GPUsMarket vs Northflank

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Northflank 85

Graded on the hosted platform lines. Instatus page at status.northflank.com with per-component uptime and history (20). Five notices from 4 August to 2 November 2026. Workloads failed to start for some users across several regions for 1 hour on 5 August ("partial start up issues", labelled partial outage), addon expose was paused in US - Central for 2 hours 25 minutes on 4 September (maintenance), SSO through WorkOS was degraded for 46 minutes on 25 September, and on 20 October a GCP europe-west2 zone fault reached login and control plane components for part of 6 hours 50 minutes, with workloads unaffected and "the majority of users" unaffected. Each is partial, so minor. The 30 October "Security incident", still open on 2 November, marks the platform components as major outage but describes exposed secrets, not downtime, and the Northflank API component shows 100 per cent uptime for October, so it's scored as a negative event (20). 1,000 API requests an hour by default (15). A 429 past the limit, with x-ratelimit-remaining and x-ratelimit-reset on every response. No backoff or safe-retry guidance (10 of 15). The pricing page lists a 99.99 per cent uptime SLA and a custom SLA on Enterprise; no SLA document was found (10). Services, jobs and GPU workloads are GA (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Northflank 82

Personal tokens and team API tokens issued under API roles with granular permissions and project or cluster restrictions, and the API now documents rotating a key on an API token (30). API roles take per-action permissions and can be restricted to named projects or clusters. No confirmation step for destructive calls found (15). Runs your own containers and returns their output (10). Audit logs with filters since April 2025, enabled for every customer including free users on 31 October 2026 (15). The security page claims SOC 2 Type II, HIPAA and ISO 27001, names security@northflank.com and a trust centre, and says penetration tests are planned. No security.txt (404 on 2 November), disclosure policy, bug bounty or advisories found, and the same page says Northflank has never been breached while the 30 October incident is open. That is fireworks-inference's record (SOC 2 Type II and ISO 27001, a Vanta trust centre, no security.txt, disclosure policy or bounty), so level with it (12). The open incident and the no-breach sentence are counted under negative events, as trigger-dev's breach was, not on this line. 30 + 15 + 10 + 15 + 12 = 82.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Northflank 81

OpenAPI 3.0 at api.northflank.com/v1/swagger-json with well over 100 paths, plus an HTML view, per the 1 October check, not re-read on 2 November (25). llms.txt and a .md twin for every docs page (10). Operations carry short descriptions and the guides explain jobs against services; few say when not to use an endpoint (12). Enums throughout (token kind, scope, restriction mode) and bounded parameters such as per_page 1 to 100 (13). Examples in the guides; the spec documents 200 responses but not error schemas (6). Versioned /v1 and a dated changelog (15).

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Northflank 40

No machine payment protocol (0). Per-hour GPU, vCPU and memory prices published without a login (20). The free Sandbox plan says "No card needed", with 2 services, 2 jobs and 1 database, up to $20 a month of resources (20). Signup is a browser flow (0). 0 + 20 + 20 + 0 = 40.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Northflank 56

Closed service under UK law (15). Terms and privacy policy are both dated 1 March 2021, more than five years old, with no retention periods we could find (10). Both still read Effective Date 1 March 2021 on 2 November. No deprecation policy or dated notices found (0). Regions and bring-your-own-cloud are documented; no subprocessor list found (8).