). Per-call audit logs and optional full logs to the customer's CLS (14 of 15). No security.txt; Tencent's TSRC bounty covers Tencent Cloud; no certification checked (10 of 20). 26 + 14 + 7 + 14 + 10 = 71.