OpenRouter vs Vertex AI (Gemini Enterprise Agent Platform)

OpenRouter 55

Status page at status.openrouter.ai, which rendered only in a browser with its feed and JSON paths answering 403 on 1 and 2 October. On 1 November its robots.txt answered 403 AccessDenied, so the host is treated as blocked and the page was not read (10 of 20, per the 2 October check, and 5 for the incident line, no readable history). The limits page gives 20 requests a minute on free models, 50 a day below $10 of lifetime purchases and 1,000 a day above, no platform cap on paid models, and a key endpoint that reports what's left (15). The errors page says 429, 503 and 402 responses from the in-flight spending budget carry Retry-After, tells clients to honour it, and says the official SDKs already do (15). The pricing page lists 'Contractual SLAs' for Enterprise without publishing terms, which we count as no published SLA (0). The chat completions API is GA (10). Model fallbacks through a models list soften an upstream outage, which this checklist doesn't score.

Vertex AI (Gemini Enterprise Agent Platform) 99

Google Cloud status dashboard with per-product history (20). Its incident feed, read on 6 November, has no incident naming Vertex Gemini API, Gemini or the Agent Platform in the 90 days. The regional incidents of 20 August, 1 September and 20 October (europe-west2) and the Cloud Storage incident of 8 and 9 October didn't list it among affected products (30). Standard PayGo publishes usage tiers by 30-day spend with baseline throughput, 2,000,000 to 50,000,000 tokens a minute for Flash models and 500,000 to 10,000,000 for Pro, plus quota tables for other methods (15). A 429 page says to use the global endpoint and truncated exponential backoff, and a retry-strategy page (15). SLA of 99.5 per cent a month on generateContent and streamGenerateContent, 95 per cent for short-term availability models, and a latency SLO on Provisioned Throughput. The 429 page says pay-as-you-go 429s don't count toward the SLA error rate (10). Gemini 4 Argon reached GA on 13 October and Gemini 3.8 Flash moved to the 12-month tier, and the v1 API, 3.5 Flash-Lite and Claude Opus 5.5 are GA, but express mode was Preview at the 6 October check (9 of 10, up from 8). Up from 98 on 6 October.

OpenRouter 67

Model reading. Bearer keys with per-key credit limits, Management API keys for creating and rotating keys in code, and OAuth PKCE for user-delegated keys. No permission scopes on keys (25 of 30). OpenRouter doesn't store or use prompts unless you opt in for a 1% discount, but the routing reference, re-read on 1 November 2026, still sets data_collection to 'allow' by default, which admits providers that may store and train on data. An account privacy setting can switch that off, and the docs don't say what a new account starts with (5 of 20). Prompts not stored by default and a per-request zdr filter (15). Request metadata kept for reporting, per-call logs not confirmed (10 of 15). security.txt, read on 1 November 2026, is valid to 12 August 2027 with security@openrouter.ai and a PGP key, and says reports confirmed as high-impact get an invitation to a private HackerOne bug bounty. The private bounty counts as a bounty, as other listings' invitation-only programmes do (activepieces, fireflies, mixpanel). No certification or public advisory was found, so 12, above blockrun-ai's 10 (valid security.txt, no bounty) and below activepieces' 13 (a private bounty and nine public advisories) (12 of 20).

Vertex AI (Gemini Enterprise Agent Platform) 97

Model reading. OAuth 2.0 with IAM roles and service accounts, which the docs recommend for production, with API keys for testing. No key in a query string found in the docs we read (30). The training restriction in the Service Specific Terms says Google won't use customer data to train or fine-tune any model without permission, GA and pre-GA alike (20). Default in-memory caching for 24 hours that can be disabled, flagged prompts logged up to 90 days unless an abuse-monitoring exception is granted or the customer has a Cloud Master Agreement, the Interactions API storing by default, and Claude Fable 5 and Mythos 5 requiring 30-day retention shared with Anthropic (12 of 15, a judgement call matching the Fable exception on the Anthropic and Bedrock listings). Cloud Audit Logs, with Data Access logs off until enabled, and optional request-response logging to BigQuery (15). google.com security.txt valid to 2030-04-01, the Google VRP, and Generative AI on the platform in ISO 27001, 27017 and 27018 and SOC 1, 2 and 3 scope per the 1 October services-in-scope check for vertex-ai-tuning, not re-read on 6 October (20).

OpenRouter 72

Closed service with clear terms, SDKs Apache-2.0 (15). Data collection page and privacy policy agree that content isn't stored unless you opt in, but training defaults for upstream providers sit on other pages we didn't read (15 of 30). An API versioning page states how deprecations are announced (in the changelog, with the field or endpoint marked deprecated in the reference) and the changelog dates each one, but no notice period is promised (12 of 20). Each provider's data policy is shown per endpoint per the listing, and EU or US in-region routing is part of the Business plan. No subprocessor list checked (15 of 20).

Vertex AI (Gemini Enterprise Agent Platform) 90

Closed service under the Google Cloud terms, with the Gen AI SDKs under Apache-2.0 and a public discovery document (18, as for Bedrock's open service models). The zero data retention and abuse monitoring pages agree with the Cloud terms and give periods for each case, 24 hours in memory, up to 90 days for flagged prompts, 30 days for Advanced AI models, 3 days for Search grounding logs and 30 days for Maps grounding, and say which can't be switched off (27 of 30). A dated model versions table with release and retirement dates and a stated 12-month or 45-day policy, but on 6 November it still listed Gemini 2.5 Pro, Flash and Flash-Lite as available with a 20 October 2026 retirement date and left them out of the retired table (18 of 20, down from 20). The Cloud subprocessor list with locations, per the 1 October vertex-ai-tuning check, regional and multi-region endpoints, and per-model ML processing locations on the partner model cards (20).

OpenRouter 85

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calling documented, behaviour depends on the routed model (15 of 20). Structured outputs depend on the upstream model (10 of 15). Prompt caching documented, discount set by each provider (10 of 15). Routes to models with 1M-token context, a judgement call since a router has no default model (15). Batch API, usually half price per the listing (10). Official SDKs in TypeScript, Python and Go (10). Errors and debugging page (15).

Vertex AI (Gemini Enterprise Agent Platform) 97

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with FunctionCallingConfig mode ANY and allowedFunctionNames to force a named tool (20). Schema-guaranteed JSON output (15). Implicit and explicit context caching, cached input at 0.1x, $0.075 per million on 3.8 Flash through 31 December (15). 1,048,576-token context on 3.8 Flash, a unified 1,048,576-token input and output limit on Gemini 4 Argon, and 1,000,000 on Claude Opus 5.5 (15). Flex/Batch at half price on Gemini (10). Gen AI SDKs for Python and JavaScript among others, and the OpenAI libraries work with Google Cloud auth (10). 429 handling documented per quota framework, with standard Google status codes elsewhere (12 of 15).

OpenRouter 82

Model reading. The TypeScript and Python SDKs were tagged on 31 October 2026, v1.5.33 and v1.3.106, and the API changelog's newest entry is 29 October (30). The versioning page says breaking changes are reviewed by a person and published in the changelog with migration notes, and that removing a deprecated part of the API follows that process, but it states no notice period. The 25 July Responses GA entry still promises a sunset date before the beta aliases go (6 of 12). Several removals of OpenRouter's own surface in the 90 days from 3 August, each published the day it shipped, sleep_after_seconds and the ncompass provider on 8 September, the /interns endpoints on 23 October, and the Python SDK's end_users namespace in 1.3.70 on 21 October (4 of 8). Dated changelog for every release that changes the spec, support not checked (12 of 15). SDK issue replies not sampled (5 of 10). Official SDKs in TypeScript and Python (and Go, not re-read on 1 November), generated from the OpenAPI document with Speakeasy, 242 and 279 tags since 3 August (15). Each SDK repository runs PR validation and publish workflows, per the 2 October check (10).

Vertex AI (Gemini Enterprise Agent Platform) 91

Model reading. Gemini Omni 1.2 Flash GA on 5 November, Grok 4.7 GA on 27 October, Gemini 4 Argon GA on 13 October and Claude Haiku 5.5 on 7 October 2026 (30). Stable models stay at least 12 months, and since 6 October Gemini 4 Argon and Gemini 3.8 Flash are in that tier, while 3.7 and 3.6 Flash remain short-term with at least 45 days' notice once a date is set (10 of 12, up from 8). Gemini 2.5 Pro, Flash and Flash-Lite were due to retire on 20 October, three models on one date after more than 12 months, with replacements named. We didn't check partner model retirements (6 of 8, down from 8). Dated release notes on most working days, newest 5 November, and Cloud Customer Care (15). python-genai replies not sampled this run (5 of 10). Current SDKs, google-genai 3.0.0 on 6 November and @google/genai 3.0.0, and google-cloud-aiplatform 2.7.0 on 28 October 2026 (15). Supported runtimes stated, Python 3.10 or later and Node 20 or later, per the 6 October check (10). Unchanged at 91.