DeepSeek API vs Hugging Face Inference Providers

DeepSeek API 35

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Model reading. One Bearer key per balance, no scoping found (20 of 30). The privacy policy, last updated 10 February 2026, says personal data is used to train models, with an opt-out by email to privacy@deepseek.com (0 of 20). Data kept for as long as needed to provide the services, with no period stated and no zero-retention route (5 of 15). Per-call logs or audit logs not found (5 of 15). Security programme 5 of 20 (was 0). The www.deepseek.com footer carries a Report Security Issue address, security@deepseek.com, per the 21 October reading used for DeepSeek's open-weight listings and its Search and Fetch API listing. No security.txt (404 on 17 October), disclosure policy, certification or bug bounty found. 20 + 0 + 5 + 5 + 5 = 35.

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

DeepSeek API 60

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Status page at status.deepseek.com, run on Flashduty, with per-API components and a readable feed (20). The recorded feed lists 36 incidents from 22 July to 15 October. Four touch only web search, 27 are degraded performance, and five are partial unavailability, one of them (12 October) the web chat only. Of the four that hit the API, 28 July (7 minutes) has left the 90-day window and 2 September lasted 31 minutes. 14 September (18:30 to 21:30 UTC) left the V4.1 Flash API and chat partly unavailable for three hours, and 15 October (00:11 to 05:04 UTC) left the V4 Pro and V4.1 Flash APIs and chat partly unavailable for 4 hours 52 minutes. Two majors in 90 days sit between one (10) and several (0), so 5. 16 October to 5 November is unread and earns nothing beyond the recorded award (5). Concurrency caps published per account, 2,500 on Flash and 500 on V4 Pro, and requests that haven't started inference after 10 minutes are closed (15). The rate-limit and error pages document 429, and advise a brief wait and retry on 500 and 503, with no Retry-After header, backoff schedule or statement that a retried call is safe (10 of 15). No SLA found (0). V4 Pro and V4.1 Flash are GA (10). 20 + 5 + 15 + 10 + 0 + 10 = 60.

Hugging Face Inference Providers 25

Hosted lines. status.huggingface.co is a Better Stack page with 90-day component history for the Hub, Inference Endpoints, Spaces, the CDNs and Jobs, but no component for Inference Providers or the router (10 of 20). With no component, there is no readable incident history for the surface agents call, and the feed's 23 items from 10 June to 7 October 2026 don't name it (5). No rate limits for the router were found; the Hub rate-limits page gives numbers for Hub APIs, resolvers and pages only (0). No 429 or overload guidance for the router was found (0). No SLA found (0). Chat completions on the router is generally available; the Responses API is labelled beta (10). Routing between providers with :fastest or :cheapest softens a single provider's outage, which this checklist doesn't score.

DeepSeek API 46

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Model reading. V4.1 Flash was upgraded to DeepSeek-V4.1-Flash-1017 on 17 October under the same deepseek-flash name and price, posted on the updates page the same day, 19 days before this check (30). Later updates entries are unread. No stated notice policy. deepseek-chat and deepseek-reasoner got three months, announced on 24 April for 24 July. One dated notice with no stated period partly meets the line, and the earlier partial award is held (4 of 12). Model churn covers the V4 Flash retirement on 10 September and the V4 Pro shutdown set for 14 September, announced on 13 August and withdrawn on 10 September. The 24 July shutdown has left the 90-day window. A retirement and a withdrawn shutdown inside it keep churn at the bottom of its range (0 of 8). Dated updates page, and the docs list api-service@deepseek.com and a Discord server for support. We didn't test whether either answers (12 of 15). No official SDKs or SDK repository (0 of 15, 0 of 10). 30 + 4 + 0 + 12 + 0 + 0 = 46.

Hugging Face Inference Providers 80

Model reading. huggingface_hub 2.4.0 tagged on 29 October 2026 and the Inference Providers docs updated daily by an automated job, last on 6 November (30). huggingface_hub 2.2.0, 2.3.0 and 2.4.0 and @huggingface/inference 4.13.28 to 4.13.32 in the 90 days (20). No dedicated changelog; the Hub has a forum and Discord, and GitHub issue replies were not read (8 of 15). Current official SDKs in Python and JavaScript (15). The Python client supports Python 3.10 and later, per the Inference Endpoints check; CI not read (7 of 10).

DeepSeek API 49

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). No OpenAPI document and no llms.txt found (0 and 0). API reference covers both the OpenAI and Anthropic formats. The chat completion reference, read on 2 October, describes each parameter with its range and default, such as max_tokens from 1 to 393,216 with 8K by default without thinking, but says little on when not to use one (14 of 20). Strict tool calls are documented, in beta at the /beta base URL, with a JSON Schema subset (object, string, number, integer, boolean, array, enum, anyOf, $ref) where every property must be required. JSON output mode carries no schema guarantee (10 of 15). The error codes page lists seven codes, each with a cause and a fix, but no example bodies (10 of 15). Dated updates page that names model changes (15). 0 + 0 + 14 + 10 + 10 + 15 = 49.

Hugging Face Inference Providers 62

No OpenAPI document for the router (openapi.json paths answer 404). The task reference pages are generated from typed JSON Schema specs in huggingface.js, and the router's /v1/models gives a machine-readable catalogue, so 12 of 25. llms.txt for the Inference Providers docs and a Markdown twin of every page via .md (10). Guides say what each task and policy is for, with a quick setup page for coding agents (14 of 20). Parameter tables with types for chat completion, though response_format and tool_choice show as unknown types (9 of 15). Examples in Python, JavaScript and curl on every task page, but no documented error responses for the router (9 of 15). No changelog of its own; the Hub changelog doesn't cover it and dated changes are only in the hub-docs history (8 of 15).

DeepSeek API 70

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calls through both request formats, and the API reference documents tool_choice as none, auto, required or a named function (20 of 20). Strict schema-enforced tool calls in beta, JSON output without a schema guarantee (10 of 15). Disk cache on by default with cheaper hits, per the listing (15). 1M-token context and up to 384K output (15). No batch API documented (0). No official SDKs, you use the OpenAI or Anthropic client (0). Seven error codes with a fix for each, 402 for an empty balance (10 of 15). 20 + 10 + 15 + 15 + 0 + 0 + 10 = 70.

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

DeepSeek API 65

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Closed service with clear terms under PRC law. The model weights are published, which doesn't change the hosted service (15). The privacy policy of 10 February 2026 is consistent on training by default and storage in the PRC, but publishes no retention period and no DPA (10 of 30). Dated notices on the updates page, undercut by a shutdown announced and withdrawn within a month and a reroute with no prior entry (10 of 20). Data location disclosed as the PRC, third parties named only by category (10 of 20). 15 + 10 + 10 + 10 = 45.

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).