Muse Ember vs RouterPlus

Muse Ember 20

Published rubric. No payment protocol (0). Per-token prices for both tiers published without a login, read 9 November (20). No free API allowance found; billing needs a card, per the platform reading (0). Browser sign-up (0). 0 + 20 + 0 + 0 = 20.

RouterPlus 40

No machine payment protocol found in llms-full.txt. Calls draw on a prepaid balance (0). Per-token prices for every model are public in the docs catalogue and on the model pages with no login, re-read on 4 November 2026 (20). Signup adds no free credit, but inference through the caller's own provider keys carries no RouterPlus charge and needs no credit, the reading Cloudflare AI Gateway's dossier took for the same arrangement. We did not sign up to confirm that no card is asked for (20). A person signs up in the browser through Clerk with email verification, and the programmatic signup route was removed (0).

Muse Ember 53

Editorial half. Closed model under the Model API terms, with clear terms and law; no weights and no parameter count, unlike Muse Spark Open and Muse Glimmer (15). Standard content isn't used for training, retention periods not stated outside zero retention (18 of 30). No deprecation policy or dated notices (0). A subprocessor list linked but not read, no data locations (8 of 20). 15 + 18 + 0 + 8 = 41.

RouterPlus 41

Closed service with no terms of service found. The only terms on the site govern the capacity request form, under EVO HQ Inc (0 of 30). The data policy page is detailed, lists what is stored and why, and gives a 30-day period for request logs and each provider's retention flag. Its 4 November 2026 text, which logs request content by default, no longer agrees with the homepage FAQ; that contradiction is charged once as a misleading claim under negative events, not on this line. There is no privacy policy, no DPA and no retention period for account data such as email addresses (14 of 30, held). Model retirement by deprecation_date is documented with no notice period, and no dated deprecation notices were found (4 of 20). The docs name Clerk, Resend and an AWS bucket, and say RouterPlus's own GPUs run in the United States. The form's terms name Supabase, Cloudflare and Resend. No complete subprocessor list or gateway hosting location was found (8 of 20).

Muse Ember 64

Platform readings are the meta-model-api listing's of 4 November. Team keys, named, revocable, no scopes (20 of 30). Standard mode only, so content isn't used to train Meta models under the terms, with safety use reserved (17 of 20). Retention 'as needed' with zero retention through sales (10 of 15). Usage dashboard by model, no per-call log (5 of 15). No security.txt on dev.meta.ai, a bug bounty and a security commitments page, no named certification (12 of 20). 20 + 17 + 10 + 5 + 12 = 64.

RouterPlus 59

Router, read on the model lines. tm_vk_ keys are stored as SHA-256 hashes and revocable, each bound to a workspace and principal, with per-key RPM and monthly spend caps. Since 17 October 2026 the console also keeps an encrypted copy so an owner or admin can copy a key again, and an organisation can ask for copying to be turned off. Inference keys have no management rights. There are no permission scopes on a key and no SSO or SCIM (24 of 30). RouterPlus says it does not train on request logs and does not share them, and deletes them after 30 days. Most Claude and GPT routes are marked prompt_logging: retained with no ZDR, so retention and training upstream rest on each provider's API terms, while DeepInfra's open models, Perplexity, Cloudflare Workers AI, Fastino and RouterPlus's own models declare none (12 of 20, held). The data policy re-read on 4 November 2026 says requests and responses to non-dedicated endpoints are now logged by default for up to 30 days for debugging, with recognised keys removed. On 13 October it said content was kept only for hackathon accounts. Opting out takes a request to support, dedicated endpoints are excluded, and the zdr and data_collection: deny filters still remove every marketplace route, so they work only on the caller's own provider keys. Cloudflare AI Gateway, with default logging and a per-request header to switch it off, has 11 here (7 of 15, 10 before). GET /v1/generation lists every attempt behind a request with provider, tokens and cost, and the console has usage and logs (14 of 15). No security.txt (404 on both hosts on 4 November 2026), disclosure policy, bug bounty or certification found. The footer's Security link is an email to founders@evo-hq.com (2 of 20). 24 + 12 + 7 + 14 + 2 = 59.