Hugging Face Inference Providers vs RouterPlus

Hugging Face Inference Providers 80

Model reading. huggingface_hub 2.4.0 tagged on 29 October 2026 and the Inference Providers docs updated daily by an automated job, last on 6 November (30). huggingface_hub 2.2.0, 2.3.0 and 2.4.0 and @huggingface/inference 4.13.28 to 4.13.32 in the 90 days (20). No dedicated changelog; the Hub has a forum and Discord, and GitHub issue replies were not read (8 of 15). Current official SDKs in Python and JavaScript (15). The Python client supports Python 3.10 and later, per the Inference Endpoints check; CI not read (7 of 10).

RouterPlus 44

Router, read on the model lines. No changelog or release notes found. The blog, re-read on 4 November 2026, dates the launch of ScaleDown's extract-1 and summarize-1 on chat completions and classify-1 on the decisions API to 13 October 2026, and the catalogue now lists 105 chat models against 19 on 13 October, so the API changed within the last 30 days (30). The docs also date a console change on 17 October 2026 (keys can be copied again), which isn't counted, since it changes the console and not the API. Models carry a deprecation_date that delists them automatically, with no notice period stated (3 of 12). POST /v1/signup and the magic-link route were removed and Optimize is paused, none with a date we could find (3 of 8). No public changelog. Support is reached through the console and an email address, and wasn't tested (3 of 15). No public issue tracker for the gateway (0 of 10). No official SDK. The docs rely on the OpenAI and Anthropic SDKs and give client setups (5 of 15). No package or public repository to check (0 of 10).

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).

RouterPlus 41

Closed service with no terms of service found. The only terms on the site govern the capacity request form, under EVO HQ Inc (0 of 30). The data policy page is detailed, lists what is stored and why, and gives a 30-day period for request logs and each provider's retention flag. Its 4 November 2026 text, which logs request content by default, no longer agrees with the homepage FAQ; that contradiction is charged once as a misleading claim under negative events, not on this line. There is no privacy policy, no DPA and no retention period for account data such as email addresses (14 of 30, held). Model retirement by deprecation_date is documented with no notice period, and no dated deprecation notices were found (4 of 20). The docs name Clerk, Resend and an AWS bucket, and say RouterPlus's own GPUs run in the United States. The form's terms name Supabase, Cloudflare and Resend. No complete subprocessor list or gateway hosting location was found (8 of 20).

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

RouterPlus 59

Router, read on the model lines. tm_vk_ keys are stored as SHA-256 hashes and revocable, each bound to a workspace and principal, with per-key RPM and monthly spend caps. Since 17 October 2026 the console also keeps an encrypted copy so an owner or admin can copy a key again, and an organisation can ask for copying to be turned off. Inference keys have no management rights. There are no permission scopes on a key and no SSO or SCIM (24 of 30). RouterPlus says it does not train on request logs and does not share them, and deletes them after 30 days. Most Claude and GPT routes are marked prompt_logging: retained with no ZDR, so retention and training upstream rest on each provider's API terms, while DeepInfra's open models, Perplexity, Cloudflare Workers AI, Fastino and RouterPlus's own models declare none (12 of 20, held). The data policy re-read on 4 November 2026 says requests and responses to non-dedicated endpoints are now logged by default for up to 30 days for debugging, with recognised keys removed. On 13 October it said content was kept only for hackathon accounts. Opting out takes a request to support, dedicated endpoints are excluded, and the zdr and data_collection: deny filters still remove every marketplace route, so they work only on the caller's own provider keys. Cloudflare AI Gateway, with default logging and a per-request header to switch it off, has 11 here (7 of 15, 10 before). GET /v1/generation lists every attempt behind a request with provider, tokens and cost, and the console has usage and logs (14 of 15). No security.txt (404 on both hosts on 4 November 2026), disclosure policy, bug bounty or certification found. The footer's Security link is an email to founders@evo-hq.com (2 of 20). 24 + 12 + 7 + 14 + 2 = 59.

Hugging Face Inference Providers 20

No x402, MPP or L402 (0). Per-token prices for every model and provider published without a login in the router's /v1/models and on model pages (20). No free tier since 7 October 2026, when free users lost their included monthly credits; PRO's $2.00 of credits needs a subscription (0). Sign-up, token creation and credit purchase are browser steps (0).

RouterPlus 40

No machine payment protocol found in llms-full.txt. Calls draw on a prepaid balance (0). Per-token prices for every model are public in the docs catalogue and on the model pages with no login, re-read on 4 November 2026 (20). Signup adds no free credit, but inference through the caller's own provider keys carries no RouterPlus charge and needs no credit, the reading Cloudflare AI Gateway's dossier took for the same arrangement. We did not sign up to confirm that no card is asked for (20). A person signs up in the browser through Clerk with email verification, and the programmatic signup route was removed (0).

Hugging Face Inference Providers 25

Hosted lines. status.huggingface.co is a Better Stack page with 90-day component history for the Hub, Inference Endpoints, Spaces, the CDNs and Jobs, but no component for Inference Providers or the router (10 of 20). With no component, there is no readable incident history for the surface agents call, and the feed's 23 items from 10 June to 7 October 2026 don't name it (5). No rate limits for the router were found; the Hub rate-limits page gives numbers for Hub APIs, resolvers and pages only (0). No 429 or overload guidance for the router was found (0). No SLA found (0). Chat completions on the router is generally available; the Responses API is labelled beta (10). Routing between providers with :fastest or :cheapest softens a single provider's outage, which this checklist doesn't score.

RouterPlus 42

Hosted reading. No status page found. Model pages show each provider's uptime over the last 24 hours and no incident history, and status.routerplus.com failed at our proxy again on 4 November 2026 (0). No readable incident history (5). The limits page, re-read on 4 November 2026, gives 20 requests a minute until the organisation's first purchase, then 300 per console key and 60 for the managed Playground key, with token-per-minute and in-flight limits per organisation and key (15). Rate-limit 429s carry retry-after from 1 to 59 seconds and metadata.retry_at, the errors page gives a retry or no-retry rule for each error class, and the docs say a retry is a new billed request because there is no idempotency key. That is safe-retry guidance without keys on the billed call, the value this run settled for routers such as ramp-router (12, 15 before). The homepage says "Production-grade SLAs", but no SLA terms were found, and the only terms on the site say a stated response time is not a service level (0). The chat and messages surfaces carry no beta label. The Responses API is a preview for non-OpenAI models and Optimize is paused, neither of which is the main surface (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

RouterPlus 71

Router, read on the model lines (tool use, structured output, caching, context, batch, SDKs, errors). Tools pass through on both surfaces, and Anthropic server tools such as web search work for Claude models on /v1/messages. Behaviour depends on the model (15 of 20). response_format works for GPT ids and the open models (re-read on 4 November 2026), and the docs tell callers to get JSON from Claude through a single tool, so structured output still rests on the provider (8 of 15, held). Cached-input and cache-write prices per model, a session id that keeps provider caches warm, and cache_control on the Anthropic surface (13 of 15). The catalogue's largest contexts are 1,050,000 tokens on GPT-6.1 Sol and 1,000,000 on Claude Sonnet 5.5, a judgement call since a router has no default model (15). No batch route (0 of 10). No SDK of its own. The OpenAI and Anthropic SDKs work with a changed base URL, and the docs give setups for ten coding tools (5 of 10). A stable error_type in every body and header, an origin header, the limit that refused a request, and x-tm-dropped-params naming every dropped field (15).