Hugging Face Inference Providers vs StepFun API

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

StepFun API 41

Model reading. Bearer API keys, revocable by deletion. Organisations can create one key per project, billed to a project's credit with a per-member cap. No scopes or read-only keys found (20 of 30). Training on API data is not off by default in plain words. The privacy policy (effective 7 August 2026) says StepFun may use and retain data to improve its models, including training and fine-tuning where law and program terms permit, and the terms name early-access programmes as one such case. No opt-out found (5 of 20). No retention period for prompts and outputs and no zero-retention option. IP addresses are kept three years (3 of 15). The console's usage details list each billed call by key, model and date, with export (8 of 15). No security.txt, bug bounty or certification found. A DPA with breach notification exists (5 of 20).

Hugging Face Inference Providers 80

Model reading. huggingface_hub 2.4.0 tagged on 29 October 2026 and the Inference Providers docs updated daily by an automated job, last on 6 November (30). huggingface_hub 2.2.0, 2.3.0 and 2.4.0 and @huggingface/inference 4.13.28 to 4.13.32 in the 90 days (20). No dedicated changelog; the Hub has a forum and Discord, and GitHub issue replies were not read (8 of 15). Current official SDKs in Python and JavaScript (15). The Python client supports Python 3.10 and later, per the Inference Endpoints check; CI not read (7 of 10).

StepFun API 50

Model reading. The image models step-2x-large and step-image-edit-2 were retired on 10 October 2026, and a Step 5 Preview price change is announced for 14 October (30). No stated notice period. The 10 October image retirement had a dated notice page and the July retirements a migration table, but we couldn't date when either notice went up (4 of 12). One retirement date in the last 90 days, 10 October, with nine models retired on 8 July just outside that window (6 of 8). Dated announcements, a Discord server and platform@stepfun.com for support. We didn't test whether either answers (10 of 15). No official SDK (0 of 15, 0 of 10).

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).

StepFun API 57

Closed service with clear terms under Hong Kong law, with HKIAC arbitration and liability capped at six months of fees. Some earlier Step models have open weights, which doesn't change the hosted service (15). The privacy policy, terms and DPA agree that data may be used for training under program terms, but the terms' licence to Content is broad and perpetual, no retention period is given for prompts and outputs, and no subprocessor list was found (12 of 30). A model lifecycle page with dated retirements and replacements (14 of 20). Servers are disclosed as in the United States. The DPA gives general authorisation for subprocessors without a published list (10 of 20).

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

StepFun API 68

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calls through Chat Completions, Responses and Messages, with no documented way to force or forbid a call (15 of 20). Strict JSON Schema output on Step 5 Preview (13 of 15). Prompt caching with a published cache-hit price at a tenth of the miss price (15). 1M-token context and 64k output (15). No batch endpoint found (0). No official SDK. The docs use the OpenAI and Anthropic clients against compatible endpoints (0). Eight error codes with a fix each, plus finish_reason handling for length, content filter and tool calls (10 of 15).

Hugging Face Inference Providers 62

No OpenAPI document for the router (openapi.json paths answer 404). The task reference pages are generated from typed JSON Schema specs in huggingface.js, and the router's /v1/models gives a machine-readable catalogue, so 12 of 25. llms.txt for the Inference Providers docs and a Markdown twin of every page via .md (10). Guides say what each task and policy is for, with a quick setup page for coding agents (14 of 20). Parameter tables with types for chat completion, though response_format and tool_choice show as unknown types (9 of 15). Examples in Python, JavaScript and curl on every task page, but no documented error responses for the router (9 of 15). No changelog of its own; the Hub changelog doesn't cover it and dated changes are only in the hub-docs history (8 of 15).

StepFun API 53

No OpenAPI or similar machine-readable contract found. The API reference is Markdown pages (0). llms.txt at platform.stepfun.ai/docs/llms.txt, and every page has a Markdown copy (10). The Chat Completions reference describes each parameter with its default, and the model page lists what Step 5 Preview supports, but little on when not to use an option (12 of 20). Tool definitions take JSON Schema parameters, structured output takes a JSON Schema with strict: true, and reasoning_effort is an enum of low, medium and high. No tool_choice parameter is documented (11 of 15). Worked requests and responses on each page, and an error table of eight codes with causes and fixes, but no error bodies (12 of 15). No API changelog. A model lifecycle page with dated retirements and announcement pages (8 of 15).