Northflank vs Together GPU Clusters

Northflank 85

Graded on the hosted platform lines. Instatus page at status.northflank.com with per-component uptime and history (20). Five notices from 4 August to 2 November 2026. Workloads failed to start for some users across several regions for 1 hour on 5 August ("partial start up issues", labelled partial outage), addon expose was paused in US - Central for 2 hours 25 minutes on 4 September (maintenance), SSO through WorkOS was degraded for 46 minutes on 25 September, and on 20 October a GCP europe-west2 zone fault reached login and control plane components for part of 6 hours 50 minutes, with workloads unaffected and "the majority of users" unaffected. Each is partial, so minor. The 30 October "Security incident", still open on 2 November, marks the platform components as major outage but describes exposed secrets, not downtime, and the Northflank API component shows 100 per cent uptime for October, so it's scored as a negative event (20). 1,000 API requests an hour by default (15). A 429 past the limit, with x-ratelimit-remaining and x-ratelimit-reset on every response. No backoff or safe-retry guidance (10 of 15). The pricing page lists a 99.99 per cent uptime SLA and a custom SLA on Enterprise; no SLA document was found (10). Services, jobs and GPU workloads are GA (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

Together GPU Clusters 38

Read with the hosted lines. status.together.ai lists the website, the playground and serverless models with no component for GPU clusters, and a vendor page with no component for the product takes 15 in this run, as for Together's Code Sandbox and fine-tuning listings (15). No incident history for clusters can be read (5). No rate limits for the clusters API found (0). Together's docs give 429 and 503 backoff guidance for its APIs, per the inference listing's 1 November check, and the CLI has --non-interactive and --json for scripted retries, but creation has no idempotency key (8). No SLA for clusters found; the published 99% commitment covers provisioned inference throughput only (0). Generally available since 9 September 2025 and out of the CLI's beta paths since 22 October 2026, with preemptible nodes in preview (10). 15+5+0+8+0+10 = 38.

Northflank 40

No machine payment protocol (0). Per-hour GPU, vCPU and memory prices published without a login (20). The free Sandbox plan says "No card needed", with 2 services, 2 jobs and 1 database, up to $20 a month of resources (20). Signup is a browser flow (0). 0 + 20 + 20 + 0 = 40.

Together GPU Clusters 20

No machine payment protocol (0). Per GPU-hour prices for each capacity type and per GiB-month storage published without a login (20). No free trial, and creation needs credit for the full reservation or a minimum on-demand period (0). Sign-up and credit purchase are browser steps (0). 0+20+0+0 = 20.

Northflank 82

Personal tokens and team API tokens issued under API roles with granular permissions and project or cluster restrictions, and the API now documents rotating a key on an API token (30). API roles take per-action permissions and can be restricted to named projects or clusters. No confirmation step for destructive calls found (15). Runs your own containers and returns their output (10). Audit logs with filters since April 2025, enabled for every customer including free users on 31 October 2026 (15). The security page claims SOC 2 Type II, HIPAA and ISO 27001, names security@northflank.com and a trust centre, and says penetration tests are planned. No security.txt (404 on 2 November), disclosure policy, bug bounty or advisories found, and the same page says Northflank has never been breached while the 30 October incident is open. That is fireworks-inference's record (SOC 2 Type II and ISO 27001, a Vanta trust centre, no security.txt, disclosure policy or bounty), so level with it (12). The open incident and the no-breach sentence are counted under negative events, as trigger-dev's breach was, not on this line. 30 + 15 + 10 + 15 + 12 = 82.

Together GPU Clusters 68

Project-scoped API keys, revocable with optional expiry, read as Together's other listings read the same key model (30). Admin and editor roles with no read-only role. Only admins get the admin kubeconfig, which has cluster-admin rights, and OIDC lets editors use kubectl under RBAC. Deletes run without confirmation when --non-interactive is passed (8). The API returns cluster state, not third-party content (10). Invoices itemise reserved, on-demand and storage charges, and no audit log for cluster operations was found (5). security.txt with a HackerOne route, per the 1 November check of the inference listing (15). 30+8+10+5+15 = 68.

Northflank 81

OpenAPI 3.0 at api.northflank.com/v1/swagger-json with well over 100 paths, plus an HTML view, per the 1 October check, not re-read on 2 November (25). llms.txt and a .md twin for every docs page (10). Operations carry short descriptions and the guides explain jobs against services; few say when not to use an endpoint (12). Enums throughout (token kind, scope, restriction mode) and bounded parameters such as per_page 1 to 100 (13). Examples in the guides; the spec documents 200 responses but not error schemas (6). Versioned /v1 and a dated changelog (15).

Together GPU Clusters 92

Public OpenAPI 3.1 for /v1/compute/clusters and shared volumes, MIT, embedded in every reference page (25). llms.txt and a Markdown twin of every page (10). The docs say when to choose Kubernetes or Slurm and each capacity type, and the management page carries instructions for agents on reporting live availability and prices (18). Enums for cluster type, billing type, GPU type and status, required fields marked (13). CLI, Python, TypeScript and console steps on each task, with 402 and 403 cases documented, though no error catalogue for the clusters API (11). Versioned SDKs and a dated changelog with cluster entries (15). 25+10+18+13+11+15 = 92.

Northflank 56

Closed service under UK law (15). Terms and privacy policy are both dated 1 March 2021, more than five years old, with no retention periods we could find (10). Both still read Effective Date 1 March 2021 on 2 November. No deprecation policy or dated notices found (0). Regions and bring-your-own-cloud are documented; no subprocessor list found (8).

Together GPU Clusters 65

Closed service under Together's terms, with Apache-2.0 SDKs, which don't raise the line for a closed API (15). The privacy policy's data table covers GPU clusters, per the 4 November Code Sandbox check, and the billing page states when volumes are deleted after credit runs out, with no retention period for data on deleted clusters (15). The 3.0 breaking change came with a migration guide on the day, and reservations carry dated end-of-term emails, with no notice period for API changes found (8). Regions are listed through the API and US regions appear in examples; subprocessors and data locations for clusters were not established (8). 15+15+8+8 = 46.

Northflank 70

The newest changelog digest is dated 24 September 2026, 39 days before the check. The status page's dated updates on 30 and 31 October 2026 announce secret rotation for Postgres, MongoDB and RabbitMQ add-ons and audit logs for all customers, platform changes on the vendor's own page within 30 days (30). Digests come every two months, so one falls in the 90 days from 4 August (24 September, the 23 July digest having left), with the October changes on the status page. Half credit (10). Closed service with a dated changelog and a support address for rate-limit increases (10 of 15). A CLI and JavaScript client on npm and a Python client the docs put at 2.1.0. npm and PyPI couldn't be read on 2 November (15). npm packages not audited (5). 30 + 10 + 10 + 15 + 5 = 70.

Together GPU Clusters 75

Closed service. The newest cluster change is CLI and SDK 3.0 on 22 October 2026, 15 days before this check (30). Dated cluster entries in the 90 days from 8 August include 12, 18, 19, 24, 27 and 28 August, 10 September and 22 October (20). Dated changelog, a support portal and Discord, with responsiveness not tested (8). Python SDK 3.1 and TypeScript SDK 1.0 are current and cover clusters (15). SDK CI and dependencies weren't audited (2). 30+20+8+15+2 = 75.