Hugging Face Inference Providers vs Beam 1.0

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

Beam 1.0 45

Model reading. API keys per project, revocable, shown once and disabled when their creator leaves, with no scopes, expiry or rotation API found (20 of 30). Training 10 of 20, partial kept. The API reference says each response's reflection-data-retention header reports contributor when content may be used to train Reflection's models "under contributor terms your organization accepted". The API safety page and commercial terms read on 17 October are struck (reflection.ai now disallows our crawler), so whether training is off by default can't be read. Retention 5 of 15, partial kept. The header can report zero, standard or contributor, and no readable page states periods or whether zero retention is offered. x-request-id on every response and the retention header, with usage dashboards behind the login and not read (5 of 15). Security programme 5 of 20 (was 6). The model card names reports@reflection.ai for security vulnerabilities; developers.reflection.ai has no security.txt (404 on 17 October), and the safety report and reflection.ai's security.txt can't be read. No bug bounty, SOC 2 or ISO 27001 found on a readable page. 20 + 10 + 5 + 5 + 5 = 45.

Hugging Face Inference Providers 80

Model reading. huggingface_hub 2.4.0 tagged on 29 October 2026 and the Inference Providers docs updated daily by an automated job, last on 6 November (30). huggingface_hub 2.2.0, 2.3.0 and 2.4.0 and @huggingface/inference 4.13.28 to 4.13.32 in the 90 days (20). No dedicated changelog; the Hub has a forum and Discord, and GitHub issue replies were not read (8 of 15). Current official SDKs in Python and JavaScript (15). The Python client supports Python 3.10 and later, per the Inference Endpoints check; CI not read (7 of 10).

Beam 1.0 50

Model reading. The weights were published on 16 October 2026, the date on the Hugging Face model page (the repository was created on 7 October); later commits to 30 October add evaluation results and a guide, which record no model change (30). One model, with a shutdown_date field and a lifecycle section in the docs but no notice period for retirements, and no history of releases or retirements yet (4 of 20). No changelog. Support through the platform and developers@reflection.ai for higher limits, and the model card names reports@reflection.ai. The Hub page shows 15 discussions (10 open, 5 closed), replies not sampled (6 of 25). No first-party SDK, the docs rely on the OpenAI SDKs (5 of 15). Reflection's serving guides for vLLM, SGLang, TokenSpeed, Transformers and Dynamo, a Beam Verifier repository, and fine-tuning recipes now published for NeMo AutoModel, Megatron Bridge, Axolotl and TRL (5 of 10, partial kept). 30 + 4 + 6 + 5 + 5 = 50.

Hugging Face Inference Providers 25

Hosted lines. status.huggingface.co is a Better Stack page with 90-day component history for the Hub, Inference Endpoints, Spaces, the CDNs and Jobs, but no component for Inference Providers or the router (10 of 20). With no component, there is no readable incident history for the surface agents call, and the feed's 23 items from 10 June to 7 October 2026 don't name it (5). No rate limits for the router were found; the Hub rate-limits page gives numbers for Hub APIs, resolvers and pages only (0). No 429 or overload guidance for the router was found (0). No SLA found (0). Chat completions on the router is generally available; the Responses API is labelled beta (10). Routing between providers with :fastest or :cheapest softens a single provider's outage, which this checklist doesn't score.

Beam 1.0 52

Hosted lines, for the Reflection API. Status page at status.reflection.ai on incident.io, with API, platform and developer docs components and Atom and RSS feeds (20). In the 90 days to 4 November 2026 its incident pages list two full outages of the API component, a serving cluster down from 22:01 to 23:20 UTC on 14 October and elevated errors from 06:10 to 07:10 UTC on 15 October, each an hour or more, so two majors. Three more are labelled partial outages (16 October 02:28 to 02:38 UTC, 22 October rate-limit errors in two windows, 3 November about 20:10 to 21:38 UTC on one inference provider), read as minor. Two majors give 5. Rate limits are described per organisation in requests and tokens per minute and per day, with concurrency caps and headers, but no figures are published (5 of 15). 429 and 503 responses carry Retry-After, daily limits add x-should-retry: false, and the errors page says which codes to retry, with exponential backoff and jitter. There are no idempotency keys, and a chat completion is the billed call, so this run's value for retry guidance without idempotency keys gives 12 (was 15). No SLA found (0). The developers docs read on 4 November carry no beta or preview label for the API; the earlier beta reading came from reflection.ai pages now struck (10). 20 + 5 + 5 + 12 + 0 + 10 = 52.

Hugging Face Inference Providers 62

No OpenAPI document for the router (openapi.json paths answer 404). The task reference pages are generated from typed JSON Schema specs in huggingface.js, and the router's /v1/models gives a machine-readable catalogue, so 12 of 25. llms.txt for the Inference Providers docs and a Markdown twin of every page via .md (10). Guides say what each task and policy is for, with a quick setup page for coding agents (14 of 20). Parameter tables with types for chat completion, though response_format and tool_choice show as unknown types (9 of 15). Examples in Python, JavaScript and curl on every task page, but no documented error responses for the router (9 of 15). No changelog of its own; the Hub changelog doesn't cover it and dated changes are only in the hub-docs history (8 of 15).

Beam 1.0 84

Model reading. OpenAPI 3.0.3 document, version 0.1.0, covering all three documented endpoints with typed schemas and error examples. A second 'Reflection client' base URL, https://api.reflection.ai/v1, is named with no endpoints documented (22 of 25). llms.txt, a Markdown copy of every page and a docs MCP endpoint (10). The guides say which reasoning effort suits which task, which OpenAI parameters are fixed, ignored or unsupported and which endpoints don't exist, so a model knows what not to send (17 of 20). reasoning_effort is an enum, strict JSON Schema for tools and json_schema output with the unsupported keywords and size limits listed, and unknown parameters return unsupported_parameter (15). curl, Python and TypeScript examples on every guide, and an error reference with every status, error.code and retry advice (15). The model ID carries its version and the models endpoint has a shutdown_date field, but no changelog or release notes were found (5 of 15). 22 + 10 + 17 + 15 + 15 + 5 = 84. The OpenAPI file is linked from llms.txt; the guides beyond the overview, models, rate limits, authentication and reference overview pages are per the 17 October check.

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).

Beam 1.0 57

Weights under Apache-2.0, an OSI licence, per the model card, which says the licence doesn't restrict distillation or training on outputs. The hosted API is a closed service whose commercial terms are on reflection.ai and can no longer be read (25 of 30, kept). Data handling 10 of 30, partial kept. What remains readable is the API reference's retention header (zero, standard, contributor) and the rate-limits page's request for data retention requirements; the terms, privacy policy, API safety page and zero-retention page are struck. Deprecation 4 of 20 (was 6). A shutdown_date field and a lifecycle section that says to move off a model before that date, with no notice period or dated notice; the fee-increase notice came from the struck terms. Subprocessors 0 of 20 (was 18). The list read on 17 October is on reflection.ai and struck, and no readable page names subprocessors or data locations. 25 + 10 + 4 + 0 = 39.

Hugging Face Inference Providers 20

No x402, MPP or L402 (0). Per-token prices for every model and provider published without a login in the router's /v1/models and on model pages (20). No free tier since 7 October 2026, when free users lost their included monthly credits; PRO's $2.00 of credits needs a subscription (0). Sign-up, token creation and credit purchase are browser steps (0).

Beam 1.0 10

Graded on the Reflection API. No x402, MPP or L402 (0). No per-token, plan or allocation price is published on any readable page; the beta pricing page on reflection.ai is struck (0, was 10). Free tier 10 of 20, partial kept. The rate-limits page describes a daily token allowance and asks those requesting higher limits whether they are "interested in paid usage", and the authentication page says some organisations must verify a credit card before keys work. A person signs up in the browser at platform.reflection.ai to get a key (0). 0 + 0 + 10 + 0 = 10.