diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c6a18c..46ea68a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,18 @@ Initial public foundation (v0.1). native vision), AOI 53.2, grade D. Classified open-weights, not closed-frontier; grounded to primary sources, with the offensive-cyber safety finding and the new Model-as-a-Service licence gate as the load-bearing risks. +- Three new inference-provider entries, each drafted from automated research and then + independently re-verified by a Cowork browser session (see the "Corrected" entries below for + what changed on verification): Fireworks AI (AOI 64.8, grade C - a Zero Data Retention posture + and the Response API's 30-day-default retention exception are independently confirmed via + readable docs, but the Terms of Service and DPA turned out to be unreachable to a real browser, + so confidentiality is coded unknown rather than asserted), Baseten (AOI 73.6, grade B - Zero + Data Retention by default plus a genuinely MUTUAL confidentiality clause, confirmed on two + independent live fetches, and a real 99.9% SLA; no published EU region for the managed + service), and Nebius / Token Factory (AOI 60.8, grade C - its central finding, that the binding + Terms of Service contradict the marketing claim of no training on customer content, is + confirmed verbatim on independent re-read; EU-region and SLA claims were corrected downward on + the same pass). ### Changed @@ -38,6 +50,63 @@ Initial public foundation (v0.1). grant the aggregate entry had described. Safety was re-scored from 4 to 3 across all three, because no published model-level safety evaluation was found for any release; Ultra's ownership is now substantial on the OpenMDW "without restriction" grant. +- Refreshed the Together AI entry's model catalogue and pricing (last verified 2026-08-06, past the + 30-day fast-moving SLA): the served catalogue moved forward a generation (DeepSeek V3/R1 to + V4-generation, Qwen3 to 3.5/3.7/3.8, plus new GLM-5.3 and Kimi K3 entries), Mistral/Mixtral was + removed from serverless, and the prior "embeddings" claim is corrected - Together's own docs now + state no embedding models are offered via serverless. Score unchanged (governance terms have not + materially changed since the last pass). +- Corrected all four inference-provider entries above against an independent Cowork browser + verification pass, replacing draft findings from automated web-fetch research with directly + read, human-supervised evidence. Fireworks AI: the Terms of Service and DPA turned out to be + unreachable to a real browser (page-level noindexed) - confidentiality moved from + `functional_only` to `unknown`, sub-processor disclosure from `true` to `false`, and + `trains_on_inputs` from `never` to `opt_in_only` (headline 71.6 -> 64.8, grade B -> C; ownership + substantial -> partial). Baseten: the mutual confidentiality clause was confirmed on two + independent live fetches, and a real 99.9% SLA was found where none had been located, but a + prior ISO 27001 claim was retracted for lack of any basis (headline 71.2 -> 73.6, grade + unchanged at B). Nebius: the entry's central finding (training by default under the binding + Terms of Service, contradicting marketing) was confirmed verbatim, but the EU-region count + (four -> two public self-serve), a claimed inference SLA (retracted - none exists), and a + "dedicated-only" catalogue claim (models were simply superseded, not gated) were all corrected + downward, while compliance strengthened with a named SOC 2 auditor (headline 65.2 -> 60.8, + grade unchanged at C; also corrected the ownership level from `limited` to `partial` per the + ownership rule, independent of this pass). Together AI: the confidentiality-disclaimed finding + and the catalogue corrections were both independently confirmed unchanged, but `zdr_available` + was corrected from `yes_default` to `yes_optional` (Zero Data Retention is account-level opt-in, + not the default) - a real field-level fix with no score impact, since data_governance was + already capped at 3 by the confidentiality disclaimer. +- Freshness re-verification sweep across the 21 model entries the daily freshness cron flagged as + 49-58 days past the 30-day fast SLA (surfaced when PR #22's CI ran `validate.py` with the + freshness check active). A Cowork browser session re-checked each entry's licence, safety + posture, and availability against current primary sources - not a bulk date-bump. 20 of 21 + re-verified clean with no score change; several flag newer-generation releases (DeepSeek V4 + line and V3.1/V3.2, a licence-divergent GLM-5 generation, Nemotron 3.5 Lightning 30B-A3B, OLMo 3, + EuroLLM-22B-2512, Qwen3.5/3.6/3.8, Kimi K2.5/K2.6/K2.7-Code) as new entities for a future build + pass, deliberately not folded into the existing entries' scores. The one entry that needed real + judgment, not just a re-check, was `soofi`: the research surfaced that Soofi-S-Base's model card + reads "closed-beta" and the repo is gated, in tension with the project's own "open-source" + marketing - but the entry's 2026-07-25 correction already accounts for exactly this (openness + held at the open_weights ceiling, ownership already partial), so no further downgrade was + warranted. Full research pack archived under + `docs/freshness-sweeps/2026-09-21/`. +- Second freshness re-verification sweep, covering the remaining 8 stale entries (3 hosting + providers, 5 inference providers) - the same daily cron finding, out of scope for the model + sweep above. Six re-verified clean with no score change (Hugging Face, Berget, Groq, Infercom, + plus two hosting providers - llama.cpp/GGUF and Ollama - where a fresh in-window CVE each + (CVE-2026-52131, CVE-2026-85180) reinforced rather than moved their existing grade). Two needed + real re-grades: DeepInfra's Terms of Service was rewritten (effective 2026-08-17) to add a + genuine mutual confidentiality clause and make Zero Data Retention contractual and controlling + with a bounded exception, lifting it from 52.0 D to 56.8 C; Runware's current Terms no longer + contain the adverse, non-confidentiality clause a prior pass had found - the customer now owns + Outputs outright with no broad licence granted to Runware - lifting the adverse hard flag and + moving data_governance from 2 to 3 (45.6 D to 50.4 D; the grade itself did not cross into C + because compliance and residency, unrelated to this finding, were not re-examined). Runware's + correction carries a load-bearing caveat: the removal is inferred from the current text's + absence of the old clauses, since web archives were proxy-blocked and no verbatim historical + diff was possible. `python scripts/validate.py` now reports 0 errors registry-wide for the + first time this session. Research pack archived under + `docs/freshness-sweeps/2026-09-21-providers/`. ### The index diff --git a/docs/freshness-sweeps/2026-09-21-providers/_FRESHNESS-SWEEP-PROVIDERS__2026-09-21.md b/docs/freshness-sweeps/2026-09-21-providers/_FRESHNESS-SWEEP-PROVIDERS__2026-09-21.md new file mode 100644 index 0000000..bd47da9 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21-providers/_FRESHNESS-SWEEP-PROVIDERS__2026-09-21.md @@ -0,0 +1,40 @@ +# AOI freshness re-verification sweep - hosting/inference providers - 2026-09-21 + +The second half of the PR #22 freshness debt: **8 stale provider entries** (3 hosting/distribution, 5 inference), all 46-58 days past SLA. Real re-check against current primary sources, not a bulk date-bump. Every entry re-read this pass; `retrieved` flags honest per file. This lands `validate.py` at 0 errors registry-wide. + +## Summary table + +| Entity | Type | Result | What changed | Action | +|---|---|---|---|---| +| `hugging-face` (79.2 B) | hosting | clean | scanning policy verbatim unchanged; no HF-native signing; July intrusion predates window | bump, hold | +| `llama-cpp-gguf` (56.4 C) | hosting | delta | new CVE-2026-52131 (2026-09-01, CVSS 7.5, `gguf_reader::read` reachable assertion) | bump, hold C | +| `ollama` (55.2 C) | hosting | delta | new CVE-2026-85180 (2026-09-03, tensor-blob redirect SSRF); OMS signing PR #11573 in-progress, not merged | bump, hold C | +| `berget` (70.4 B) | inference | clean + positive | explicit confidentiality intact; refreshed DPA 2026-09-10 (EEA-only + customer region choice + 5 named sub-processors); ISO 27001 still a claim | bump, hold B | +| `groq` (70.0 B) | inference | clean | Sec 10 mutual confidentiality verbatim unchanged; training prohibited; "Eligible Customers" ZDR gap persists; Helsinki ~14-mo track record (no contractual region-pinning); Trust Center Vanta-gated | bump, hold B | +| `infercom` (76.0 B) | inference | clean | on-prem/air-gap still shipped (load-bearing strength); functional_only confirmed; no training (Sec 2.4); ISO 27001:2022 dated cert; DPA v1.3 PDF gated | bump, hold B | +| `deepinfra` (52.0 D) | inference | **DELTA - material positive** | ToS rewrite 2026-08-17: Section 17 mutual confidentiality (was functional_only); Section 7(b) Zero Data Retention contractual + controlling; training opt-in (hard flag lifted). Residual: disclosed Google/Anthropic model routing | RE-GRADED up: 52.0 D -> 56.8 C | +| `runware` (45.6 D) | inference | **DELTA - material** | current ToS has no adverse SUBMISSIONS clause; §2 user owns Outputs; §3 no-train commitment; private-model confidentiality - adverse cap no longer supported | RE-GRADED up: 45.6 D -> 50.4 D (hard flag lifted) | + +## Code-session application (2026-09-21) + +Both re-grade recommendations were applied, each with the flagged caveats carried into the entry: + +- **deepinfra**: confidentiality functional_only -> mutual; data_governance 3 -> 4; headline 52.0 -> 56.8 (D -> C). Compliance (SOC 2/ISO dated status, DPA/SCCs) was NOT re-examined this pass (trust centre 403'd again) and stays unchanged pending a future check. Open caveat carried into the entry: the rewritten ToS reads as an enterprise/Service-Order MSA at the canonical /terms URL - credited to the base self-serve product as the standard reading of a canonical Terms page, flagged for explicit re-confirmation if a separate self-serve-only ToS surfaces. +- **runware**: confidentiality adverse -> functional_only (not mutual/explicit - no general confidentiality clause covers ordinary prompts/outputs, only the pre-existing Private Model Protection clause); adverse hard flag lifted; trains_on_inputs unclear -> never; customer_data_ownership provider_may_use -> customer_retains; data_governance 2 -> 3; headline 45.6 -> 50.4 (stays D - other dimensions, notably compliance at 1 and residency at 2, were not re-examined and remain the binding constraints). Load-bearing caveat carried into the entry: the confidentiality-clause removal is inferred from the current text's absence of the old clauses, not a verbatim historical diff - all web archives (web.archive.org, archive.ph, timetravel.mementoweb) were proxy-blocked this pass. + +## New security findings (hosting) - no grade change + +- **CVE-2026-52131** (llama-cpp-gguf, 2026-09-01, CVSS 7.5) - reachable assertion in `gguf_reader::read`. Reinforces the existing C rationale. +- **CVE-2026-85180** (ollama, 2026-09-03) - tensor-blob redirect SSRF to internal/metadata hosts, a separate code path from the earlier fix. Offset by the not-yet-merged OMS signing PR #11573. + +## Items still requiring a manual eyeball / re-attempt (tool limits, gated sources) + +- **runware Aug-2026 archive diff** - all web archives proxy-blocked; adverse removal inferred, not verbatim-diffed. Retry when the proxy allows if a verbatim diff is later required. +- **deepinfra trust center** (trust.deepinfra.com/compliance) - 403 Sprinto/JS-gated; SOC 2 / ISO 27001 dates not re-confirmed. +- **deepinfra MSA scope** - confirm the rewritten ToS genuinely governs standard self-serve API users, not only enterprise Service Orders. +- **groq Trust Center** (trust.groq.com) - Vanta JS-gated; SOC 2 Type II remains claim-grade this pass, dated certificate not read. +- **infercom DPA v1.3** - full text gated behind a redirect; substantive clauses not read this pass (not load-bearing, since functional_only already stands on the Terms). + +## Net result + +`python scripts/validate.py` now reports **0 errors registry-wide** for the first time this session. Two material re-grades (deepinfra, runware) and six clean re-verifications, all independently checked against current primary sources rather than bulk-dated. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__ai2-olmo__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__ai2-olmo__2026-09-21.md new file mode 100644 index 0000000..4fd5ea5 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__ai2-olmo__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: ai2-olmo (freshness re-verification) - 2026-09-21 + +**Verdict: DELTA (supersession) -> bump `last_verified` to 2026-09-21, and add a new sibling.** + +- **Licence:** unchanged for the tracked line - OLMo 2 remains **Apache-2.0, fully open** (weights + data + training code). No revision. +- **Supersession - FLAG (add sibling):** AI2 has shipped **OLMo 3**, also **Apache-2.0** and **fully_open**, trained on **Dolma 3**. This is a genuinely new generation continuing the fully-open posture - recommend adding **OLMo 3** as a new sibling. The existing **OLMo 2** entry remains valid (still a live, correctly-graded fully-open model), so this is add-sibling, not replace. +- **Safety / availability:** repos live, ungated; no adverse finding - the strong openness posture (the reason for the high B grade) is intact and extended. + +`retrieved: true` - OLMo 2 + OLMo 3 model cards / LICENSE re-read; both Apache-2.0 fully-open. Clause file: `model_card__olmo-3__2026-09-21.md`. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1-distill-llama__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1-distill-llama__2026-09-21.md new file mode 100644 index 0000000..dbfca6f --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1-distill-llama__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: deepseek-r1-distill-llama (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged. The R1-Distill-Llama repos remain MIT for the DeepSeek distillation, with the underlying Llama base still governed by the Llama Community Licence (the dual-origin note in the entry still holds). No licence-text revision this pass. +- **Supersession:** no newer distill has replaced the tracked Llama-based R1 distills. **FLAG:** the V4/V3.2 generation exists but DeepSeek has not (as of this check) published an equivalent *R1-Distill-Llama* refresh under it - flagged only so the code session knows the distill line has not been re-cut. +- **Safety / availability:** repos live, ungated, no new safety finding. + +`retrieved: true` - model card + LICENSE re-read. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1-distill-qwen__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1-distill-qwen__2026-09-21.md new file mode 100644 index 0000000..2706da4 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1-distill-qwen__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: deepseek-r1-distill-qwen (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged. The R1-Distill-Qwen repos remain MIT for the DeepSeek distillation, with the underlying Qwen base under its own Apache-2.0/Qwen licence per size (the entry's per-variant note still holds). No licence-text revision this pass. +- **Supersession:** no newer Qwen-based R1 distill has replaced the tracked set. **FLAG:** the DeepSeek V4/V3.2 generation exists but has not re-cut this distill line; separately the base Qwen family has moved to Qwen3.5/3.6/3.8 (see the `qwen` return) - not folded here. +- **Safety / availability:** repos live, ungated, no new safety finding. + +`retrieved: true` - model card + LICENSE re-read. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1__2026-09-21.md new file mode 100644 index 0000000..bfb6bd0 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-r1__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: deepseek-r1 (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged. `deepseek-ai/DeepSeek-R1` HF repo `LICENSE` still MIT (weights) with the code under MIT; model card licence tag reads `mit`. No revision to the licence text since the last check. +- **Supersession:** no newer *R1* point release has replaced the tracked `DeepSeek-R1` (the `-0528` update predates the last verification and is already reflected). **FLAG (do not fold):** DeepSeek has since shipped a materially newer generation - **DeepSeek-V4 line** (V4.1-Flash, V4-Flash-Vision-Exp, V4-Pro-0813, V4-Flash-0731) and **V3.1 / V3.2** - as separate reasoning/base families. These are new entities, not an update to R1; flagged for the code session to decide new-sibling vs new-family. +- **Safety / availability:** repo live, ungated, no new red-team finding, no takedown or gating change. + +`retrieved: true` - model card + LICENSE re-read this pass. No new clause file (nothing moved on the tracked entry). diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-v3-mit__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-v3-mit__2026-09-21.md new file mode 100644 index 0000000..9f6ba73 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-v3-mit__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: deepseek-v3-mit (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged. The MIT-licensed DeepSeek-V3 variant remains MIT (this is the arm of the split that carries MIT for both code and weights). No licence-text revision this pass. +- **Supersession:** **FLAG (do not fold).** DeepSeek-V3 has been superseded by **V3.1 and V3.2**, which are also MIT-licensed, and by the **V4 line**. The tracked `deepseek-v3-mit` entry is not wrong, but it no longer represents the current head of the V3 line - flagged for the code session to decide whether to add V3.1/V3.2 as siblings. +- **Safety / availability:** repo live, ungated, no new safety finding. + +`retrieved: true` - model card + LICENSE re-read. No new clause file (tracked entry unchanged; supersession flagged only). diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-v3-original__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-v3-original__2026-09-21.md new file mode 100644 index 0000000..f2695fb --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__deepseek-v3-original__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: deepseek-v3-original (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged and the split still holds. The "original" DeepSeek-V3 repo remains **dual-licensed - code under MIT, model weights under the DeepSeek License Agreement (v1.0)**. This is exactly the divergence that justifies keeping `deepseek-v3-original` separate from `deepseek-v3-mit`, and it is still real this pass (re-confirmed against the repo `LICENSE` / `LICENSE-MODEL` split). No revision to the DeepSeek License Agreement text. +- **Supersession:** same V3.1/V3.2 -> V4 supersession as the MIT variant; flagged, not folded. +- **Safety / availability:** repo live, ungated, no new safety finding. + +`retrieved: true` - model card + both LICENSE files re-read; the MIT-vs-DeepSeek-License split verified still present. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__eurollm__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__eurollm__2026-09-21.md new file mode 100644 index 0000000..796404a --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__eurollm__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: eurollm (freshness re-verification) - 2026-09-21 + +**Verdict: DELTA (supersession) -> bump `last_verified` to 2026-09-21, and add a new sibling.** + +- **Licence:** unchanged for the tracked line - **EuroLLM-9B** remains **Apache-2.0** and **gated** (accept-terms access on HF). No revision. +- **Supersession - FLAG (add sibling):** a newer **EuroLLM-22B-2512** has shipped. Recommend adding it as a new sibling; the tracked 9B entry remains valid. Confirm the 22B's licence tag against its raw repo `LICENSE` before scoring (expected Apache-2.0, consistent with the family). +- **Safety / availability:** repos live (gated); no adverse finding. + +`retrieved: true` - EuroLLM-9B card/LICENSE re-read (still apache-2.0, gated); 22B sibling flagged. Clause file: `model_card__eurollm-22b__2026-09-21.md`. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__glm-4-9b-chat-original__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__glm-4-9b-chat-original__2026-09-21.md new file mode 100644 index 0000000..aee7233 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__glm-4-9b-chat-original__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: glm-4-9b-chat-original (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged. `THUDM/glm-4-9b-chat` remains under the custom **`glm-4`** licence, and the **commercial-registration clause** (registration/notification required for commercial use) is **intact** - re-read verbatim this pass. No revision. +- **Supersession:** the GLM-5 generation exists (see the `glm` return) but does **not** supersede this specific legacy `glm-4-9b-chat` weight - the entry still points at a live, distinct repo. +- **Safety / availability:** repo **live**, accessible; no takedown, no new adverse finding. + +`retrieved: true` - model card + glm-4 LICENSE re-read; commercial-registration clause re-confirmed. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__glm__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__glm__2026-09-21.md new file mode 100644 index 0000000..9594fbd --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__glm__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: glm (freshness re-verification) - 2026-09-21 + +**Verdict: tracked entry re-verified CLEAN -> bump `last_verified` to 2026-09-21, with a new licence-divergent sibling ACTION for the code session.** + +- **Licence (tracked MIT cluster):** unchanged. The GLM models tracked under this entry remain as recorded (MIT-cluster). No revision this pass. +- **Supersession - ACTION (new entity):** Z.ai/Zhipu has shipped a **GLM-5 generation** (**GLM-5, 5.1, 5.2, 5.3, 5.3-Flash**) governed by a **custom "GLM-5.3 License"** that is **licence-divergent** from the tracked GLM cluster - it adds a **$10B MaaS security-review gate** (a security-review requirement triggered above a large Model-as-a-Service revenue/scale threshold). This is not an MIT model and must **not** be folded into the `glm` entry - it warrants a **new `glm-5` entity/family split**. Flagged for the code session. +- **Safety / availability:** tracked repos live; no adverse finding on the tracked entry. The GLM-5.3 gate is a governance term on the *new* line, captured in its clause file. + +`retrieved: true` - GLM model cards + GLM-5.3 License re-read. Clause file: `license__glm-5__2026-09-21.md`. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__gpt-oss__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__gpt-oss__2026-09-21.md new file mode 100644 index 0000000..1c02dbe --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__gpt-oss__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: gpt-oss (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> no material change, `last_verified` can be bumped to 2026-09-21 without a re-score.** + +- **Licence:** unchanged. **gpt-oss-20b** and **gpt-oss-120b** remain **Apache-2.0** and **ungated**. No revision this pass. +- **Supersession:** no newer gpt-oss base release supersedes the tracked pair. **Optional note (not folded):** OpenAI has published **gpt-oss-safeguard** variants (safety/guardrail-oriented) - these are complementary safety artefacts, optional to add as siblings; they do not change the tracked entry's grade. +- **Safety / availability:** repos live, ungated; no adverse finding. + +`retrieved: true` - gpt-oss-20b/120b cards + LICENSE re-read; still apache-2.0 ungated. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__kimi-k2__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__kimi-k2__2026-09-21.md new file mode 100644 index 0000000..e58b136 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__kimi-k2__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: kimi-k2 (freshness re-verification) - 2026-09-21 + +**Verdict: licence re-verified CLEAN -> bump `last_verified` to 2026-09-21, with a supersession flag.** + +- **Licence:** unchanged. Kimi K2 remains under the **modified-MIT** licence carrying the branding clause: above the **100M-MAU / $20M-monthly-revenue** threshold, the licensee must **"prominently display 'Kimi K2'"** on the product UI. Re-read verbatim this pass; the thresholds and branding requirement are textually unchanged. +- **Supersession - FLAG (do not fold):** Moonshot has shipped newer releases - **K2.5, K2.6, and K2.7-Code**. These are distinct releases; flagged for the code session to decide sibling vs update-in-place. Not folded into the tracked K2 scores. +- **Safety / availability:** repo live, no adverse finding. + +`retrieved: true` - model card + modified-MIT LICENSE re-read; branding clause re-confirmed. No new clause file for the tracked entry; supersession flagged. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__kimi-k3__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__kimi-k3__2026-09-21.md new file mode 100644 index 0000000..934a940 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__kimi-k3__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: kimi-k3 (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21. Load-bearing risk finding UNCHANGED.** + +- **Licence:** unchanged. Kimi K3 remains under the **Kimi K3 License** with the load-bearing gate intact: above the **$20M** monthly-revenue Model-as-a-Service threshold the licensee must enter a **separate commercial agreement** with Moonshot, plus the branding-display thresholds. Re-read verbatim this pass - the MaaS separate-agreement gate and thresholds are textually unchanged. **The K3 risk finding (the gate that discriminates its ownership verdict) stands.** +- **Supersession:** **no K4** and no K3 point release that alters the tracked terms. +- **Safety / availability:** repo live, no new adverse finding. + +`retrieved: true` - model card + Kimi K3 License re-read; $20M MaaS gate + branding thresholds re-confirmed verbatim. No new clause file (risk finding unchanged). diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__llama-4__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__llama-4__2026-09-21.md new file mode 100644 index 0000000..0daf382 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__llama-4__2026-09-21.md @@ -0,0 +1,10 @@ +# Research return: llama-4 (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN on tracked terms -> `last_verified` can be bumped to 2026-09-21, with one manual-eyeball flag.** + +- **Licence:** unchanged on the load-bearing terms. The **Llama 4 Community License** still carries the 700M-MAU threshold and remains gated. +- **Manual re-confirm needed (tool limitation, not a finding):** WebFetch **truncated the "Additional Terms" section**, so the **EU-domicile multimodal carve-out** (the clause restricting multimodal-model use by entities domiciled in the EU) could **not be re-confirmed verbatim this pass**. Treat as **unchanged pending a manual eyeball** of the licence page - this is an unread-section caveat, not evidence of a change. `retrieved: false` for that specific clause. +- **Supersession:** no **Behemoth GA** and no newer Llama 4 point release that changes the tracked terms. +- **Safety / availability:** repos remain gated; no new adverse safety finding. + +`retrieved: true` for the model card + main licence body; `retrieved: false` for the truncated Additional Terms (EU carve-out). No new clause file - flag only. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__meta-llama__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__meta-llama__2026-09-21.md new file mode 100644 index 0000000..faf640b --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__meta-llama__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: meta-llama (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> no material change, `last_verified` can be bumped to 2026-09-21 without a re-score.** + +- **Licence:** unchanged. The **Llama 3.x Community License** still carries the **700-million-monthly-active-user** threshold clause (verbatim: a special licence from Meta is required if, on the version release date, the licensee or its affiliates offer products/services with "greater than 700 million monthly active users in the preceding calendar month"). Re-read this pass on the current `meta-llama/Llama-3.1` and `Llama-3.3` cards; the clause is textually unchanged. +- **Supersession:** the tracked entry covers the Llama 3.1 / 3.3 line; Llama 4 is tracked separately (`llama-4`). No new Llama *3.x* release. No Behemoth GA that would alter this entry. +- **Safety / availability:** repos remain **gated** (accept-terms access) - unchanged. No new adverse safety finding. + +`retrieved: true` - Llama 3.1/3.3 model cards + Community License re-read; 700M-MAU clause re-confirmed verbatim. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__mistral-research-license__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__mistral-research-license__2026-09-21.md new file mode 100644 index 0000000..f3cdc94 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__mistral-research-license__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: mistral-research-license (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged. The tracked MRL-governed models remain under the **Mistral Research License** - **Ministral-8B-2410** and **Mistral-Large-2407** still carry the `mrl` tag this pass. The MRL text (research/non-production use, no revision) is unchanged. +- **Trend note (not a change to this entry):** Mistral's **new-generation** releases appear to be trending toward **Apache-2.0 rather than MRL** (see the `mistral` return - Large-3 / Ministral-3 read Apache, pending manual re-confirm). If that holds, the MRL split may shrink over time, but **the currently-tracked MRL entries are still MRL** - no reclassification this pass. +- **Safety / availability:** repos live; no new adverse finding. + +`retrieved: true` - Ministral-8B-2410 + Large-2407 cards/LICENSE re-read; still `mrl`. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__mistral__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__mistral__2026-09-21.md new file mode 100644 index 0000000..8f71840 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__mistral__2026-09-21.md @@ -0,0 +1,12 @@ +# Research return: mistral (freshness re-verification) - 2026-09-21 + +**Verdict: DELTA -> bump `last_verified` to 2026-09-21, and flag new-gen catalogue for the code session.** + +- **Licence (tracked Apache group):** the Apache-2.0 arm of the Mistral split is **still Apache-2.0** and has, if anything, expanded. New-generation 2026 releases read as Apache-2.0: + - **Mistral-Small-4-119B - apache-2.0** (corroborated across model card + repo tag). + - **Devstral-2, Voxtral** and other new-gen releases - apache-2.0. +- **Manual re-confirm needed:** **Mistral-Large-3-675B** and **Ministral-3** were **read as apache-2.0 via the WebFetch summariser** - if correct this is a notable shift, because prior Large/Ministral-tier weights sat under the **Mistral Research License (MRL)**. An **MRL -> Apache** move is a material policy change, so this must be **manually re-confirmed against the raw HF `LICENSE` tag** before the code session re-scores. `retrieved: true` but summariser-sourced -> treat as provisional. +- **Exception preserved:** **Codestral-22B-v0.1 remains `mnpl`** (Mistral Non-Production License) - keep as the explicit non-Apache exception in the split; unchanged. +- **Supersession:** the tracked `mistral` entry's catalogue is behind the current new-gen line; flagged for the code session to refresh `models`/siblings (not folded into scores here). + +`retrieved: true` (cards re-read); Large-3 / Ministral-3 Apache reading flagged provisional pending manual LICENSE-tag check. Clause file: `license__mistral-newgen__2026-09-21.md`. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3-nano-omni__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3-nano-omni__2026-09-21.md new file mode 100644 index 0000000..cb77726 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3-nano-omni__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: nemotron-3-nano-omni (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged and correctly tagged - **NVIDIA Nemotron Open Model License** (Apache-derived, irrevocable, no Trustworthy-AI/guardrail-revocation clause). No revision this pass. +- **Supersession - FLAG:** the new **Nemotron 3.5 Lightning 30B-A3B (2026-08-11, OpenMDW-1.1)** sits in the same Nano/compact footprint as this entry. It is a distinct licence and a distinct release, so it belongs as a new sibling rather than folded into `nemotron-3-nano-omni`. Flagged (also noted under `nemotron-3`). +- **Safety:** unchanged/strengthened (3.5 Content Safety guard). No adverse finding. + +`retrieved: true` - model card + licence re-read. No new clause file for the tracked entry; sibling flagged. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3-ultra__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3-ultra__2026-09-21.md new file mode 100644 index 0000000..7ba5bdd --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3-ultra__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: nemotron-3-ultra (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN -> bump `last_verified` to 2026-09-21.** + +- **Licence:** unchanged and correctly tagged - **NVIDIA Nemotron Open Model License** (Apache-derived, irrevocable, no Trustworthy-AI/guardrail-revocation clause). No revision this pass; tag still distinct from the generic NVIDIA Open Model License. +- **Supersession:** no newer *Ultra*-tier release has replaced the tracked entry. (The new Nemotron 3.5 Lightning 30B-A3B sits in the Nano/compact footprint, not the Ultra tier - see the `nemotron-3` return; not folded here.) +- **Safety:** unchanged/strengthened (Nemotron 3.5 Content Safety guard added to the family tooling). No adverse finding. + +`retrieved: true` - model card + licence re-read. No new clause file. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3__2026-09-21.md new file mode 100644 index 0000000..8d6d71a --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__nemotron-3__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: nemotron-3 (freshness re-verification) - 2026-09-21 + +**Verdict: re-verified CLEAN on tracked terms -> bump `last_verified` to 2026-09-21, with a sibling flag.** + +- **Licence:** unchanged and correctly tagged. Nemotron-3 remains under the **NVIDIA Nemotron Open Model License** (Apache-derived, irrevocable grant, **no** Trustworthy-AI (2.3) / revocable-guardrail (2.1) clause). Re-confirmed this pass that the Nemotron-tagged licence is *not* the generic "NVIDIA Open Model License" that does carry those clauses - the distinction the earlier pack corrected still holds and the tag is right. +- **Supersession - FLAG (do not fold):** NVIDIA has shipped **Nemotron 3.5 Lightning 30B-A3B (released 2026-08-11), licensed OpenMDW-1.1** (Linux Foundation), sitting in the Nano/compact footprint. Different licence from the tracked Nemotron-3 -> warrants a new sibling, not an in-place fold. Flagged for the code session. +- **Safety:** strengthened, not weakened - a **Nemotron 3.5 Content Safety** guard model has been added to the safety tooling. No new adverse red-team finding. + +`retrieved: true` - model card + Nemotron Open Model License re-read; licence-family distinction re-verified. New sibling flagged; no correction needed to the existing entry's clauses. diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__qwen__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__qwen__2026-09-21.md new file mode 100644 index 0000000..58fcefa --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__qwen__2026-09-21.md @@ -0,0 +1,9 @@ +# Research return: qwen (freshness re-verification) - 2026-09-21 + +**Verdict: DELTA (supersession) -> bump `last_verified` to 2026-09-21, and flag the newer generations.** + +- **Licence:** unchanged for the tracked line - the in-scope **Qwen3** weights remain **Apache-2.0** and have **not** been reverted or re-licensed. No revision this pass. +- **Supersession - FLAG:** Qwen3 has been superseded by **Qwen3.5 / 3.6 / 3.8**, all read as **Apache-2.0**. The tracked Qwen3 entry is not wrong (still live, still Apache), but it no longer represents the current head of the line - flagged for the code session to decide whether to add newer siblings or update `models`. +- **Safety / availability:** repos live, ungated; no adverse finding. + +`retrieved: true` - Qwen3 + Qwen3.5/3.6/3.8 cards/LICENSE re-read; all apache-2.0, tracked Qwen3 not reverted. No new clause file (supersession flagged). diff --git a/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__soofi__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__soofi__2026-09-21.md new file mode 100644 index 0000000..7960231 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/RESEARCH-RETURN__soofi__2026-09-21.md @@ -0,0 +1,18 @@ +# Research return: soofi (freshness re-verification) - 2026-09-21 + +**Verdict: DELTA / REVIEW -> do NOT auto-bump; flag for the code session, possible re-grade.** + +- **Openness contradiction - load-bearing:** the **Soofi-S-Base** model card carries the HF tag **verbatim "closed-beta"** and the repo is **GATED**, while the project's marketing describes it as **"open-source."** The current AOI entry grades `soofi` at **73.2 (B)** - that grade may be **too generous** if the actual weight availability is closed-beta/gated rather than openly downloadable. This is exactly the kind of "marketing not-equal licence tag" divergence AOI exists to catch. **Recommend the code session re-examine `transparency`/`use_modify` for this entry before honestly bumping `last_verified`** - a clean bump is not warranted here. +- **Supersession:** the **Soofi-Project** org has published new preview siblings - **Soofi-S-Instruct, Soofi-Isar, Soofi-Rhine** - as previews. Flagged; not folded. +- **Availability:** Soofi-S-Base **gated** (access-request), not openly downloadable this pass. + +`retrieved: true` - Soofi-Project org + Soofi-S-Base card re-read; "closed-beta" tag + gating captured verbatim. Clause file: `model_card__soofi__2026-09-21.md`. **Recommend hold on the bump pending re-grade.** + +## Code-session follow-up (2026-09-21, after review) + +On review against the existing `soofi` entry, this recommendation is superseded: the entry's +2026-07-25 correction already accounts for exactly this contradiction (openness held at the +`open_weights` ceiling/score 3, `weights` component already `partial`, ownership already +`partial`, `use_modify` already `moderate` - all specifically because the licence was already +known unconfirmed and weights not generally downloadable). No further downgrade applied; +`last_verified` bumped with the reasoning documented in the entry's own changelog. diff --git a/docs/freshness-sweeps/2026-09-21/_FRESHNESS-SWEEP__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/_FRESHNESS-SWEEP__2026-09-21.md new file mode 100644 index 0000000..ca688d1 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/_FRESHNESS-SWEEP__2026-09-21.md @@ -0,0 +1,74 @@ +# AOI freshness re-verification sweep - 2026-09-21 + +Re-verification of the **21 stale model entries** surfaced by `validate.py` on PR #22 (all +`last_verified` in late-Jul/early-Aug 2026, 49-58 days past the 30-day fast SLA). This was a +**real re-check against current primary sources**, not a bulk date-bump. Every entry was re-read +this pass; `retrieved` flags are honest per file. + +## Summary table + +| Entity | Result | What changed | Bump `last_verified`? | +|---|---|---|---| +| `deepseek-r1` | clean | none on tracked entry; V4 line + V3.1/V3.2 exist (flag) | **Yes** | +| `deepseek-r1-distill-llama` | clean | none; distill line not re-cut under V4 | **Yes** | +| `deepseek-r1-distill-qwen` | clean | none; base Qwen moved (see qwen) | **Yes** | +| `deepseek-v3-mit` | clean | none on entry; V3.1/V3.2 (also MIT) supersede (flag) | **Yes** | +| `deepseek-v3-original` | clean | MIT-code / DeepSeek-License-weights split still real | **Yes** | +| `nemotron-3` | clean + flag | licence tag correct; **new sibling: Nemotron 3.5 Lightning 30B-A3B (OpenMDW-1.1)** | **Yes** | +| `nemotron-3-ultra` | clean | licence tag correct; no Ultra-tier supersession | **Yes** | +| `nemotron-3-nano-omni` | clean + flag | licence tag correct; 3.5 Lightning sits in this footprint (sibling) | **Yes** | +| `meta-llama` | clean | 700M-MAU clause verbatim unchanged; gated | **Yes** | +| `llama-4` | clean + caveat | terms unchanged; EU multimodal carve-out not re-confirmable (fetch truncation) - manual eyeball | **Yes** (with caveat) | +| `mistral` | delta | new-gen apache-2.0 releases; Large-3/Ministral-3 read Apache - manual re-confirm (MRL to Apache?); Codestral still mnpl | **Yes** | +| `mistral-research-license` | clean | Ministral-8B-2410 + Large-2407 still mrl; new gen trending Apache | **Yes** | +| `glm` | clean + action | MIT cluster unchanged; **new licence-divergent line: glm-5 (custom GLM-5.3 License, $10B MaaS security gate)** | **Yes** | +| `glm-4-9b-chat-original` | clean | glm-4 tag + commercial-registration clause intact; repo live | **Yes** | +| `kimi-k2` | clean + flag | 100M-MAU / $20M branding clause intact; **K2.5/K2.6/K2.7-Code exist** (flag) | **Yes** | +| `kimi-k3` | clean | $20M MaaS separate-agreement gate verbatim unchanged; risk finding stands; no K4 | **Yes** | +| `ai2-olmo` | delta | **OLMo 3 shipped (Apache-2.0, fully_open, Dolma 3) - add sibling**; OLMo 2 still valid | **Yes** | +| `eurollm` | delta | 9B still apache-2.0/gated; **EuroLLM-22B-2512 - add sibling** | **Yes** | +| `gpt-oss` | clean | 20b/120b apache-2.0 ungated; gpt-oss-safeguard optional note | **Yes** | +| `qwen` | delta | Qwen3 not reverted (apache-2.0); **superseded by Qwen3.5/3.6/3.8** (flag) | **Yes** | +| `soofi` | REVIEW | **Soofi-S-Base tag verbatim "closed-beta" + gated vs "open-source" marketing** - B grade may overstate openness | HOLD - re-grade first (see code session's own follow-up note below) | + +## Code-session follow-up on `soofi` (added after the research pack landed) + +The research pack recommended holding the bump pending a re-grade. On review, the entry's +2026-07-25 correction already accounts for exactly this: openness is already held at the +`open_weights` ceiling (score 3, not `fully_open`/5), the `weights` component is already +`partial`, and ownership is already `partial` with `use_modify: moderate` - all specifically +because the licence was already known to be unconfirmed and weights not generally downloadable. +The newly-confirmed "gated" detail doesn't change that picture. No further downgrade applied; +`last_verified` bumped with a documented reasoning trail in the entry's own changelog. + +## New entities / siblings flagged for a future build pass (NOT folded into existing scores) + +1. **`glm-5`** - new licence-divergent family (GLM-5/5.1/5.2/5.3/5.3-Flash; custom GLM-5.3 + License with $10B MaaS security-review gate). +2. **Nemotron 3.5 Lightning 30B-A3B** - OpenMDW-1.1, distinct licence from tracked Nemotron-3. +3. **OLMo 3** - Apache-2.0 fully_open, Dolma 3. +4. **EuroLLM-22B-2512** - new sibling. +5. **DeepSeek V4 line** (V4.1-Flash, V4-Flash-Vision-Exp, V4-Pro-0813, V4-Flash-0731) + **V3.1/V3.2** + (MIT) - new entities. +6. **Qwen3.5 / 3.6 / 3.8** (apache-2.0) - newer siblings. +7. **Kimi K2.5 / K2.6 / K2.7-Code** - newer releases. +8. **Soofi previews** (Instruct, Isar, Rhine) - already tracked as variants of the existing entry, + not new entities. + +## Items requiring a manual eyeball before any future re-scoring (tool limits / summariser-sourced) + +- **llama-4 EU-domicile multimodal carve-out** - WebFetch truncated the "Additional Terms"; + `retrieved:false` for that clause. Treated as unchanged pending a manual read. +- **Mistral Large-3-675B and Ministral-3 apache-2.0** - read via a WebFetch summariser, not the + raw HF `LICENSE` tag. An MRL to Apache move would be materially score-moving - confirm from the + raw file before re-scoring `use_modify`. +- **GLM-5.3 $10B MaaS threshold** - re-confirm the figure verbatim from the licence text before + public quotation. +- **EuroLLM-22B-2512 licence tag** - expected Apache-2.0; confirm from the raw repo file. + +## Net for the 21 stale entries + +20 of 21 honestly bumped to `last_verified: 2026-09-21` with no score change (nothing tracked +changed; new-generation releases are flagged as separate future entities, not folded in). `soofi` +bumped after the code session confirmed the entry's existing 2026-07-25 correction already +accounts for the re-confirmed facts. diff --git a/docs/freshness-sweeps/2026-09-21/license__glm-5__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/license__glm-5__2026-09-21.md new file mode 100644 index 0000000..acee627 --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/license__glm-5__2026-09-21.md @@ -0,0 +1,19 @@ +doc_type: license +entity: glm-5 (NEW - licence-divergent from the tracked `glm` MIT cluster) +source_url: https://huggingface.co/zai-org (GLM-5 / 5.1 / 5.2 / 5.3 / 5.3-Flash) ; GLM-5.3 License +document_effective_date: GLM-5 generation, 2026 +retrieval_date: 2026-09-21 +exists: yes +retrieved: true +tag: publisher + +## What moved +Z.ai/Zhipu has shipped a **GLM-5 generation** - **GLM-5, GLM-5.1, GLM-5.2, GLM-5.3, GLM-5.3-Flash** - governed by a **custom "GLM-5.3 License"** that is materially different from the MIT-cluster licence the tracked `glm` entry records. + +## Load-bearing term +The GLM-5.3 License adds a **Model-as-a-Service security-review gate**: above a large MaaS scale threshold (reported at the **$10B** level) the licensee is required to undergo a **security review**. This is a governance restriction on commercial deployment at scale - analogous in shape to the Kimi K3 / GLM-5.3 MaaS gates - and it does not exist in the MIT-cluster GLM entry. + +## Recommendation (for the code session - do not fold) +Create a **new `glm-5` entity/family split** rather than updating the MIT `glm` entry. The licence divergence (custom GLM-5.3 License + MaaS security-review gate vs MIT) is exactly the kind of split AOI already uses elsewhere (mistral apache/mrl/mnpl; deepseek mit/original). `use_modify` for `glm-5` is gated by the security-review clause and should be scored separately from the MIT cluster. + +retrieved: true - GLM-5 cards + GLM-5.3 License re-read this pass. (The $10B threshold figure should be re-confirmed verbatim from the licence text before it is quoted publicly.) diff --git a/docs/freshness-sweeps/2026-09-21/license__mistral-newgen__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/license__mistral-newgen__2026-09-21.md new file mode 100644 index 0000000..5ab981a --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/license__mistral-newgen__2026-09-21.md @@ -0,0 +1,23 @@ +doc_type: license +entity: mistral +source_url: https://huggingface.co/mistralai (Mistral-Small-4, Mistral-Large-3, Ministral-3, Devstral-2, Voxtral cards) ; per-repo LICENSE tags +document_effective_date: 2026 new-generation releases +retrieval_date: 2026-09-21 +exists: yes +retrieved: partial - see per-item flags +tag: publisher + +## What moved +Mistral's 2026 new-generation catalogue has advanced past what the `mistral` entry tracks. Licence reads this pass: + +- **Mistral-Small-4-119B - apache-2.0.** Corroborated across model card + repo licence tag. retrieved: true. +- **Devstral-2 - apache-2.0.** retrieved: true (card). +- **Voxtral - apache-2.0.** retrieved: true (card). +- **Mistral-Large-3-675B - read apache-2.0 (PROVISIONAL).** Sourced via the WebFetch summariser, not a raw LICENSE-file read. If correct, this is a policy shift, because prior Large-tier weights sat under the **Mistral Research License (MRL)**. retrieved: false for the raw licence tag -> MUST be manually re-confirmed against the HF repo `LICENSE` before the code session re-scores. +- **Ministral-3 - read apache-2.0 (PROVISIONAL).** Same caveat as Large-3: summariser-sourced; prior Ministral-tier sat under MRL. retrieved: false for the raw tag -> manual re-confirm required. + +## Preserved exception (unchanged) +- **Codestral-22B-v0.1 - mnpl (Mistral Non-Production License).** Still the explicit non-Apache exception in the split. retrieved: true. Unchanged. + +## Note for the code session +The Apache-2.0 arm of the split is intact and expanding. The open question is whether Large-3 / Ministral-3 have genuinely moved MRL -> Apache. Do NOT re-score `use_modify` on that basis until the raw LICENSE tags are eyeballed - an MRL to Apache reclassification is materially score-moving and must not rest on a summariser read. diff --git a/docs/freshness-sweeps/2026-09-21/model_card__eurollm-22b__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/model_card__eurollm-22b__2026-09-21.md new file mode 100644 index 0000000..9d263fc --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/model_card__eurollm-22b__2026-09-21.md @@ -0,0 +1,20 @@ +doc_type: model_card +entity: eurollm (NEW sibling - EuroLLM-22B-2512) +source_url: https://huggingface.co/utter-project (EuroLLM-22B-2512) +document_effective_date: EuroLLM-22B-2512 release +retrieval_date: 2026-09-21 +exists: yes +retrieved: true +tag: publisher + +## What moved +A newer, larger **EuroLLM-22B-2512** has shipped alongside the tracked EuroLLM-9B. + +- **Availability:** live on HF. +- **Licence:** expected **Apache-2.0**, consistent with the EuroLLM-9B family - **confirm against the raw repo `LICENSE` tag** before scoring (recorded here as expected-but-to-verify, not asserted). +- **Gating:** verify whether the 22B is accept-terms gated like the 9B. + +## Recommendation (for the code session) +**Add EuroLLM-22B-2512 as a new sibling.** The tracked EuroLLM-9B entry remains valid (still apache-2.0, gated, re-verified clean this pass). Ground the 22B's licence/gating from its own repo before assigning a grade. + +retrieved: true - 22B card sighted this pass; licence tag flagged for raw-file confirmation. diff --git a/docs/freshness-sweeps/2026-09-21/model_card__olmo-3__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/model_card__olmo-3__2026-09-21.md new file mode 100644 index 0000000..6424b9c --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/model_card__olmo-3__2026-09-21.md @@ -0,0 +1,20 @@ +doc_type: model_card +entity: ai2-olmo (NEW sibling - OLMo 3) +source_url: https://huggingface.co/allenai (OLMo 3) ; allenai.org +document_effective_date: OLMo 3 release, 2026 +retrieval_date: 2026-09-21 +exists: yes +retrieved: true +tag: publisher + +## What moved +AI2 has shipped **OLMo 3**, the next generation of the OLMo fully-open family. + +- **Licence:** **Apache-2.0.** +- **Openness:** **fully_open** - weights, training code, and data released, continuing the OLMo posture that earns the family its high grade. +- **Training data:** **Dolma 3** (the refreshed open pre-training corpus). + +## Recommendation (for the code session) +**Add OLMo 3 as a new sibling.** Do not replace the existing OLMo 2 entry - OLMo 2 remains a live, correctly-graded fully-open model. OLMo 3 inherits the same Apache-2.0 / fully-open profile, so its trust dimensions (Openness, Provenance) should score at least as strongly as OLMo 2; verify `technical_report` and Dolma 3 documentation links when grounding. + +retrieved: true - OLMo 3 model card + LICENSE re-read this pass. diff --git a/docs/freshness-sweeps/2026-09-21/model_card__soofi__2026-09-21.md b/docs/freshness-sweeps/2026-09-21/model_card__soofi__2026-09-21.md new file mode 100644 index 0000000..e2de13e --- /dev/null +++ b/docs/freshness-sweeps/2026-09-21/model_card__soofi__2026-09-21.md @@ -0,0 +1,28 @@ +doc_type: model_card +entity: soofi +source_url: https://huggingface.co/Soofi-Project (Soofi-S-Base, Soofi-S-Instruct, Soofi-Isar, Soofi-Rhine) +document_effective_date: current +retrieval_date: 2026-09-21 +exists: yes +retrieved: true +tag: publisher + +## The load-bearing contradiction +The **Soofi-S-Base** HF model card carries the tag **verbatim "closed-beta"**, and the repo is **GATED** (access-request), while the Soofi project's own marketing describes the model as **"open-source."** + +- Marketing framing: "open-source". +- Actual HF signal: **"closed-beta"** tag + **gated** access - i.e. weights are NOT openly downloadable this pass. + +This is a marketing-vs-availability divergence: the current AOI grade of **73.2 (B)** may be too generous if it assumed open weight availability. + +## New siblings (previews) +The **Soofi-Project** org has published preview siblings: **Soofi-S-Instruct, Soofi-Isar, Soofi-Rhine** - all preview-stage. Flagged, not folded. + +## Recommendation (for the code session) +**Do NOT bump `last_verified` with a clean pass for `soofi`.** Re-examine `transparency` and `use_modify` against the "closed-beta" tag and gating before re-grading. If the weights are genuinely closed-beta/gated rather than openly licensed, the B grade likely overstates openness and should come down. + +retrieved: true - Soofi-Project org + Soofi-S-Base card re-read this pass; "closed-beta" tag and gating captured directly. + +## Code-session follow-up (2026-09-21, after review) +See `RESEARCH-RETURN__soofi__2026-09-21.md` in this same folder: the entry's existing 2026-07-25 +correction already accounts for this exact contradiction. No further downgrade applied. diff --git a/docs/primary-sources/baseten/_sources.md b/docs/primary-sources/baseten/_sources.md new file mode 100644 index 0000000..d1dfbc6 --- /dev/null +++ b/docs/primary-sources/baseten/_sources.md @@ -0,0 +1,26 @@ +# baseten - primary-source clauses + +**CORRECTED 2026-09-21** after an independent Cowork browser verification pass - see +[`browser-verified/`](browser-verified/) for the full capture and +[`RESEARCH-RETURN__baseten__2026-09-20.md`](browser-verified/RESEARCH-RETURN__baseten__2026-09-20.md) +for the field-by-field findings. Net result: mostly CONFIRMATORY and even strengthened (mutual +confidentiality independently confirmed on two fetches; a real SLA was found where none had been +located before), with one retraction (a prior ISO 27001 claim had no basis anywhere) and one +location correction (ZDR default lives on the Security Practices page, not the Terms directly). + +## _sources.md +``` +doc_type | url | exists | retrieved | notes +terms | https://www.baseten.co/terms-and-conditions/ | yes | yes | Independently browser-confirmed on TWO separate fetches. Sec 11 mutual confidentiality (Customer Content + Customer Models named symmetrically), Sec 6.3 never-train, Sec 6.1 customer IP, Sec 2.5 ZDR (conditional on Security Practices designation), Sec 7.4 30-day export, Sec 12.8 California law, Sec 9.1 liability cap. +security | https://www.baseten.co/security-practices/ | yes | yes | Independently browser-confirmed verbatim. ZDR DEFAULT stated HERE (not the Terms); logical namespace isolation + single-tenant dedicated + self-hosted VPC (NOT an explicit "three-tier" model); TLS1.2+/AES-256; MFA; pen-testing; SOC2/HIPAA/GDPR claimed (NOT ISO 27001). +dpa | https://www.baseten.co/dpa | yes | yes | Dated 2026-09-15. Processor/Controller roles, SCCs Module 2/3, 15-day sub-processor notice (Sec 7.1), objection right (Sec 7.2), personal-data confidentiality (Sec 5.3). +marketing | https://www.baseten.co/blog/soc-2-type-2/ | yes | yes | SOC 2 Type II, named audit firm (Sensiba San Filippo LLP). +docs | https://docs.baseten.co/deployment/regional-environments | yes | yes | No published region-name list; requires contacting support. +docs | https://www.baseten.co/deployments/baseten-self-hosted/ | yes | yes | Full workload plane in customer VPC, Enterprise-tier marketing. +sla | https://status.baseten.co/ | yes | YES (upgraded) | Independently browser-read: "All Systems Operational", 6 components, 3 incidents in current window (Sep 9/14/20 2026), all resolved same/next-day. A prior draft cited a single, differently-dated incident from a search snippet only. +sla | https://www.baseten.co/service-level-agreement/ | yes | YES (new) | NEW FINDING: a real, committed SLA. Sec 2.0 - 99.9% uptime (Dedicated Inference + Model APIs); Sec 4.2 - credits capped at 40%/month; Sec 4.3 - 24h claim window. A prior draft said none had been located. +marketing | https://www.baseten.co/pricing/ | yes | yes | Per-token Model API rates + per-GPU-minute dedicated rates (T4 through B200). +docs | https://www.baseten.co/library/ | yes | yes | Curated Model Library catalogue. +docs | https://docs.baseten.co/overview | yes | yes | Three product pathways (Model APIs, custom dedicated deploys, Training Jobs/Loops); OpenAI + beta Anthropic API compatibility. +security | https://trust.baseten.co/ (+ /subprocessors) | yes | no | Vanta portal, JS-gated - every path tried returns only a meta description + security@baseten.co. RETRACTION: a prior claim of ISO 27001 certification has NO basis here or anywhere else checked - do not assert it. PCI DSS/FedRAMP/CSA STAR and the named sub-processor list also remain unconfirmed. +``` diff --git a/docs/primary-sources/baseten/browser-verified/RESEARCH-RETURN__baseten__2026-09-20.md b/docs/primary-sources/baseten/browser-verified/RESEARCH-RETURN__baseten__2026-09-20.md new file mode 100644 index 0000000..b943edf --- /dev/null +++ b/docs/primary-sources/baseten/browser-verified/RESEARCH-RETURN__baseten__2026-09-20.md @@ -0,0 +1,35 @@ +# Research return: baseten (FULL grounding pass) - 2026-09-20 + +## Decisive questions - CONFIRM / CORRECT +1. ZDR default + never-train? -> CONFIRMED, with a location nuance: ZDR is the DEFAULT per the Security Practices page ("ZDR is the default configuration for the customer's use of the inference products"), NOT the Terms - Terms Sec 2.5 only honours whatever the Security Practices designate. CORRECT any "ZDR default per the Terms" wording. Never-train CONFIRMED (Terms Sec 6.3 verbatim). +2. Mutual confidentiality + survival? -> CONFIRMED and strong. Section 11 is genuinely mutual (symmetric Disclosing/Receiving Party; Customer Content + Models named as Customer's confidential info; single shared standard of care Sec 11.2), survives 3 years, trade secrets indefinitely (Sec 11.4). This is a legitimate differentiating finding - state it clearly. confidentiality = mutual. +3. Trust Center ISO 27001 / PCI DSS / FedRAMP / CSA STAR? -> retrieved:false. Vanta portal JS-gated; NONE confirmable. Only SOC 2 Type II, HIPAA, GDPR are publicly claimed (Security Practices/docs). Do NOT assert ISO 27001/PCI/FedRAMP/CSA STAR - no independent read. No compliance upgrade from those. +4. Named sub-processor list? -> PARTIAL. Baseten COMMITS to a named list (DPA 7.1 + Security Practices) with 15-day notice, but the list sits behind the Vanta gate (unverifiable). Only marketing vendors are publicly named (Privacy Policy). Treat the named infra list as NOT independently confirmed. + +## Field-by-field +| Field | Value | Grounded | +|-------|-------|----------| +| retention | ZDR DEFAULT (Security Practices); Terms Sec 2.5 conditional | security/terms | +| training-on-inputs | never (Terms 6.3; Security Practices) | terms/security | +| confidentiality | MUTUAL (Sec 11.1-11.2), 3-yr survival + trade secrets indefinite (11.4) | terms (verbatim x2) | +| customer IP | customer reserves all rights (Sec 6.1) | terms | +| export | 30-day post-term export (Sec 7.4) | terms | +| compliance | SOC2 Type II + HIPAA + GDPR (publisher); ISO27001/PCI/FedRAMP/CSA STAR NOT confirmed (Vanta JS-gated) | security; trust:false | +| encryption | TLS1.2+/AES-256 | security | +| isolation | logical namespace + single-tenant dedicated + self-hosted VPC (NOT "three-tier") | security/docs | +| pen-test | yes; bug bounty not found | security | +| SLA | 99.9% committed (Model APIs + Dedicated); 40% max monthly credits; 24h claim | sla (verbatim) | +| status | all operational; incidents Sep 9/14/20 | status | +| dedicated_availability | self_serve (dedicated per-minute); self-hosted = enterprise_only | pricing | +| governing law / liability | California; 12-mo cap (Sec 9.1) | terms | +| sub-processors | 15-day notice + list at trust.baseten.co (JS-gated, unread) | dpa/security; trust:false | + +## Corrections to the draft entry +1. "ZDR default per the Terms" -> per the Security Practices page (incorporated by reference); Terms Sec 2.5 only honours the designated posture. +2. "Three-tier isolation model" -> not stated; describe as logical namespace + single-tenant dedicated + self-hosted VPC. +3. "Named sub-processor list published" -> committed but Vanta-gated/unverifiable; only marketing vendors publicly named. +4. ISO 27001 / PCI DSS / FedRAMP / CSA STAR -> NOT found; only SOC2 Type II / HIPAA / GDPR publicly claimed. +CONFIRMED STRONG: mutual confidentiality with 3-year (indefinite trade-secret) survival. + +## RE-DO +Authenticated/JS render of trust.baseten.co to read the Vanta certificate list (ISO/PCI/FedRAMP/CSA STAR status + dates) and the named infra sub-processor inventory. diff --git a/docs/primary-sources/baseten/browser-verified/_sources.md b/docs/primary-sources/baseten/browser-verified/_sources.md new file mode 100644 index 0000000..0099203 --- /dev/null +++ b/docs/primary-sources/baseten/browser-verified/_sources.md @@ -0,0 +1,11 @@ +doc_type | source_url | retrieval_date | exists | retrieved | notes +terms | https://www.baseten.co/terms-and-conditions/ | 2026-09-20 | yes | true | Full Section 11 (mutual confidentiality) confirmed verbatim across 2 fetches; ZDR in Terms is CONDITIONAL (Sec 2.5), not default; no-train Sec 6.3; customer IP Sec 6.1; 30-day export Sec 7.4; California law Sec 12.8; 12-mo liability cap Sec 9.1. publisher. +dpa | https://www.baseten.co/dpa/ | 2026-09-20 | yes | true | Dated 2026-09-15; Baseten=Processor; SCCs Module 2/3; 15-day sub-processor notice; confidentiality re personal data Sec 5.3. publisher. +security | https://www.baseten.co/security-practices/ | 2026-09-20 | yes | true | ZDR DEFAULT stated here; SOC2 Type II/HIPAA/GDPR; TLS1.2+/AES-256; MFA; pen-test; sub-processor list "maintained at trust.baseten.co" 15-day notice. publisher. +security | https://docs.baseten.co/observability/security | 2026-09-20 | yes | true | ZDR default; per-customer K8s namespaces; Calico/Cilium; GPUs never shared; self-hosted control/workload split. publisher. +security | https://trust.baseten.co/ (+ /subprocessors) | 2026-09-20 | yes | false | Vanta portal JS-gated; only meta + security@baseten.co. NO cert dates/scope; ISO 27001/PCI DSS/FedRAMP/CSA STAR UNVERIFIABLE. Named infra sub-processor list not readable. +sla | https://www.baseten.co/service-level-agreement/ | 2026-09-20 | yes | true | 99.9% committed (Sec 2.0) for Model APIs + Dedicated Inference; 40% max monthly credits (Sec 4.2); 24h claim window (Sec 4.3); exclusions Sec 1.4. publisher. +sla | https://status.baseten.co/ | 2026-09-20 | yes | true | "All Systems Operational"; 6 components; 90-day history, no numeric % on face; incidents Sep 9/14/20 2026. publisher. +pricing | https://www.baseten.co/pricing/ | 2026-09-20 | yes | true | Model APIs per-token; Dedicated per-minute (self-serve); self-hosted Enterprise-only; Truss/open-model portability. publisher. +privacy | https://www.baseten.co/privacy-policy/ | 2026-09-20 | yes | true | Names only Google Analytics/Segment/Sendgrid/Stripe (marketing vendors), NOT inference infra sub-processors. +legal_index | https://www.baseten.co/legal/ | 2026-09-20 | no | false | 404 (DPA at /dpa/, terms at /terms-and-conditions/). diff --git a/docs/primary-sources/baseten/browser-verified/dpa-security-sla__2026-09-20.md b/docs/primary-sources/baseten/browser-verified/dpa-security-sla__2026-09-20.md new file mode 100644 index 0000000..e9c8e54 --- /dev/null +++ b/docs/primary-sources/baseten/browser-verified/dpa-security-sla__2026-09-20.md @@ -0,0 +1,41 @@ +doc_type: dpa (+ security, sla, status, pricing) +entity: baseten +source_url: baseten.co/dpa ; baseten.co/security-practices ; docs.baseten.co/observability/security ; baseten.co/service-level-agreement ; status.baseten.co ; baseten.co/pricing ; trust.baseten.co +document_effective_date: DPA 2026-09-15 +retrieval_date: 2026-09-20 +exists: yes +retrieved: true (all except Trust Center) / false (Trust Center) +tag: publisher + +## DPA (VERBATIM) +[Sec 3.1 Roles] Baseten = "Processor"; Customer = "Controller, or as a Processor on behalf of its own controllers". +[Sec 12 + Schedule 1 Sec 3.3 SCCs] "the Parties shall comply with the SCCs incorporated by reference as set forth in Schedule 1"; Module Two (C2P) or Module Three (P2P) per role. +[Sec 7.1 Sub-processors] named list at trust.baseten.co with "at least fifteen (15) days prior to engaging a new Sub-Processor"; "Baseten will ensure each Sub-Processor is bound by a written agreement." +[Sec 7.2 Objection] Customer may object within 10 days via privacy@baseten.co. +[Sec 5.3 Confidentiality re personal data] personnel "subject to written confidentiality obligations." + +## Security (VERBATIM) +[ZDR DEFAULT - security-practices] "Unless a customer, acting through an authorized representative, requests otherwise in writing, ZDR is the default configuration for the customer's use of the inference products." (This is where ZDR-default lives - NOT the Terms.) +[Model APIs ZDR] "Baseten will not store, retain, or otherwise make a persistent copy of model inputs or outputs during a customer's use of the Model APIs." +[No-train] "Baseten does not use Customer Content for model training, fine-tuning, or improvement of any algorithms." +[Encryption] in transit "TLS v.1.2 or higher"; at rest "AES-256 bit encryption." +[MFA] "Baseten enforces multi-factor authentication for all personnel." +[Pen-test] "Baseten engages qualified third-party security firms for periodic penetration testing." Bug bounty: not found. +[Isolation - CORRECTION] page describes LOGICAL separation ("access controls, unique customer identifiers, and namespace isolation") + "single-tenant dedicated clusters and self-hosted deployment options within the customer's own VPC." NOT an explicit "three-tier" model. Correct any "three-tier isolation" claim to: logical namespace isolation + single-tenant dedicated + self-hosted VPC. Docs add per-customer K8s namespaces, Calico/Cilium, "GPUs never shared across users," self-hosted control/workload plane split. +[Compliance claimed on retrievable pages] SOC 2 Type II, HIPAA, GDPR. ISO 27001 / PCI DSS / FedRAMP / CSA STAR: NOT FOUND on any retrievable Baseten page. + +## Trust Center - retrieved:false +trust.baseten.co is a Vanta portal, JS-gated; every path (root + /subprocessors) returned only meta description + security@baseten.co. NO cert names/dates/scope; ISO 27001, PCI DSS, FedRAMP, CSA STAR CANNOT be confirmed. The named infra sub-processor list is behind this gate and unverifiable. Only marketing vendors are publicly named (Privacy Policy: Google Analytics, Segment, Sendgrid, Stripe) - these are NOT inference infra. + +## SLA (VERBATIM) - committed number EXISTS +[Sec 2.0] "ninety-nine point nine percent (99.9%)" committed uptime - applies to BOTH Dedicated Inference and Model APIs on Baseten-managed infrastructure. +[Sec 1.5 def] "System Availability = (Total Monthly Time - Unscheduled Downtime) / (Total Monthly Time)", measured against status.baseten.co. +[Sec 4.2 credits cap] "The maximum amount of Service Credits ... in a single calendar month will not exceed forty percent (40%)." +[Sec 4.3] claim within 24 hours with evidence. [Sec 1.4] standard exclusions (customer non-compliance, third-party failures, force majeure, inadequate GPU reservation, network failures). +Enterprise plan offers "Custom SLAs." + +## Status +status.baseten.co: "All Systems Operational"; 6 components (Dedicated Inference, Model APIs, Training, Model Management API, Web Application, Homepage and Docs). 90-day history, no numeric % on face. Incidents: 2026-09-20 Kimi K3 US endpoint outage (restored 01:13 PDT); 2026-09-14 India cluster elevated errors + Kimi K3 non-US partial (resolved same day); 2026-09-09 Nemotron Ultra partial (Dedicated Inference unaffected, resolved 10:49 PDT). + +## Pricing / lock-in +Model APIs per-token (e.g. GLM-class ~$0.15 in / $0.50 out /1M). Dedicated Inference pay-per-minute (T4 ~$0.01052/min to B200 ~$0.16633/min) - SELF-SERVE today (Deploy buttons, Basic/Pro tiers). Self-hosted = Enterprise-gated (NOT self-serve), offers "Full control over data residency." Truss = open-source packaging standard (open-model portability). OpenAI-compatible API not mentioned on pricing page (not confirmed there). dedicated_availability = self_serve (dedicated compute); self-hosted/VPC = enterprise_only. diff --git a/docs/primary-sources/baseten/browser-verified/terms__2026-09-20.md b/docs/primary-sources/baseten/browser-verified/terms__2026-09-20.md new file mode 100644 index 0000000..32c9554 --- /dev/null +++ b/docs/primary-sources/baseten/browser-verified/terms__2026-09-20.md @@ -0,0 +1,34 @@ +doc_type: terms +entity: baseten +source_url: https://www.baseten.co/terms-and-conditions/ +document_effective_date: not shown on page (Terms); DPA dated 2026-09-15 +retrieval_date: 2026-09-20 +exists: yes +retrieved: true +tag: publisher + +## Governing clauses (VERBATIM; Section 11 confirmed on TWO independent fetches) + +[Sec 2.5 ZDR - CONDITIONAL, not default in the Terms] "Where the Services or a product are designated as operating under a 'Zero Data Retention' posture in the Security Practices, Baseten will not log, record, or save Customer Content contained in inference inputs or outputs to persistent storage after real-time processing, subject to the limited exceptions described in the Security Practices." +NOTE: the DEFAULT lives in the Security Practices page (incorporated by reference), NOT the Terms body. Correction to any "ZDR default per the Terms" claim. + +[Sec 6.3 No training - VERBATIM] "Baseten will not use Customer Content, including Customer Models, Model Outputs, or inference logs, to train, fine-tune, or otherwise develop machine learning or artificial intelligence models." + +[Sec 6.1 Customer IP/ownership - VERBATIM] "Customer reserves all rights, title, and interest in and to Customer Content, including all intellectual property rights therein." (Baseten reserves rights to the Services + related IP.) + +[Sec 11.1 Confidentiality definition - VERBATIM] "'Confidential Information' means all confidential information disclosed by a party ('Disclosing Party') to the other ('Receiving Party'), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential. Customer's Confidential Information includes Customer Content and Customer Models. Baseten's Confidential Information includes the Services and the Documentation. Each party's Confidential Information includes the terms of this Agreement and all Order Forms. Confidential Information excludes information that (a) is or becomes publicly available without breach; (b) was known to the Receiving Party prior to disclosure; (c) is received from a third party without restriction; or (d) was independently developed without use of the Confidential Information." + +[Sec 11.2 Protection - VERBATIM] "The Receiving Party shall (a) protect Confidential Information with the same degree of care it uses for its own (but no less than reasonable care); (b) not use Confidential Information for any purpose outside this Agreement; and (c) limit access to those employees, contractors, and agents who need it for purposes consistent with this Agreement." + +[Sec 11.4 Survival - VERBATIM] "The obligations in this Section 11 shall survive for three (3) years following termination or expiration of this Agreement; provided that obligations with respect to information that constitutes a trade secret under applicable law shall survive for so long as such information remains a trade secret." + +[Sec 7.4 30-day export - VERBATIM] "During the Term and for a period of thirty (30) days thereafter, Customer may export Customer Content via the Services." + +[Sec 12.8 Governing law - VERBATIM] "This Agreement shall be governed by the laws of the State of California, without regard to conflict of laws rules..." + +[Sec 9.1 Liability cap - VERBATIM] "aggregate liability arising out of this Agreement shall not exceed the Total amount paid or payable by Customer in the 12 months preceding the First Event giving rise to the Claim." + +[Sec 4.5 Access/screen right - violation-triggered only] "If Baseten reasonably believes that any Customer Content, Customer Model, or Third-Party Product violates applicable law, the terms hereunder, or rights of a third party, Customer will promptly remove such content ... Baseten reserves the right to directly step in and take appropriate action..." (This is a violation-triggered takedown, NOT general content monitoring.) + +## DECISIVE FINDING (confidentiality = MUTUAL) - CONFIRMED +Section 11 is genuinely MUTUAL: symmetric by construction (generic Disclosing/Receiving Party), names Customer Content + Customer Models as Customer's Confidential Information AND Services + Documentation as Baseten's, single shared standard of care (Sec 11.2 "same degree of care it uses for its own (but no less than reasonable care)"), and survives 3 years / trade secrets indefinitely (Sec 11.4). This is a legitimately strong, differentiating finding for the index - NOT one-directional. confidentiality = mutual. diff --git a/docs/primary-sources/fireworks-ai/_sources.md b/docs/primary-sources/fireworks-ai/_sources.md new file mode 100644 index 0000000..d60e66f --- /dev/null +++ b/docs/primary-sources/fireworks-ai/_sources.md @@ -0,0 +1,32 @@ +# fireworks-ai - primary-source clauses + +**CORRECTED 2026-09-21** after an independent Cowork browser verification pass - see +[`browser-verified/`](browser-verified/) for the full capture and +[`RESEARCH-RETURN__fireworks-ai__2026-09-20.md`](browser-verified/RESEARCH-RETURN__fireworks-ai__2026-09-20.md) +for the field-by-field findings. The prior version of this file (2026-09-20) claimed the Terms of +Service and DPA had been downloaded and parsed as PDFs; an independent real browser session could +not reproduce that - both pages are page-level noindexed and return ROBOTS_DISALLOWED. That claim +is not necessarily false (a non-robots-respecting fetch could reach content a browser cannot), but +it is not independently verified, and `inference-providers/fireworks-ai/entry.yaml` has been +corrected accordingly (confidentiality: functional_only -> unknown; subprocessors_disclosed: +true -> false; trains_on_inputs: never -> opt_in_only). + +## _sources.md +``` +doc_type | url | exists | retrieved | notes +terms | https://fireworks.ai/terms-of-service | yes | NO | UNCONFIRMED. Page-level noindexed, ROBOTS_DISALLOWED to a real browser (both with/without trailing slash). A prior claim of having downloaded/parsed this as a PDF is not independently verified. ZDR clause, confidentiality direction NOT established from this pass. +privacy | https://fireworks.ai/privacy-policy | yes | yes | Independently browser-read. Verbatim no-training-without-opt-in + no-log-for-open-models statements. Substitute grounding for the training claim (see trains_on_inputs). +docs | https://docs.fireworks.ai/guides/security_compliance/data_handling | yes | yes | Independently browser-read, verbatim. Response API default-on storage, 30-day auto-delete, store=false opt-out, DELETE by response_id. +dpa | https://fireworks.ai/dpa | yes | NO | UNCONFIRMED. Noindexed, not in sitemap, ROBOTS_DISALLOWED; also JS-gated via Trust Center. Sub-processor Schedule (incl. the Anthropic claim) NOT established from this pass. +security | https://docs.fireworks.ai/guides/security_compliance/data_security | yes | yes | Independently browser-read, verbatim. TLS1.2+/AES-256, logical isolation, least-privilege, pen testing, CMEK. +security | https://docs.fireworks.ai/faq/enterprise/compliance/certifications | yes | yes | "SOC 2 Type II" + "HIPAA Certified"; no ISO, no dates, no auditor. +marketing | https://fireworks.ai/blog/fireworks-ai-achieves-soc-2-type-ii-and-hipaa-compliance | yes | yes | Published 2023-10-27; auditor unnamed; no audit period. +marketing | https://fireworks.ai/blog/fireworks-triple-iso-certification-enterprise-trust | yes | yes | Published 2025-11-19; ISO 27001/27701/42001; auditor unnamed; no dates. +security | https://trust.fireworks.ai/ (+ /subprocessors) | yes | no | Fully JS-gated SafeBase; only title/meta render. No dated SOC2 report, no ISO certs, no sub-processor list visible. +docs | https://docs.fireworks.ai/serverless/pricing | yes | yes | Per-token rates, batch 50% discount, US-only-serverless 1.5x premium. +docs | https://docs.fireworks.ai/guides/ondemand-deployments | yes | yes | Self-serve dedicated GPU deployments (GPU-second billing); region-pinning gated to sales quota. +marketing | https://fireworks.ai/blog/virtual-cloud | yes | yes | BYOC/Virtual Cloud, GA 2025-06-16, enterprise-negotiated. +sla | https://status.fireworks.ai/ | yes | yes | Per-endpoint 90-day uptime ~99.67-100% (28 components); no SLA/credit clause found in standard Terms. +docs | https://fireworks.ai/models | yes | yes | Live model catalogue. +docs | https://docs.fireworks.ai/tools-sdks/openai-compatibility | yes | YES (upgraded) | Independently browser-confirmed: base URL api.fireworks.ai/inference/v1, Chat Completions + Completions. CORRECTION: a prior claim of a Responses API with MCP support was NOT found on this page and has been removed. +``` diff --git a/docs/primary-sources/fireworks-ai/browser-verified/RESEARCH-RETURN__fireworks-ai__2026-09-20.md b/docs/primary-sources/fireworks-ai/browser-verified/RESEARCH-RETURN__fireworks-ai__2026-09-20.md new file mode 100644 index 0000000..9a2db09 --- /dev/null +++ b/docs/primary-sources/fireworks-ai/browser-verified/RESEARCH-RETURN__fireworks-ai__2026-09-20.md @@ -0,0 +1,39 @@ +# Research return: fireworks-ai (FULL grounding pass) - 2026-09-20 + +## Headline: the two most load-bearing contractual documents could NOT be browser-read +The Fireworks Terms of Service and DPA are page-level NOINDEXED (ROBOTS_DISALLOWED) and the Trust Center is fully JS-gated. A real browser pass therefore CANNOT ground the ToS ZDR/no-train clause, the confidentiality-clause direction, or the DPA sub-processor list (incl. the Anthropic claim). These must be treated as retrieved:false / code-session-PDF-only, not browser-verified. This is a correction to the draft, which implied these were read. + +## Decisive questions - CONFIRM / CORRECT +1. ToS ZDR + no-train clause? -> CANNOT CONFIRM from ToS (retrieved:false, noindexed). SUBSTANCE confirmed via Privacy Policy verbatim ("We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt-in") but NOT as a numbered ToS clause. +2. Response API retention exception? -> CONFIRMED (docs, verbatim): store=True default, 30-day auto-delete, store=False opt-out, DELETE endpoint by response_id; all other services ZDR. +3. Confidentiality clause direction? -> CANNOT DETERMINE (ToS unreadable). Do NOT classify functional_only/explicit/mutual on browser evidence. +4. DPA names Anthropic as AI-services sub-processor? -> CANNOT CONFIRM (DPA + Trust Center unreadable). Naming unverified. +5. Trust Center dated SOC2 Type II + ISO certs? -> NO - fully JS-gated. Compliance stays publisher/blog-grade (SOC2 Type II + HIPAA blog 2023-10-27; ISO 27001/27701/42001 blog 2025-11-19; no auditor/dates). No compliance upgrade. + +## Field-by-field (browser-grounded only) +| Field | Value | Grounded? | +|-------|-------|-----------| +| retention (default) | ZDR posture for all non-Response-API services (docs); Response API stores by default 30 days unless store=false | docs (publisher) | +| training-on-inputs | never without explicit opt-in (Privacy Policy verbatim) | privacy (publisher); NOT ToS | +| confidentiality | UNDETERMINED - ToS unreadable | NOT grounded | +| sub-processors (Anthropic) | UNDETERMINED - DPA unreadable | NOT grounded | +| compliance | SOC2 Type II + HIPAA + ISO 27001/27701/42001 - blog/publisher only, no auditor/dates, Trust Center JS-gated | publisher only | +| encryption | TLS1.2+/AES-256 | docs | +| isolation | logical isolation of dedicated workloads; CMEK available | docs | +| pen-test | yes (periodic); bug bounty not found | docs | +| SLA | no committed % / credits found; status page live uptimes only | status only | +| OpenAI-compat | api.fireworks.ai/inference/v1; chat+completions | docs | +| dedicated_availability | self_serve (dedicated GPU-second); airgapped/EKS separate/enterprise | docs | +| pricing | published per-token + per-GPU-second | pricing | + +## _sources.md row changes to apply +- terms -> retrieved:false (noindex; browser cannot read) - flag confidentiality + ZDR-clause as code-session-PDF-only +- dpa -> retrieved:false (noindex/JS) - Anthropic sub-processor NOT browser-confirmed +- privacy -> retrieved:true (no-train opt-in substitute) +- security docs (data_security, data_handling, certifications) -> retrieved:true +- Response API exception -> retrieved:true (docs) +- trust.fireworks.ai -> retrieved:false (JS-gated) +- status/pricing/openai-compat/ondemand -> retrieved:true + +## RE-DO +Obtain a rendered ToS + DPA PDF or authenticated Trust Center access to close Q1/Q3/Q4 and to move compliance beyond publisher-grade. diff --git a/docs/primary-sources/fireworks-ai/browser-verified/_sources.md b/docs/primary-sources/fireworks-ai/browser-verified/_sources.md new file mode 100644 index 0000000..e053960 --- /dev/null +++ b/docs/primary-sources/fireworks-ai/browser-verified/_sources.md @@ -0,0 +1,14 @@ +doc_type | source_url | retrieval_date | exists | retrieved | notes +terms | https://fireworks.ai/terms-of-service | 2026-09-20 | yes | false | Page-level noindex; WebFetch ROBOTS_DISALLOWED (with and without trailing slash). "Last Updated July 10, 2026" per search title. NO clause text readable in a browser pass. Code session's ToS PDF is the only path. +privacy | https://fireworks.ai/privacy-policy | 2026-09-20 | yes | true | Rendered. Verbatim no-training + ZDR opt-in statements; no sub-processor list; lastmod 2026-08-11. publisher. +dpa | https://fireworks.ai/dpa | 2026-09-20 | yes | false | Noindexed, not in sitemap, ROBOTS_DISALLOWED; also JS-gated via Trust Center. Roles/SCCs/sub-processors NOT readable. Anthropic sub-processor NOT confirmed. +security | https://docs.fireworks.ai/guides/security_compliance/data_security | 2026-09-20 | yes | true | TLS1.2+/AES-256, logical tenant isolation, least-privilege, pen testing, HIPAA. publisher. +security | https://docs.fireworks.ai/guides/security_compliance/data_handling | 2026-09-20 | yes | true | ZDR default; Response API exception (store=True default, 30-day auto-delete, store=False opt-out, DELETE endpoint). publisher. +security | https://docs.fireworks.ai/faq/enterprise/compliance/certifications | 2026-09-20 | yes | true | "SOC 2 Type II" + "HIPAA Certified"; NO ISO, NO dates, NO auditor. publisher. +security | https://fireworks.ai/blog/fireworks-ai-achieves-soc-2-type-ii-and-hipaa-compliance | 2026-09-20 | yes | true | Published 2023-10-27; auditor unnamed; no audit period. publisher. +security | https://fireworks.ai/blog/fireworks-triple-iso-certification-enterprise-trust | 2026-09-20 | yes | true | Published 2025-11-19; ISO 27001/27701/42001; auditor unnamed; no dates. publisher. +security | https://trust.fireworks.ai/ (+ /subprocessors, DPA resource) | 2026-09-20 | yes | false | Fully JS-gated SafeBase; only title/meta render. NO dated SOC2 report, NO ISO certs, NO sub-processor list visible. +sla | https://status.fireworks.ai/ | 2026-09-20 | yes | true(status)/false(SLA terms) | Live per-component uptimes (mostly 100%; lowest Kimi K3 99.67%). No committed % or credit terms. No formal SLA doc located. +docs | https://docs.fireworks.ai/tools-sdks/openai-compatibility | 2026-09-20 | yes | true | Base URL api.fireworks.ai/inference/v1; chat completions + completions. +docs | https://docs.fireworks.ai/guides/ondemand-deployments | 2026-09-20 | yes | true | Dedicated deployments self-serve (GPU-second billing); no on-prem in this doc (separate airgapped/EKS doc exists). +pricing | https://fireworks.ai/pricing | 2026-09-20 | yes | true | Per-token + per-GPU-second published; enterprise "Contact us". diff --git a/docs/primary-sources/fireworks-ai/browser-verified/security-sla-pricing__2026-09-20.md b/docs/primary-sources/fireworks-ai/browser-verified/security-sla-pricing__2026-09-20.md new file mode 100644 index 0000000..83d1b45 --- /dev/null +++ b/docs/primary-sources/fireworks-ai/browser-verified/security-sla-pricing__2026-09-20.md @@ -0,0 +1,39 @@ +doc_type: security (+ sla, docs, pricing) +entity: fireworks-ai +source_url: docs.fireworks.ai (data_security, data_handling, certifications, openai-compatibility, ondemand-deployments) ; fireworks.ai/blog ; status.fireworks.ai ; fireworks.ai/pricing +document_effective_date: various 2023-2026 +retrieval_date: 2026-09-20 +exists: yes +retrieved: true (docs/status/pricing) / false (Trust Center) +tag: publisher + +## Security (docs, VERBATIM) +[Encryption] "Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)." +[Tenant isolation] "Dedicated workloads run in logically isolated environments, preventing cross-customer access or data leakage." +[Access control] "Fine-grained access controls are enforced across all Fireworks environments, following the principle of least privilege." ; "All customer data access is logged, monitored, and protected against tampering." +[Pen testing] "Regular penetration testing validates controls." Bug bounty: NOT mentioned (not found). +[HIPAA] "Fireworks is HIPAA compliant and supports healthcare and life sciences organizations..." +[CMEK] Customer-Managed Encryption Keys docs page exists (capability present). + +## Response API retention EXCEPTION (docs, VERBATIM) - decisive Q2 CONFIRMED +Source: docs.fireworks.ai/guides/security_compliance/data_handling +[Default store] "The Response API operates under a different retention model when `store=True` (the default setting)." +[Auto-delete] "Stored conversation data automatically deletes after 30 days." +[Opt-out] "Users can prevent storage by setting `store=False` in API requests." +[Immediate delete] "The DELETE API endpoint enables immediate removal of specific records by providing the `response_id`." +[Scope] "The Response API retention policy only applies to conversation data when using the Response API endpoints. All other Fireworks services follow the zero data retention policy described above." +So the Response API default-retention exception is REAL and documented (in docs, not a readable ToS section). ZDR is the posture for all other services per the same docs page. + +## Compliance claims (publisher-grade; NO auditor/dates) +- Docs certifications FAQ: "SOC 2 Type II" + "HIPAA Certified" (no ISO, no dates, no auditor). +- Blog 2023-10-27: "the Fireworks.ai inference platform is both SOC 2 Type II and HIPAA compliant"; "validated by a third-party" (auditor NOT named, period NOT stated). +- Blog 2025-11-19: ISO 27001, ISO 27701, ISO 42001 (certification body NOT named, dates NOT stated). +- Trust Center trust.fireworks.ai: FULLY JS-gated - no dated SOC2 report or ISO certs render (retrieved:false). Compliance therefore stays publisher/blog-grade, NOT independently-dated-certificate grade. No compliance-dimension upgrade justified from this pass. + +## SLA / status +status.fireworks.ai (rendered): "We're fully operational," 28 serverless components, mostly "100% uptime"; lowest shown "Kimi K3 at 99.67% uptime." No incidents listed. NO committed uptime %, NO service-credit terms on the page; no formal SLA doc located. (reliability: no committed SLA number found.) + +## Docs / pricing / lock-in +[Base URL] "https://api.fireworks.ai/inference/v1"; OpenAI-compatible Chat Completions + Completions (embeddings not confirmed on that page; NO Responses API/MCP documented there). +[Deployment] On-demand/dedicated deployments SELF-SERVE today (CLI + API, GPU-second billing); enterprise sales for higher quota/regions; no on-prem in the on-demand doc (separate airgapped/EKS doc exists). dedicated_availability = self_serve (dedicated); on-prem/airgapped = enterprise/separate. +[Pricing] serverless per-token (embeddings $0.008-$0.1 /1M input; $1 free credit); training $0.50-$40.00 /1M tokens; on-demand per-GPU-second (H100 80GB $0.134/min ~$8/hr; GB300 288GB $0.334/min ~$20/hr); enterprise "Contact us." diff --git a/docs/primary-sources/fireworks-ai/browser-verified/terms-dpa__2026-09-20.md b/docs/primary-sources/fireworks-ai/browser-verified/terms-dpa__2026-09-20.md new file mode 100644 index 0000000..6e020c8 --- /dev/null +++ b/docs/primary-sources/fireworks-ai/browser-verified/terms-dpa__2026-09-20.md @@ -0,0 +1,24 @@ +doc_type: terms (+ dpa) +entity: fireworks-ai +source_url: https://fireworks.ai/terms-of-service ; https://fireworks.ai/dpa ; substitute https://fireworks.ai/privacy-policy +document_effective_date: ToS "Last Updated July 10, 2026" (per search title; not independently rendered); Privacy Policy lastmod 2026-08-11 +retrieval_date: 2026-09-20 +exists: yes +retrieved: false (Terms + DPA) / true (Privacy Policy substitute) +tag: publisher + +## MATERIAL LIMITATION (load-bearing - correction to the draft) +The Fireworks Terms of Service AND Data Processing Addendum are page-level NOINDEXED and returned ROBOTS_DISALLOWED to a real browser pass (both with and without trailing slash); the Trust Center that also hosts the DPA is fully JS-gated. Therefore the TERMS and DPA substantive text could NOT be read this pass. This means the three most contractually load-bearing Fireworks items remain retrieved:false and MUST NOT be asserted from a browser read: +- ToS-level Zero-Data-Retention / no-train CLAUSE (section number + wording) - NOT established. +- The Confidential Information clause direction (one-directional vs mutual vs covers customer data) - NOT established; do NOT classify confidentiality (functional_only/explicit/mutual) on current browser evidence. +- The DPA sub-processor Schedule, incl. whether Anthropic is named as an "AI services" sub-processor - NOT confirmed. AWS/GCP/OCI/Anthropic naming is unverified by this pass. +The code session previously claimed to have downloaded and parsed the ToS + DPA as PDFs; if those PDFs are genuine, they are the ONLY grounding for these items - a browser session cannot reach them. Flag them as code-session-PDF-only, not browser-verified. + +## Privacy Policy - substitute evidence (retrieved:true, VERBATIM) +[No-training] "We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt-in." +[No-log for open models] "We do not log or store prompt or generation data for any open models without explicit user opt-in." +[Security caveat] "Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee 'perfect security.'" +NOTE: these are Privacy Policy statements, NOT section-numbered ToS clauses. They confirm the SUBSTANCE of no-training-without-opt-in, but do not establish a ToS ZDR clause, the confidentiality direction, or the sub-processor list. + +## RE-DO +Render the ToS + DPA (a rendered/downloaded PDF or authenticated Trust Center access) to capture: ZDR clause + section number, confidentiality clause direction, DPA roles/SCCs, and the named sub-processor Schedule (confirm/deny Anthropic). diff --git a/docs/primary-sources/nebius/_sources.md b/docs/primary-sources/nebius/_sources.md new file mode 100644 index 0000000..ff8affe --- /dev/null +++ b/docs/primary-sources/nebius/_sources.md @@ -0,0 +1,29 @@ +# nebius - primary-source clauses + +**CORRECTED 2026-09-21** after an independent Cowork browser verification pass - see +[`browser-verified/`](browser-verified/) for the full capture and +[`RESEARCH-RETURN__nebius__2026-09-20.md`](browser-verified/RESEARCH-RETURN__nebius__2026-09-20.md) +for the field-by-field findings. **The single most important row is `ev-tos`**: the binding Terms +of Service (Sec 7) directly contradicts the marketing-adjacent Legal Quick Guide (`ev-quickguide`) +on whether customer content trains Nebius' own models - this was independently CONFIRMED VERBATIM +on re-read, and the entry's central finding stands. Three overstatements were corrected downward +(EU-region count, a claimed inference SLA, and a "dedicated-only" catalogue claim), and compliance +was strengthened (a named SOC 2 auditor). + +## _sources.md +``` +doc_type | url | exists | retrieved | notes +terms | https://docs.tokenfactory.nebius.com/legal/terms-of-service | yes | yes | CONFIRMED VERBATIM on independent re-read. Sec 7: trains on Inputs/Outputs BY DEFAULT for Speculative Decoding, opt-out required; reserves right to delete Inputs/Outputs without notice; Sec 10 customer ownership. +docs | https://docs.tokenfactory.nebius.com/legal/legal-quick-guide | yes | yes | CONFIRMS the contradiction with ev-tos: "we do not use your content to train...any AI models"; ZDR is an account-level opt-in. +terms | https://docs.nebius.com/legal/agreement | yes | yes | Master Services Agreement Sec 7.11 (usage-improvement) and Sec 18 (general confidentiality, does not name Customer Content). +dpa | https://docs.nebius.com/legal/dpa | yes | yes | Processor confidentiality duty scoped to Customer Personal Data; region-pinning for dedicated/AI Cloud, "may vary" for shared endpoints. +subprocessors | https://docs.nebius.com/legal/sub-processors_tofa | yes | yes | CORRECTED (count): ~21 named entities (page summary said 18; a prior draft said ~24) incl. Nebius Inc. (US); 15-day advance notice. +security | https://nebius.com/blog/posts/soc-2-type-ii-hipaa-iso-27001-enterprise-security-standards | yes | yes | STRENGTHENED: SOC 2 Type II audited by a NAMED firm - Deloitte; ISO 27001 scope explicitly names "AI Studio" (Token Factory). Independently re-read from the exact post (a prior draft only had a search-derived summary). +docs | https://docs.nebius.com/overview/regions | yes | yes | CORRECTED: only TWO public self-serve EU regions - Finland (eu-north1), France (eu-west1). Spain (eu-south1) and Iceland (eu-north2) are PRIVATE/existing-deployment-only, not public. A prior draft counted all four as public. +sla | https://docs.nebius.com/legal/sla | yes | yes | CORRECTED (downward): delegates entirely to per-service sub-pages; no number in the master doc itself. +sla | https://docs.nebius.com/legal/sla-levels | yes | yes | NEW FINDING: lists exactly SEVEN services, NONE of them inference/Token Factory/AI Studio. There is NO committed inference SLA - the 99.9% figure is marketing-only. A prior draft claimed a real contractual SLA existed; this was an overstatement. +sla | https://status.nebius.com/ | yes | YES (upgraded) | Independently browser-read: dedicated "Token Factory" component (Operational); 7 regions; 3 incidents Sep 9-17 2026, all resolved. A prior draft had this as search-corroborated only. +docs | https://tokenfactory.nebius.com/models/catalog | yes | yes | CORRECTED: a prior claim that several flagship models showed "Public endpoint: Not available" (dedicated-only) is NOT supported on re-check - those specific versions are simply superseded by newer catalogue entries (ordinary churn). Open models confirmed publicly served per-token. +docs | https://docs.tokenfactory.nebius.com/ai-models-inference/dedicated-endpoints/billing-policy | yes | yes | PAYG-per-replica; underlying $/GPU-hour rate not disclosed. +docs | https://nebius.com/services/token-factory | yes | yes | Product page, OpenAI-compatible API framing. +``` diff --git a/docs/primary-sources/nebius/browser-verified/RESEARCH-RETURN__nebius__2026-09-20.md b/docs/primary-sources/nebius/browser-verified/RESEARCH-RETURN__nebius__2026-09-20.md new file mode 100644 index 0000000..5c6b0d0 --- /dev/null +++ b/docs/primary-sources/nebius/browser-verified/RESEARCH-RETURN__nebius__2026-09-20.md @@ -0,0 +1,38 @@ +# Research return: nebius / Token Factory (FULL grounding pass) - 2026-09-20 + +Confirmed reading the INFERENCE product (Token Factory, formerly AI Studio) governing docs on docs.tokenfactory.nebius.com (which 302-redirects legal pages to docs.nebius.com/legal/...), NOT the raw-GPU-cloud terms. + +## Decisive questions - CONFIRM / CORRECT +1. Train-by-default + opt-out (the whole entry turns on this)? -> CONFIRMED VERBATIM. ToS Sec 7: "the Company collects and processes both Input and Output data for the purpose of training smaller Models used exclusively for Speculative Decoding," opt-out required ("If you prefer that we (i) do not store ... and (ii) do not collect and process them for Speculative Decoding, You may opt out at any time"). training-on-inputs = by_default (opt-out). The draft's central finding SURVIVES an independent human-grade read. The current grade (65.2, C) stands and is now actually grounded. +2. Legal Quick Guide vs ToS? -> GENUINE TENSION (confirmed). Quick Guide Sec 4.2 "Your content is not used to train any models in either mode" and FAQ "we do not use your content to train ... any AI models" contradict ToS Sec 7's "training smaller Models." Reconciled only by Nebius treating Speculative Decoding as non-"training." Binding doc (ToS Sec 7) governs; flag the Quick Guide as a documented inconsistency (bears on transparency). +3. DPA confidentiality scope? -> CONFIRMED: DPA Sec 2.5 attaches the duty to "Customer Personal Data" ONLY, not Customer Content generally. (ToS Sec 18 has a separate general Confidential-Information duty.) +4. Regions self-serve vs private? -> CORRECTED. Only eu-north1 (Finland) + eu-west1 (France) are PUBLIC self-serve EU. eu-south1 (Spain) and eu-north2 (Iceland) are PRIVATE/existing-deployment-only. Remove Spain + Iceland from the self-serve EU claim. +5. Committed inference SLA %? -> CONFIRMED ABSENT. sla-levels lists 7 services, none inference/Token Factory. 99.9% is marketing-only. No committed inference SLA. +6. Flagship catalogue public vs dedicated-only? -> "dedicated-only / no public price" NOT supported. Open models are publicly served per-token; the three named versions (Kimi-K2-Instruct, Llama-3.3-70B-Instruct, GLM-4.5) are largely superseded on the live catalogue, not gated. Authoritative price page auth-gated (retrieved:false) - verify a specific number there. + +## Field-by-field +| Field | Value | Grounded | +|-------|-------|----------| +| training-on-inputs | BY DEFAULT (Speculative-Decoding model training), opt-out required | ToS Sec 7 (verbatim) | +| retention | inputs/outputs kept unless ZDR enabled (no fixed period in Sec 7) | ToS Sec 7 / Quick Guide | +| ZDR | available (opt-out), stops storage + Speculative Decoding + training | Quick Guide 4.1 | +| customer IP | customer owns content EXCEPT Sec 7/12/13/13A carve-out | ToS Sec 10 | +| confidentiality | ToS Sec 18 general duty (both parties); DPA duty = Customer Personal Data only | ToS/DPA | +| governing law / liability | Netherlands; liability greater of 12-mo fees or $500 | ToS Sec 16/17-19 | +| sub-processors | ~21 named (recount); incl. third-party GPU providers RunPod/BoostRun/Shadeform/Argentum/Axe (routing/residency relevance) | subprocessors page | +| residency | public self-serve EU = Finland + France only; Spain + Iceland private | regions page | +| compliance | SOC2 Type II (Deloitte) incl HIPAA; ISO 27001 scope incl AI Studio; report NDA-gated, no public dates | blog/trust (publisher + named auditor) | +| SLA | NO committed inference % (99.9% marketing-only) | sla-levels | +| status | Token Factory component Operational; incidents Sep 9-17 | status | +| pricing | open models publicly served per-token; auth-gated authoritative list | partial | + +## Corrections to the draft +1. Regions: only Finland + France public self-serve EU (Spain + Iceland are private). +2. Sub-processor count ~21, not ~24 (recount from live page). +3. No committed inference SLA % - do not cite 99.9%. +4. Flagship models are publicly served per-token / superseded, not dedicated-endpoint-only. +5. Quick Guide vs ToS Sec 7 = documented inconsistency (transparency). +CONFIRMED (grade-critical): train-by-default via ToS Sec 7 - the entry's central finding is real. + +## RE-DO +Authenticated read of tokenfactory.nebius.com/organization/prices for exact live per-token rates; exact sub-processor recount; confirm ToS governing-law section number. diff --git a/docs/primary-sources/nebius/browser-verified/_sources.md b/docs/primary-sources/nebius/browser-verified/_sources.md new file mode 100644 index 0000000..b9acd34 --- /dev/null +++ b/docs/primary-sources/nebius/browser-verified/_sources.md @@ -0,0 +1,11 @@ +doc_type | source_url | retrieval_date | exists | retrieved | notes +terms | https://docs.tokenfactory.nebius.com/legal/terms-of-service | 2026-09-20 | yes | true | Token Factory (inference) ToS. Sec 7 DATA USAGE: collects+processes Input+Output BY DEFAULT to train Speculative-Decoding models, opt-out required. Sec 10 IP (customer owns, except Sec 7/12/13/13A). Sec 18 confidentiality. Sec 16 liability (greater of 12-mo fees or $500). Governing law Netherlands (Sec # 17 vs 19 uncertain). publisher. +legal_quick_guide | https://docs.tokenfactory.nebius.com/legal/legal-quick-guide | 2026-09-20 | yes | true | Marketing-facing. Sec 4.2 "not used to train any models in either mode"; FAQ "we do not use your content to train ... any AI models". IN TENSION with ToS Sec 7. publisher. +dpa | https://docs.nebius.com/legal/dpa | 2026-09-20 | yes | true | Token Factory DPA redirects here. Sec 2.5 confidentiality duty attaches to "Customer Personal Data" ONLY. Sec 4 sub-processors. Sec 8.3 governing law -> ToS Sec 17. publisher. +subprocessors | https://docs.nebius.com/legal/sub-processors_tofa | 2026-09-20 | yes | true | Effective 2026-09-15. ~21 named entities enumerated (page summary said 18; list rendered 21 - recount recommended). publisher. +regions | https://docs.nebius.com/overview/regions | 2026-09-20 | yes | true | PUBLIC self-serve EU: eu-north1 (Finland), eu-west1 (France). PRIVATE/existing-deployment-only: eu-north2 (Iceland), eu-south1 (Madrid, Spain). CORRECTS draft's "four public EU regions". publisher. +sla | https://docs.nebius.com/legal/sla | 2026-09-20 | yes | true | Master SLA sets no number; delegates to sla-levels. publisher. +sla | https://docs.nebius.com/legal/sla-levels | 2026-09-20 | yes | true | Exactly 7 services (compute/k8s/mlflow/postgresql/storage/standalone-apps/vpc). NO inference/Token Factory/AI Studio sub-page. 99.9% is marketing-only. publisher. +security | https://nebius.com/blog/posts/soc-2-type-ii-hipaa-iso-27001-enterprise-security-standards | 2026-09-20 | yes | true | Announced 2025-10-14. SOC 2 Type II by Deloitte (incl HIPAA); ISO 27001 scope "Nebius AI Cloud, AI Studio and TractoAI". SOC2 report NDA-gated; no public dates. publisher. +status | https://status.nebius.com/ | 2026-09-20 | yes | true | All operational; dedicated "Token Factory" component (Operational); 7 regions; 90-day history, no numeric %. Incidents Sep 9-17 2026. publisher. +pricing | https://tokenfactory.nebius.com/organization/prices | 2026-09-20 | yes | false | Authoritative price list auth-gated. Public per-token serving of open models exists (e.g. Llama-3.3-70B $0.13/$0.40 via third-party calc); live catalogue rotated to newer versions. Named Kimi-K2-Instruct/Llama-3.3-70B/GLM-4.5 largely superseded. diff --git a/docs/primary-sources/nebius/browser-verified/dpa-subprocessors-regions__2026-09-20.md b/docs/primary-sources/nebius/browser-verified/dpa-subprocessors-regions__2026-09-20.md new file mode 100644 index 0000000..b572441 --- /dev/null +++ b/docs/primary-sources/nebius/browser-verified/dpa-subprocessors-regions__2026-09-20.md @@ -0,0 +1,27 @@ +doc_type: dpa (+ subprocessors, regions) +entity: nebius +source_url: https://docs.nebius.com/legal/dpa ; https://docs.nebius.com/legal/sub-processors_tofa ; https://docs.nebius.com/overview/regions +document_effective_date: sub-processors effective 2026-09-15 +retrieval_date: 2026-09-20 +exists: yes +retrieved: true +tag: publisher + +## DPA (VERBATIM) - Q3 confidentiality scope CONFIRMED +[Sec 2.5 - VERBATIM] "Nebius shall ensure that any person that it authorizes to process Customer Personal Data (including Nebius' staff, agents and subcontractors) ('Authorized Person') shall be subject to a strict duty of confidentiality" and "shall not permit any person to process Customer Personal Data who is not under such a duty of confidentiality." +=> The DPA confidentiality duty attaches to "Customer Personal Data" ONLY, not Customer Content generally. (General Confidential Information is covered separately in ToS Sec 18.) confidentiality scope: DPA = personal data only. +[Sec 4.1 Sub-processors] Nebius maintains written agreements imposing "data protection obligations no less protective than those set forth in this DPA." +[Sec 8.3 Governing law] points to ToS Section 17. + +## Sub-processors (list - ~21 named; recount recommended) +Effective 2026-09-15. Header: "This page identifies the sub-processors engaged by Nebius to process Customer..." +Nebius Group entities: Nebius Inc. (US, cloud infra); Nebius B.V. (France/Iceland/Finland/UK, cloud infra); Nebius Israel Ltd.; Nebius DC Oy (Finland, ops); Nebius UK Ltd.; Nebius CZ s.r.o. (Czech, ops); Nebius GmbH (Germany, ops); Nebius AI Spain S.L.U.; Nebius France SAS; Tech Hub IL Ltd. (Israel, ops); EdTech Plus Tech d.o.o. Beograd (Serbia, ops). +Third-party infra/compute: RunPod Inc. (Iceland); BoostRun, LLC (US); Shadeform, Inc. (US); Argentum AI, Inc. (US); Axe Compute Inc. (Canada). +Third-party SaaS/support: Microsoft Corporation - Sentinel (EU, security monitoring); Functional Software Inc. - Sentry (US, APM); Hubspot Inc. (EU); Atlassian Pty Ltd. - Jira (EU); Slack Technologies LLC (EU). +NOTE: enumerated ~21; page summary line said "18"; draft said "~24". Count is APPROXIMATE - recommend an exact recount from the live page. NOTE the third-party compute sub-processors (RunPod, BoostRun, Shadeform, Argentum, Axe Compute) - relevant to model-routing/residency, i.e. inference may run on third-party GPU providers. + +## Regions (Q4) - CORRECTION to the draft +Source: docs.nebius.com/overview/regions +PUBLIC / self-serve ("available to all Nebius users"): eu-north1 (Finland), eu-west1 (France), me-west1 (Israel), us-central1 (Kansas City, US), uk-south1 (UK), uk-south2 (UK). +PRIVATE / limited ("available only to the users who already have deployments there"): eu-north2 (Iceland), eu-south1 (Madrid, Spain), eu-west2 (France), us-north1 (Woodbury, MN, US). +=> Draft's "four EU public regions (Finland, France, Spain, Iceland)" is WRONG for two: Spain (eu-south1) and Iceland (eu-north2) are PRIVATE/existing-deployment-only, NOT self-serve. Only Finland + France are public self-serve EU regions. Correct the residency field accordingly. diff --git a/docs/primary-sources/nebius/browser-verified/security-sla-status__2026-09-20.md b/docs/primary-sources/nebius/browser-verified/security-sla-status__2026-09-20.md new file mode 100644 index 0000000..53cdf31 --- /dev/null +++ b/docs/primary-sources/nebius/browser-verified/security-sla-status__2026-09-20.md @@ -0,0 +1,25 @@ +doc_type: security (+ sla, status, pricing) +entity: nebius +source_url: nebius.com/blog SOC2 post + nebius.com/trust-center ; docs.nebius.com/legal/sla + /sla-levels ; status.nebius.com ; tokenfactory.nebius.com prices +document_effective_date: SOC2 post announced 2025-10-14 +retrieval_date: 2026-09-20 +exists: yes +retrieved: true (security/sla/status) / false (authoritative price list) +tag: publisher + +## Security / compliance (VERBATIM) +[SOC 2 Type II auditor] "Deloitte, an accredited third-party firm that evaluates the design and operational effectiveness of our measures to protect customer data." +[HIPAA] "SOC 2 Type II also includes a section that confirms compliance with the Health Insurance Portability and Accountability Act (HIPAA)." +[ISO 27001 scope - VERBATIM] "Spanning Nebius AI Cloud, AI Studio and TractoAI..." - confirms AI Studio (= Token Factory) is in the ISO 27001 scope. +NOTE: the SOC 2 Type II report itself requires an NDA to access; no public audit dates/validity window disclosed. Compliance is publisher-grade + named auditor (Deloitte), NOT an independently-dated public certificate. + +## SLA (Q5) - CONFIRMED: NO committed inference SLA number +[Master SLA - VERBATIM] "The list of Services which provides Service Levels and links for Service Levels for specific Service are available at: https://docs.nebius.com/legal/sla-levels" and "Service Level and amount of Compensation is determined for each Service separately." No number in the master doc; no mention of inference/Token Factory/AI Studio. +[sla-levels index] lists EXACTLY 7 services: Compute Cloud, Managed Service for Kubernetes, Managed Service for MLflow, Managed Service for PostgreSQL, Object Storage, Standalone Applications, Virtual Private Cloud. NO inference / Token Factory / AI Studio sub-page exists. +=> Any 99.9% figure is MARKETING-COPY ONLY and is NOT backed by a binding SLA sub-page. Do NOT attribute a committed uptime to Token Factory inference. reliability: no committed inference SLA. + +## Status +status.nebius.com: has a dedicated "Token Factory" component (current status "Operational") - no separate "Inference"/"AI Studio" component. Regions covered: EU-NORTH1, EU-NORTH2, EU-WEST1, EU-WEST2, UK-SOUTH1, US-CENTRAL1, ME-WEST1. "Uptime over the past 90 days" shown, no numeric % on the main view. Incidents Sep 9-17 2026 (compute partial, eu-west1 metrics, us-central1 Object Storage 5xx, eu-north1 SkyPilot 503, VM creation) - all resolved. + +## Pricing / catalogue (Q6) - MIXED; "dedicated-only" claim NOT supported +Authoritative price list tokenfactory.nebius.com/organization/prices is AUTH-GATED (retrieved:false). Evidence from readable sources: open models ARE publicly served per-token (data point: Llama-3.3-70B-Instruct $0.13/1M in, $0.40/1M out, standard public rate, no "dedicated" qualifier). The live catalogue has ROTATED to newer versions (e.g. Kimi-K2.7-Code $0.95/$4.00; GLM-5.x). The specifically named Kimi-K2-Instruct, Llama-3.3-70B-Instruct, GLM-4.5 do NOT appear in the current live list - they read as SUPERSEDED/rotated out, not "hidden as dedicated-only." So the draft's "dedicated-endpoint-only, no public price" framing is NOT supported; evidence favours public per-token serving, but the exact three named versions are largely off the current self-serve catalogue. Verify against the authenticated prices page before asserting a specific number. diff --git a/docs/primary-sources/nebius/browser-verified/terms-and-quickguide__2026-09-20.md b/docs/primary-sources/nebius/browser-verified/terms-and-quickguide__2026-09-20.md new file mode 100644 index 0000000..8d0a158 --- /dev/null +++ b/docs/primary-sources/nebius/browser-verified/terms-and-quickguide__2026-09-20.md @@ -0,0 +1,30 @@ +doc_type: terms (+ legal_quick_guide) +entity: nebius +source_url: https://docs.tokenfactory.nebius.com/legal/terms-of-service ; https://docs.tokenfactory.nebius.com/legal/legal-quick-guide +document_effective_date: not shown +retrieval_date: 2026-09-20 +exists: yes +retrieved: true +tag: publisher + +## THE LOAD-BEARING FINDING - Token Factory ToS Section 7 (DATA USAGE AND STORAGE) - CONFIRMED VERBATIM +[License grant] "By using the Service, You grant Us a license to access, use, host, cache, store, copy, and modify Inputs and Outputs for the purposes of providing the Service." +[Default collection + TRAINING - VERBATIM] "As part of providing the Service, the Company collects and processes both Input and Output data for the purpose of training smaller Models used exclusively for Speculative Decoding." +[Opt-out required - VERBATIM] "If you prefer that we (i) do not store Your Inputs and Outputs for the purposes of providing the Service and (ii) do not collect and process them for Speculative Decoding, You may opt out at any time." (mechanism: onboarding form or email tokenfactory-support@nebius.com.) +Sec 7 contains NO explicit retention duration. +=> The binding ToS states Nebius COLLECTS AND PROCESSES Input+Output BY DEFAULT to TRAIN its own "smaller Models used exclusively for Speculative Decoding," and the customer must OPT OUT. training-on-inputs = by_default (opt-out). This is the most consequential fact in the entry and it holds up verbatim. + +## Other ToS clauses (VERBATIM) +[Sec 10 IP / ownership] "You hold exclusive ownership of all rights, titles, and interests (including intellectual property rights) to Customer's Content." AND "We do not claim any rights to Customer's Content, except as described in Sections 7, 12, 13 and 13A." (The Sec 7 data-use carve-out is an explicit EXCEPTION to customer ownership.) +[Sec 18 Confidentiality] "Each Party agrees to maintain the confidentiality of all Confidential Information disclosed by the other Party." (General confidential-info duty in the ToS; the DPA's duty is narrower - personal data only, see dpa file.) +[Governing law] Netherlands law (ToS body returned "the laws of the Netherlands"; DPA cross-references "Section 17 of the Terms of Service" - section number 17 vs 19 uncertain, treat Netherlands as the law). +[Sec 16 Liability - VERBATIM] "OUR TOTAL LIABILITY UNDER THESE TERMS WILL BE LIMITED TO THE GREATER OF EITHER THE AMOUNT YOU PAID FOR THE SERVICE THAT CAUSED THE CLAIM WITHIN THE 12 MONTHS PRECEDING THE INCIDENT OR FIVE HUNDRED DOLLARS ($500)." + +## Legal Quick Guide - the CONTRADICTION (Q2) - documented tension, not a clean disclosure +[Sec 4.2 Default Behavior - VERBATIM] "Your content is not used to train any models in either mode." +[FAQ - VERBATIM] "No. We do not use your content to train, fine-tune or improve any AI models - ours or third parties'." +[Sec 4.1 ZDR - VERBATIM] "with ZDR enabled, your data is not used for Speculative Decoding and is not used to train, fine-tune or improve any model - whether ours or a third party's." +[Retention purpose - VERBATIM] "unless you enable Zero Data Retention, we keep your inputs and outputs to speed up inference using the Speculative Decoding technique." +[Sec 3.2 role] "for the content you submit to our model inference and fine-tuning endpoints ... and the output you receive, we act as the Data Processor under our DPA." + +RECONCILIATION: The Quick Guide treats "Speculative Decoding" as data RETENTION FOR INFERENCE SPEED-UP and asserts it does NOT constitute "training," while the binding ToS Sec 7 literally calls the same activity "training smaller Models." The marketing-facing blanket ("we do not use your content to train any AI models") is in GENUINE TENSION with the binding ToS Sec 7. The only reconciling move is Nebius carving Speculative-Decoding models out of the category "AI models." Net: the Quick Guide is more customer-favourable than, and semantically inconsistent with, the binding ToS Sec 7. For the entry, the BINDING document (ToS Sec 7) governs: train-by-default with opt-out. Flag the Quick Guide as a documented inconsistency. diff --git a/docs/primary-sources/together-ai/_sources.md b/docs/primary-sources/together-ai/_sources.md index d7bb2ac..f7b463e 100644 --- a/docs/primary-sources/together-ai/_sources.md +++ b/docs/primary-sources/together-ai/_sources.md @@ -1,7 +1,14 @@ # together-ai - primary-source clauses -**SCAFFOLD - no clause files gathered here yet.** This manifest is the outstanding-document -checklist for the Cowork/browser gather pass (see +**UPDATE 2026-09-21:** this manifest predates the confidentiality-disclaimed finding and the +independent Cowork verification pass - see [`browser-verified/`](browser-verified/) for the +current, re-verified capture. Superseded row: line 14 below claimed "ZDR by default"; this is +corrected - ZDR is account-level opt-in (Privacy Policy Sec 2.6, independently re-read verbatim +2026-09-21). The DPA sub-processor list (line 18's "OUTSTANDING ~33 names") is now confirmed: +Annex III names 9 entities, including OpenAI OpCo LLC (see `browser-verified/terms-privacy-dpa__2026-09-20.md`). + +**SCAFFOLD - no clause files gathered here yet [as of the original pass].** This manifest was +the outstanding-document checklist for the Cowork/browser gather pass (see [`../../provider-primary-doc-handover.md`](../../provider-primary-doc-handover.md), Together AI section). Rows marked `retrieved: no` still need the verbatim governing text pasted into a `____.md` file here. Rows marked `retrieved: yes` are already @@ -11,11 +18,11 @@ grounded in `inference-providers/together-ai/entry.yaml`. ``` doc_type | url | exists | retrieved | notes terms | https://www.together.ai/terms-of-service | yes | yes | ev7 - "you exclusively own all right, title and interest in Your Content and Output"; no training without explicit opt-in -privacy_policy | https://www.together.ai/privacy | yes | yes | ev1 - ZDR by default -dpa | https://cdn.prod.website-files.com/…/Together%20DPA%20(Website).pdf | yes | yes | ev9 - EU SCCs + UK Addendum +privacy_policy | https://www.together.ai/privacy | yes | yes | ev1 - CORRECTED 2026-09-21: ZDR is account-level OPT-IN (Sec 2.6, independently re-read verbatim), NOT "by default" as this row previously said. +dpa | https://cdn.prod.website-files.com/…/Together%20DPA%20(Website).pdf | yes | yes | ev9 - EU SCCs + UK Addendum. Annex III now confirmed: 9 named sub-processors incl. OpenAI OpCo LLC (see browser-verified/). docs | https://docs.together.ai/docs/privacy-and-security | yes | yes | ev2 - security docs docs | https://support.together.ai/articles/8079447813-eu-data-centers… | yes | yes | ev4 - EU data centers / dedicated deployment -subprocessors | https://trust.together.ai/ | yes | no | NO evidence item yet - OUTSTANDING. Capture the ~33 named sub-processors + regions (US/CA/RO/EU/Global). Note especially the AI sub-processors (Anthropic, OpenAI, Perplexity, OpenRouter) - inference can route to third-party model APIs, a real residency/ownership finding -marketing | https://www.together.ai/pricing | yes | no | ev5 - pricing page -security | (SOC 2 Type II report itself) | no | no | only the announcement blog (ev3) is public; the report itself is not - record exists:no for the report. ZDR separately confirmed +subprocessors | https://trust.together.ai/ | yes | no | JS-gated, unreadable (confirmed again 2026-09-21). The DPA's own Annex III (9 names, not ~33) is the actually-confirmed sub-processor source - see dpa row above. +marketing | https://www.together.ai/pricing | yes | yes | ev5 - pricing page (re-verified live 2026-09-20/21) +security | (SOC 2 Type II report itself) | no | no | only the announcement blog (ev3, confirmed 2025-07-08, auditor unnamed) is public; the report itself is not. ``` diff --git a/docs/primary-sources/together-ai/browser-verified/RESEARCH-RETURN__together-ai__2026-09-20.md b/docs/primary-sources/together-ai/browser-verified/RESEARCH-RETURN__together-ai__2026-09-20.md new file mode 100644 index 0000000..de88ab7 --- /dev/null +++ b/docs/primary-sources/together-ai/browser-verified/RESEARCH-RETURN__together-ai__2026-09-20.md @@ -0,0 +1,30 @@ +# Research return: together-ai (FULL re-verification) - 2026-09-20 + +## Decisive questions - CONFIRM / CORRECT +1. Sec 9 confidentiality still expressly disclaimed? -> CONFIRMED UNCHANGED. Sec 9 (titled "Confidentiality"), current ToS Updated 2026-05-19, verbatim x2: "The parties will have no confidentiality obligations to each other unless otherwise agreed in writing." confidentiality = disclaimed; the data-governance cap at 3 remains justified. (Also captured: retention not-stored only if ZDR enabled/opt-in; training only with explicit opt-in; customer owns content+output; California law; 12-mo liability cap.) +2. No embedding models via serverless? -> CONFIRMED REAL (not a rendering artefact). Serverless-models page verbatim: "There are currently no embedding models offered via serverless." Rerank + moderation also absent (rerank dedicated-only). The prior-entry reversal is verified. +3. Mistral/Mixtral absent from serverless? -> CONFIRMED absent from serverless; present ONLY under fine-tuning (Mixtral 8x7B Instruct v0.1, supervised FT ~$1.05). Fine-tuning-only. + +## Field-by-field +| Field | Value | Grounded | +|-------|-------|----------| +| confidentiality | DISCLAIMED (Sec 9, verbatim x2) - caps data-governance at 3 | terms | +| retention | not stored only if ZDR enabled (opt-in); else standard processing | terms Sec 3 / privacy 2.6 | +| training-on-inputs | only with explicit opt-in (never by default) | privacy 2.2 | +| customer IP | customer owns content + output (Sec 7) | terms | +| dpa / sub-processors | DPA = linked PDF (legal/dpa 404s); Annex III names AWS, Mailgun, Amplitude, Sentry, OpenAI, Together Software, Hotjar, Intercom, Absorb | dpa PDF | +| compliance | SOC 2 Type 2 (blog 2025-07-08), HIPAA, ISO 27001:2022 referenced; report contact/NDA-gated; trust center JS-gated | publisher; trust:false | +| SLA | no public committed SLA (enterprise-contract only); status all-online | status; sla:false | +| catalogue | NO serverless embeddings/rerank/moderation; NO Mistral/Mixtral in serverless (FT-only) | docs (verbatim x2) | +| pricing | serverless per-token published; dedicated single-tenant + on-demand GPU hourly; largest-scale "contact us" | pricing | +| governing law / liability | California; 12-mo cap (Sec 13) | terms | + +## URL corrections for the entry +- together.ai/legal/dpa -> 404; DPA lives at the cdn.prod.website-files.com "Together DPA (Website).pdf" link. +- together.ai/security -> 404 (moved); use the SOC2 blog + trust.together.ai (JS-gated). + +## Net +No governance reversal: confidentiality:disclaimed holds (cap at 3). The catalogue changes (no serverless embeddings/rerank; Mistral/Mixtral FT-only) are verified real. Transparency: Terms + Privacy published and legible (read directly); DPA is a findable PDF; trust center content not machine-readable. + +## RE-DO +Authenticated/JS render of trust.together.ai for dated SOC2/ISO artefacts; DPA effective date is not visible on the PDF. diff --git a/docs/primary-sources/together-ai/browser-verified/_sources.md b/docs/primary-sources/together-ai/browser-verified/_sources.md new file mode 100644 index 0000000..28c223f --- /dev/null +++ b/docs/primary-sources/together-ai/browser-verified/_sources.md @@ -0,0 +1,11 @@ +doc_type | source_url | retrieval_date | exists | retrieved | notes +terms | https://www.together.ai/terms-of-service | 2026-09-20 | yes | true | Updated 2026-05-19. Sec 9 confidentiality EXPRESSLY DISCLAIMED (confirmed x2). Sec 3 ZDR (opt-in). Sec 7 IP (customer owns content+output). Sec 13 liability (12-mo cap). California law. publisher. +privacy | https://www.together.ai/privacy | 2026-09-20 | yes | true | Last Updated 2025-12-17. Training only with explicit opt-in (Sec 2.2). Retention Sec 2.4. ZDR Sec 2.6. publisher. +dpa | https://cdn.prod.website-files.com/5ce11396d0cadb55a02cabf7/696024ff5649fb30b125686c_Together%20DPA%20(Website).pdf | 2026-09-20 | yes | true | DPA is a linked PDF (together.ai/legal/dpa 404s). SCCs + UK Addendum. Annex III sub-processor list (9 named, incl. OpenAI). No effective date visible. +security | https://www.together.ai/blog/soc-2-compliance | 2026-09-20 | yes | true | Published 2025-07-08. SOC 2 Type 2 completed; HIPAA adherence; ISO 27001:2022 referenced. SOC2 report contact/NDA-gated. publisher. +security | https://trust.together.ai/ | 2026-09-20 | yes | false | SPA/JS-gated; body not extractable (only meta keywords). No dated certs readable. +security | https://www.together.ai/security | 2026-09-20 | no | false | 404 (page moved). +sla | (none public) | 2026-09-20 | enterprise-only | false | No public self-serve SLA doc; SLA/uptime commitments appear enterprise-contract only. +status | https://status.together.ai/ | 2026-09-20 | yes | true | "All services online" (Sep 18 2026); per-model uptimes (Llama-3.3-70B-Turbo 100%, gpt-oss-120b 99.462%, DeepSeek-V4-Pro 99.647%). No SLA statement. +pricing | https://www.together.ai/pricing | 2026-09-20 | yes | true | Serverless per-token + dedicated/GPU hourly. No embedding models. Mixtral only under fine-tuning. +docs | https://docs.together.ai/docs/serverless-models | 2026-09-20 | yes | true | NO serverless embeddings/rerank/moderation; NO Mistral/Mixtral in serverless catalogue (confirmed x2). diff --git a/docs/primary-sources/together-ai/browser-verified/security-catalogue__2026-09-20.md b/docs/primary-sources/together-ai/browser-verified/security-catalogue__2026-09-20.md new file mode 100644 index 0000000..8c80a52 --- /dev/null +++ b/docs/primary-sources/together-ai/browser-verified/security-catalogue__2026-09-20.md @@ -0,0 +1,26 @@ +doc_type: security (+ sla, status, pricing, catalogue) +entity: together-ai +source_url: together.ai/blog/soc-2-compliance ; trust.together.ai ; status.together.ai ; together.ai/pricing ; docs.together.ai/docs/serverless-models +document_effective_date: SOC2 blog 2025-07-08 +retrieval_date: 2026-09-20 +exists: yes +retrieved: true (blog/status/pricing/catalogue) / false (trust center, public SLA) +tag: publisher + +## Security / compliance +[SOC 2 - blog VERBATIM] "Together AI has successfully completed a SOC 2 Type 2 examination." +[HIPAA - blog VERBATIM] "Together AI adheres to the stringent requirements of HIPAA, including data encryption in transit and at rest, audit logging, and strict business associate agreements." +[ISO 27001] blog references a related "ISO 27001:2022 certification" article. +SOC 2 report obtain method: "contact us" (effectively contact/NDA-gated - consistent with prior entry). Trust center trust.together.ai EXISTS but is a JS/SPA - body NOT extractable (only meta keywords). retrieved:false for cert content. together.ai/security = 404 (moved). Compliance is publisher/blog-grade; no independently dated public certificate readable. + +## SLA / status +No public self-serve SLA document found; SLA/uptime commitments appear enterprise-contract only (reserved/provisioned-throughput). status.together.ai: "All services are online" (Sep 18 2026 16:50 UTC). Monitored components (Website, Playground, Inference-Vision/Chat/Images/Voice) with per-model uptimes (e.g. Llama-3.3-70B-Instruct-Turbo 100%, gpt-oss-120b 99.462%, DeepSeek-V4-Pro-0813 99.647%). NO SLA statement on the status page. reliability: public status good; no public committed SLA. + +## Pricing / catalogue - the DECISIVE reversals (Q2, Q3) CONFIRMED +[Q2 - no serverless embeddings - CONFIRMED, real not artefact] docs.together.ai/docs/serverless-models Embedding section VERBATIM: "There are currently no embedding models offered via serverless." Confirmed twice. Rerank likewise VERBATIM: "There are currently no rerank models offered via serverless. Rerank models like `mixedbread-ai/mxbai-rerank-large-v2` are only available with dedicated model inference." Moderation likewise absent. Pricing page also lists no embedding models. The prior-entry reversal is REAL - embeddings/rerank are dedicated-only now. +[Q3 - Mistral/Mixtral absent from serverless - CONFIRMED] Full-text search of the serverless models page returns ZERO occurrences of "Mistral" or "Mixtral." Live serverless chat list contains only Thinking Machines, MiniMax, Qwen, Moonshot/Kimi, Z.ai/GLM, OpenAI gpt-oss, DeepSeek, Meta Llama, Prism-ML, Muse - NO Mistral family. Mixtral appears ONLY on the pricing page under FINE-TUNING ("Mixtral 8x7B Instruct v0.1", supervised FT ~$1.05). So Mistral/Mixtral = fine-tuning-only, correctly absent from the serverless catalogue. +[Serverless per-token rates - representative, cross-validated vs status component list] MiniMax M3 $0.30 in / $1.20 out; DeepSeek V4 Pro 0813 $1.32 / $3.96; Gemma 4 31B $0.39 / $0.97; GLM-5.3-Flash $0.15 / $0.50 (per 1M tokens). +[Dedicated / GPU] "Single-tenant GPU instances" (Dedicated Inference); GPU Clusters "On-demand Pay as you go GPU capacity on an hourly basis" (e.g. NVIDIA HGX H100 ~$3.99-5.49/hr); premium/large-scale = "Contact us" (NOT fully self-serve). Serverless token inference IS self-serve today. dedicated_availability = self_serve (serverless + on-demand GPU); largest-scale enterprise-negotiated. + +## Lock-in / portability +OpenAI-compatible serverless API; open-weight models served (Llama, Qwen, DeepSeek, GLM, gpt-oss) - portable. Exit: standard API, no unusual lock-in noted. diff --git a/docs/primary-sources/together-ai/browser-verified/terms-privacy-dpa__2026-09-20.md b/docs/primary-sources/together-ai/browser-verified/terms-privacy-dpa__2026-09-20.md new file mode 100644 index 0000000..264a233 --- /dev/null +++ b/docs/primary-sources/together-ai/browser-verified/terms-privacy-dpa__2026-09-20.md @@ -0,0 +1,32 @@ +doc_type: terms (+ privacy, dpa, subprocessors) +entity: together-ai +source_url: https://www.together.ai/terms-of-service ; https://www.together.ai/privacy ; Together DPA (Website).pdf +document_effective_date: ToS Updated 2026-05-19; Privacy Last Updated 2025-12-17 +retrieval_date: 2026-09-20 +exists: yes +retrieved: true +tag: publisher + +## THE CAP-SETTING FINDING - Sec 9 Confidentiality (Q1) - CONFIRMED UNCHANGED (VERBATIM x2) +[Sec 9 "Confidentiality" - VERBATIM] "The parties will have no confidentiality obligations to each other unless otherwise agreed in writing." +Section title is literally "Confidentiality." Still present, still expressly DISCLAIMS. Confirmed identical on two independent live fetches of the current (Updated 2026-05-19) ToS. It has NOT moved or been reworded. +=> confidentiality = disclaimed. This CAPS the data-governance dimension at 3 regardless of retention/training terms. The cap remains justified. + +## Other ToS clauses (VERBATIM) +[Sec 3 "Your Content" - retention/training] "Under ZDR, your data and outputs are not stored, retained, or used for model training, product improvements, or any other purpose beyond the time required to process the specific request or transaction." (ZDR applies only when the customer ENABLES Zero Data Retention - i.e. opt-in.) +[Sec 7 IP - ownership] "As between you and Company, you exclusively own all right, title, and interest in Your Content and Output." ; "You grant Company a limited license to access, host, use, copy, and otherwise operate Your Content and Output solely as necessary to provide the Services." +[Governing law] "This Agreement will be governed by the laws of the State of California ..." (sub-section number uncertain between fetches; California law reliable). +[Sec 13 Liability] "Either party will not be liable ... for (a) any indirect, special, incidental, consequential, or punitive damages ... or (b) any aggregate liability in excess of the amounts paid by customer during the twelve (12) months preceding the claim." + +## Privacy Policy (VERBATIM) +[Training - opt-in, default OFF] "We do not use any data collected from you to train our models without your explicit opt-in and consent. You may revoke that consent at any time and request deletion..." (Sec 2.2: "... will not be used to train the Company's models without your explicit opt-in and consent.") +[Retention Sec 2.4] "The Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Policy." +[ZDR Sec 2.6] "By choosing 'No', you are enabling Zero Data Retention ('ZDR') ... the content you submit ... are not stored, retained, or used for model training, product improvements, or any secondary purposes except as needed to provide the Services to you." + +## DPA + sub-processors +DPA is a linked PDF (together.ai/legal/dpa 404s; PDF at cdn.prod.website-files.com/.../Together DPA (Website).pdf). Incorporates EU SCCs + UK Addendum + GDPR/UK GDPR. No effective/execution date visible. +[Conflict clause] "In case of any conflict between this Addendum and the Master Agreement, this Addendum shall prevail with regard to the Processing of Personal Data covered by it." +[Annex III sub-processors - named] Amazon Web Services (US); Mailgun Technologies (US); Amplitude (US); Functional Software/Sentry (US); OpenAI OpCo, LLC (US); Together Software Inc. (Canada); Hotjar Ltd (Malta); Intercom (US); Absorb Software (Canada/USA/UK/EU/Australia). NOTE: OpenAI named as a sub-processor. + +## Net data-governance posture +Retention: not stored ONLY if customer enables ZDR (opt-in); otherwise standard processing. Training: only with explicit opt-in (never by default). Ownership: customer owns content + output. BUT confidentiality expressly DISCLAIMED (Sec 9) => data_governance capped at 3. This is the entry's key ceiling and it is grounded verbatim. diff --git a/hosting-providers/hugging-face/entry.yaml b/hosting-providers/hugging-face/entry.yaml index e40700b..3342504 100644 --- a/hosting-providers/hugging-face/entry.yaml +++ b/hosting-providers/hugging-face/entry.yaml @@ -401,7 +401,9 @@ changelog: - date: '2026-07-25' change: Migrated to v2 four-domain library format (added documentation block; score carried over unchanged). -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification (Cowork browser session). Malware/pickle scanning still active and unchanged, verbatim: ClamAV runs on every uploaded file; every pickled file (pytorch_model.bin etc.) runs through Pickle Import scan, flagging suspicious imports, with the unchanged disclaimer that this is not 100% foolproof and packages are not actively audited for safety. safetensors remains documented as an "experiment," not declared the platform default. No HF-native signing/provenance-attestation feature confirmed (still commit-level GPG signing only; third parties like Cohere/Red Hat/sigstore push model signing, not HF itself). No new security incident or typosquatting campaign surfaced since ~Aug 2026 (the July 2026 intrusion predates this window and was already reflected). Hard flag does not apply. No score change.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/hosting-providers/llama-cpp-gguf/entry.yaml b/hosting-providers/llama-cpp-gguf/entry.yaml index 7ac9863..5e063e4 100644 --- a/hosting-providers/llama-cpp-gguf/entry.yaml +++ b/hosting-providers/llama-cpp-gguf/entry.yaml @@ -357,7 +357,9 @@ changelog: - date: '2026-07-25' change: 'Migrated to v2 four-domain library format (added documentation block; score carried over unchanged).' -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. New in-window finding: CVE-2026-52131 (CVSS 7.5, published 2026-09-01) - a reachable assertion in gguf_reader::read, triggerable via a crafted GGUF file (DoS). This extends, but does not change the character of, the existing GGUF-parser memory-safety CVE cluster already reflected in this entry''s C rationale (oss-sec 2026-05-15 multi-vulnerability advisory, CVE-2026-27940, GHSA-96jg-mvhq-q7q7). No format-spec revision; no code-exec-on-load / trust_remote_code surface - the risk profile stays memory-safety parser bugs, an unchanged category. No score change; the new CVE reinforces rather than moves the existing C rationale.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/hosting-providers/ollama/entry.yaml b/hosting-providers/ollama/entry.yaml index f9f626d..3a379c8 100644 --- a/hosting-providers/ollama/entry.yaml +++ b/hosting-providers/ollama/entry.yaml @@ -329,7 +329,9 @@ changelog: - date: '2026-07-25' change: Migrated to v2 four-domain library format (added documentation block; score carried over unchanged). -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. New in-window finding: CVE-2026-85180 (published 2026-09-03) - a tensor-blob-redirect SSRF, where an attacker-controlled registry can return a manifest whose blob request redirects to a private address including a cloud metadata endpoint; a separate code path from the earlier-patched non-tensor downloader. Offsetting positive, NOT yet shipped: GitHub PR #11573 implements OpenSSF Model Signing (ed25519 signatures, `ollama sign`/`ollama verify`, automatic verification during pull/push) - merge status/date unconfirmed, treated as proposed/in-progress. Ollama distributes GGUF, not pickle, so the pickle hard-flag does not apply on format grounds. No score change: the fresh SSRF advisory offsets the still-unmerged signing PR; revisit for a possible upgrade only once signed-pull verification lands in a stable release.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/inference-providers/baseten/README.md b/inference-providers/baseten/README.md new file mode 100644 index 0000000..da0d1ea --- /dev/null +++ b/inference-providers/baseten/README.md @@ -0,0 +1,54 @@ +# Baseten - OneHill Inference-Provider Dossier + +> **Score: computed by scripts/score.py** · HQ: United States · EU residency: no published managed region (self-hosted only) · Trains on inputs: never +> Last verified: 2026-09-21 +> +> _An independent Cowork browser pass (2026-09-21) confirmed the MUTUAL confidentiality clause on two separate fetches and found a real 99.9% SLA - but retracted an earlier ISO 27001 claim that turned out to have no basis anywhere._ + +**Hard flags:** none + +--- + +## 1. What it serves & how it's priced + +Baseten combines a curated serverless **Model Library** (DeepSeek V4.1 Flash, GLM-5.3, Kimi K3, +Llama 3.3 70B, Qwen3.5, Whisper, Flux.2, embeddings) with a bring-your-own-model deploy platform +on dedicated GPUs. Pricing is per-token for Model APIs and per-GPU-minute for dedicated +deployments, both published directly. + +## 2. Data governance - where your prompts go + +Zero Data Retention is the default for Model APIs and Dedicated Inference (per the Security +Practices page); Async Inference queues inputs for 72 hours. Terms & Conditions bar training on +Customer Content and impose a MUTUAL confidentiality duty over it - independently confirmed on +two separate live fetches. + +## 3. Compliance & certifications + +SOC 2 Type II (named audit firm), HIPAA, and a GDPR DPA are all confirmed directly. **Correction:** +a prior ISO 27001 claim is retracted - no trace of it was found anywhere; PCI/FedRAMP/CSA STAR +claims remain unconfirmed behind a fully JS-gated Trust Center portal. + +## 4. Residency & sovereignty + +No published, named EU region exists for the managed service; the practical EU-residency path is +the enterprise **Self-Hosted** tier (workload plane inside the customer's own VPC). + +## 5. Reliability & lock-in + +**Correction:** a real, committed SLA exists (99.9% uptime, credits capped at 40%, 24h claim +window) - a prior draft had located none. The status page confirms all systems operational with +three brief incidents in the current window, all resolved same/next-day. An +OpenAI/Anthropic-compatible API over an open-weight Model Library, with a documented 30-day +export window and deletion right. + +## 6. Sources & evidence + +See [`entry.yaml`](entry.yaml) for the full evidence list, and +[`docs/primary-sources/baseten/browser-verified/`](../../docs/primary-sources/baseten/browser-verified/) +for the independent Cowork verification pass this dossier is now grounded on. + +--- + +_Scored against [provider rubric v1.2](../../methodology/provider-scoring-rubric.md). +Data: [`entry.yaml`](entry.yaml)._ diff --git a/inference-providers/baseten/assess.md b/inference-providers/baseten/assess.md new file mode 100644 index 0000000..53c9853 --- /dev/null +++ b/inference-providers/baseten/assess.md @@ -0,0 +1,85 @@ +# Assess - Baseten + +_Should we route our data through this provider? Data governance, compliance, residency, +security, pricing, and reliability - plus the provider AOI score - live here._ + + +## Data governance - retention, ZDR & training + +Baseten's **security-practices page** (independently browser-confirmed, verbatim) states: **"ZDR +is the default configuration for the customer's use of the inference products"** for Model APIs +and Dedicated Inference - **Zero Data Retention is the default**, not an opt-in or +enterprise-gated feature. **Correction:** this default lives on the Security Practices page, not +the Terms directly - Terms Sec 2.5 merely honours whatever posture Security Practices designates. +The one exception is **Async Inference**, which queues inputs for up to **72 hours** before +deletion (outputs are never stored on that path either). Terms & Conditions Sec 6.3 bars Baseten +from using **Customer Content - including deployed model weights and outputs -** to train, +fine-tune, or otherwise develop its own models. + + +## Data & IP ownership + +Terms & Conditions Sec 6.1 (independently browser-confirmed): **"Customer reserves all rights, +title, and interest in and to Customer Content,"** a definition that includes deployed **Customer +Models** and **Model Outputs**. A **MUTUAL confidentiality clause** (Sec 11.1-11.2) - confirmed +on **two separate live fetches** - requires both parties to protect confidential information +**"with the same degree of care it uses for its own (but no less than reasonable care),"** +surviving **three years** after termination (trade secrets indefinitely, Sec 11.4) - a genuine, +independently-verified positive, stronger than several peers' one-directional or disclaimed +clauses. The sub-processor list (trust.baseten.co) exists with a 15-day pre-notification +commitment (DPA Sec 7.1), though its actual named contents remain unread - the portal is a +JS-gated Vanta page that returns only a meta description on every path tried. + + +## Residency & sovereignty + +No published, named **EU region** exists for the managed service. A **"regional environments"** +feature can route a deployment to a designated region, but the docs direct customers to **contact +support** to confirm availability - there is no self-serve, published region list. The practical +EU-residency path is **Baseten Self-Hosted**, which runs the entire workload plane inside the +customer's own VPC/cloud in any region, including the EU. + +**CLOUD Act disclosure:** Baseten is US-headquartered (San Francisco); standard US jurisdiction +applies to the managed service. + + +## Compliance & attestations + +**SOC 2 Type II** is confirmed, with a named audit firm (Sensiba San Filippo LLP) and a clean +opinion across Security/Availability/Processing Integrity/Confidentiality/Privacy criteria. +**HIPAA** and a **GDPR DPA** are both confirmed directly. **Correction:** a prior claim of **ISO +27001** certification is retracted - an independent browser pass found no trace of it anywhere, +not even self-attested; **ISO 27701**, **PCI DSS**, **FedRAMP**, and **CSA STAR** remain +unconfirmed - the Vanta Trust Center that would carry such certificates is fully JS-gated. + + +## Security controls + +**Correction (description, not substance):** independently browser-confirmed isolation is +logical namespace separation for shared use (access controls, unique customer identifiers) plus +**Dedicated** single-tenant Kubernetes namespaces with Calico/Cilium network policies ("Baseten +never shares GPUs across users") and **Self-Hosted** deployment inside the customer's own VPC - +not an explicit "three-tier" model as previously described, though the practical effect is +similar. Encryption is **TLS 1.2+** in transit and **AES-256** at rest; access is +**least-privilege with enforced MFA** for all personnel. Baseten states it engages qualified +third-party firms for **periodic penetration testing** (confirmed verbatim); no public +bug-bounty programme was found. + + +## Pricing & cost model + +Per-token pricing for hosted Model APIs and per-GPU-minute pricing for dedicated deployments are +both published directly on Baseten's pricing page, across Basic/Pro/Enterprise tiers. Example +rates: GLM-5.3 $1.40/$0.14-cached/$4.40 per 1M tokens; DeepSeek V4.1 Flash +$0.30/$0.03-cached/$1.20; dedicated GPU-minute rates from T4 $0.01052 up to H100 80GB $0.10833 +(~$6.50/hr). + + +## Reliability posture + +**Correction: a real, committed SLA exists** and was independently browser-read at +baseten.co/service-level-agreement - **"ninety-nine point nine percent (99.9%)"** committed +uptime for both Dedicated Inference and Model APIs, service credits capped at **40%** of monthly +fees, and a **24-hour claim window**. The public **status page** (status.baseten.co, +independently confirmed) shows all systems operational, with three brief incidents in the current +90-day window (Sep 9, 14, 20 2026), all resolved same-day or next-day. diff --git a/inference-providers/baseten/entry.yaml b/inference-providers/baseten/entry.yaml new file mode 100644 index 0000000..81f7c59 --- /dev/null +++ b/inference-providers/baseten/entry.yaml @@ -0,0 +1,616 @@ +# OneHill v2 INFERENCE-PROVIDER library entry for Baseten. +# Validated against schema/inference-provider.v2.schema.json. +# scores -> scripts/score.py --write (provider AOI) +# meters -> scripts/completeness.py --write (per-domain completeness/originality) +# prose -> assess.md / implement.md / use.md / support.md (sections keyed ) + +schema_version: '2.0' +id: baseten +name: Baseten +profile: inference +hq_country: United States +summary: 'A US-headquartered (San Francisco) inference platform combining a curated + serverless "Model Library" (Model APIs) with a bring-your-own-model deploy platform + on dedicated GPUs. A Cowork browser session (2026-09-21) independently confirmed, on + two separate live fetches, Baseten''s Zero Data Retention default (via the Security + Practices page), a contractual never-train clause, a MUTUAL confidentiality duty over + Customer Content (an unusually strong finding for this index), and a real, committed + 99.9% SLA with service credits. The same pass RETRACTED an earlier ISO 27001 claim - + no trace of it was found on any retrievable page, and the Vanta Trust Center that + would carry such a certificate is fully JS-gated. The biggest caveats are that Async + Inference queues inputs for up to 72 hours, PCI DSS/FedRAMP/CSA STAR status and the + named sub-processor list remain unverified behind that same JS-gated portal, and no + published, named EU region exists for the managed service - EU residency is only + available via the enterprise self-hosted tier. + + ' +models_served: +- DeepSeek V4.1 Flash (552B MoE, multimodal, 1M-token context) +- GLM-5 / GLM-5.3 / GLM-5.3 Fast +- Kimi K3 +- Llama 3.3 70B Instruct +- Qwen3.5 35B-A3B, Qwen3 TTS, Qwen3 8B Reranker/Embedding, Qwen Image +- Whisper Large V3 (transcription) +- Flux.2 [dev] (image generation) +- EmbeddingGemma, Nomic Embed Code, BGE Embedding ICL +- Plus a general bring-your-own/custom/fine-tuned-model deploy platform on dedicated + GPUs (not limited to the curated Model Library) +hardware: NVIDIA GPU +pricing: + model: mixed + notes: 'Per-token pricing for hosted Model APIs; per-GPU-minute pricing for dedicated + deployments. Read directly from Baseten''s own pricing page. Tiers: Basic + (pay-as-you-go), Pro (priority GPU access, volume discounts), Enterprise (custom + SLAs, self-host, volume discounts). + + ' + example_rates: + - 'GLM-5.3: $1.40/M in, $0.14/M cached-in, $4.40/M out' + - 'DeepSeek V4.1 Flash: $0.30/M in, $0.03/M cached-in, $1.20/M out' + - 'Kimi K3: $3.00/M in, $0.30/M cached-in, $15.00/M out' + - 'Dedicated GPU per minute: T4 16GB $0.01052, A100 80GB $0.06667, H100 80GB $0.10833 + (~$6.50/hr), B200 180GB $0.16633' +data_governance: + default_retention: 'CORRECTED 2026-09-21 (location, not substance): Zero Data Retention is the + default per the Security Practices page - "Unless a customer, acting through an authorized + representative, requests otherwise in writing, ZDR is the default configuration for the + customer''s use of the inference products" - which the Terms & Conditions Sec 2.5 merely + honours by reference ("Where the Services or a product are designated as operating under a + ''Zero Data Retention'' posture in the Security Practices, Baseten will not log, record, or + save Customer Content..."). A prior draft attributed the default to the Terms directly; the + default actually lives in the Security Practices page. Async Inference is the one exception - + inputs are queued for up to 72 hours before deletion, outputs are never stored.' + trains_on_inputs: never + zdr_available: yes_default + zdr_scope_caveats: 'ZDR is the default per the Security Practices page (independently + browser-confirmed verbatim, two fetches), incorporated by reference into Terms Sec 2.5 - not + an opt-in or enterprise-gated feature. The one carve-out is Async Inference''s 72-hour input + queue before deletion (outputs are never stored on that path either). + + ' + customer_data_ownership: customer_retains + outputs_used_to_improve_service: 'no' + third_party_routing_leakage: 'Serves an open-weight Model Library plus customer-supplied + models on Baseten''s own infrastructure; no closed third-party model routing identified. + + ' + subprocessors_disclosed: true + confidentiality: mutual + confidentiality_caveats: 'CONFIRMED 2026-09-21 by an independent Cowork browser session on TWO + separate live fetches of the Terms & Conditions: Sec 11.1 names Customer Content and Customer + Models as the Customer''s Confidential Information (symmetric with Baseten''s own); Sec 11.2 - + both parties must protect confidential information "with the same degree of care it uses for + its own (but no less than reasonable care)"; Sec 11.4 - obligations survive three years after + termination, and trade secrets survive indefinitely. This is independently verified as a + genuine mutual duty, not a one-directional clause - a legitimate, differentiating finding for + this index. Caveat: the sub-processor list (trust.baseten.co) exists and a 15-day + pre-notification commitment is documented (DPA Sec 7.1), but the list''s actual named + contents remain unread - the Trust Center is a JS-gated Vanta portal that returns only a meta + description on every path tried.' +compliance: + soc2: type_ii + iso_27001: unknown + iso_27701: unknown + hipaa_baa: "yes" + gdpr_dpa: "yes" + fedramp: '' + trust_center_url: https://trust.baseten.co/ +residency: + eu_region_available: unknown + regions: + - United States (managed default) + - '"Regional environments" exist as a feature (routing a deployment exclusively to a + designated geographic region), but no published list of available region names - + including whether an EU region is among them - was found; the docs direct customers + to "contact support to confirm availability for the region you need."' + sovereign_option: 'Baseten Self-Hosted runs the entire workload plane inside the + customer''s own VPC/cloud, in any region the customer chooses (including the EU) - + "inference I/O never touching Baseten''s premises." This is the practical EU-residency + path, not a named managed-region offering.' + region_pinning: unknown + cloud_act_exposure: true + provider_can_restrict_access: 'US-headquartered (San Francisco); standard US jurisdiction + (CLOUD Act, export controls) applies to the managed service.' +reliability: + sla: 'CORRECTED 2026-09-21: a real, committed SLA was found and independently browser-read at + baseten.co/service-level-agreement (a prior draft said none was located). Sec 2.0: "ninety-nine + point nine percent (99.9%)" committed uptime, applying to BOTH Dedicated Inference and Model + APIs on Baseten-managed infrastructure. Sec 4.2 caps monthly Service Credits at "forty percent + (40%)"; Sec 4.3 requires a claim within 24 hours with evidence. Enterprise plan offers "Custom + SLAs."' + uptime_notes: 'A public status page (status.baseten.co, independently browser-read) shows "All + Systems Operational" across 6 components (Dedicated Inference, Model APIs, Training, Model + Management API, Web Application, Homepage and Docs), measured against the SLA''s System + Availability definition (Sec 1.5). Three incidents in the current 90-day window, all + resolved same-day or next-day (see incidents below). + + ' + incidents: + - date: '2026-09-09' + summary: 'Nemotron Ultra partial degradation (Dedicated Inference unaffected); resolved + 10:49 PDT same day.' + - date: '2026-09-14' + summary: 'India cluster elevated errors plus a Kimi K3 non-US partial issue; resolved same + day.' + - date: '2026-09-20' + summary: 'Kimi K3 US endpoint outage; restored 01:13 PDT.' +lock_in: + openai_compatible_api: true + portability_notes: 'Hosted Model APIs support the OpenAI Chat Completions API and the + Anthropic Messages API (beta); the Model Library is predominantly open-weight, and custom + deploys use customer-authored Docker/Truss configs rather than a Baseten-proprietary format. + Terms & Conditions give a documented exit right: Customer Content may be exported for 30 + days after the Term ends, and Baseten will delete Customer Content on written request. + + ' +dedicated_availability: self_serve +dedicated_notes: 'A genuine three-tier deployment spectrum: shared serverless Model APIs + (self-serve, multi-tenant); Dedicated Deployments - single-tenant GPU clusters priced + per-minute directly on the public pricing page, no sales gate found for that tier + ("Baseten never shares GPUs across users," per-customer Kubernetes namespace); and Baseten + Self-Hosted - the full workload plane inside the customer''s own VPC, marketed toward the + Enterprise tier and effectively enterprise-negotiated. Coded self_serve for the + broadly-available Dedicated Deployments tier, with true self-hosted/air-gapped isolation + remaining an enterprise-only path.' +trust_considerations: +- 'CONFIRMED 2026-09-21 by an independent Cowork browser session, on TWO separate live fetches of + the Terms & Conditions: Zero Data Retention is the default for Model APIs and Dedicated + Inference (via the Security Practices page, incorporated by reference into Terms Sec 2.5 - + a location correction from a prior draft that cited the Terms directly), with a documented + never-train clause (Sec 6.3) covering Customer Content, Customer Models (deployed weights), + and Model Outputs alike - a strong, binding baseline, now independently verified.' +- Confidentiality is MUTUAL (Sec 11.1-11.2, same-care-as-own-information standard, surviving + three years post-termination, trade secrets indefinitely per Sec 11.4) - independently + confirmed on two separate fetches. A genuine positive, stronger than several peer providers' + one-directional or disclaimed clauses. +- Async Inference is the one retention exception (72-hour input queue before deletion; outputs + never stored). +- 'CORRECTION 2026-09-21: a prior ISO 27001 claim is RETRACTED - an independent browser pass + found no trace of it, or of ISO 27701/PCI DSS/FedRAMP/CSA STAR, on any retrievable Baseten + page; the Vanta Trust Center that would carry such certificates is fully JS-gated (every path + tried returns only a meta description). Compliance remains strong on what IS independently + confirmed: SOC 2 Type II with a named audit firm (Sensiba San Filippo LLP), HIPAA, and GDPR.' +- 'CORRECTION 2026-09-21: a real, committed SLA was found and independently read - 99.9% uptime + for Dedicated Inference and Model APIs, service credits capped at 40% of monthly fees, a + 24-hour claim window. A prior draft said no SLA document had been located.' +- No published, named EU region exists for the managed service; "Regional environments" is a + real feature but region availability (including whether EU is offered) requires a sales + conversation. EU residency in practice means the enterprise Self-Hosted tier, not the managed + product. +- US HQ implies standing CLOUD Act exposure for the managed service. +- The three-tier deployment ladder (shared, dedicated, self-hosted) is a genuine strength for + exit/control, though true self-hosted isolation is enterprise-only. +score: + rubric_version: '1.2' + headline: 73.6 + grade: B + hard_flags: [] + dimensions: + data_governance: + score: 4 + rationale: 'Terms & Conditions and the security-practices/DPA pages together give a + strong, binding posture: Zero Data Retention by default for Model APIs and Dedicated + Inference, a contractual never-train clause covering Customer Content (including + deployed model weights and outputs), customer ownership of Customer Content, and a + MUTUAL confidentiality duty (same care as own information, three-year survival). Held + below 5 because Async Inference queues inputs for up to 72 hours before deletion (a + lifecycle exception), and the sub-processor list''s actual contents were not + independently read (the Trust Center portal is JS-gated). + + ' + evidence_refs: + - ev-tc + - ev-dpa + - ev-security + compliance: + score: 4 + rationale: 'CORRECTED 2026-09-21: SOC 2 Type II is confirmed with a named audit firm + (Sensiba San Filippo LLP, clean opinion across Security/Availability/Processing + Integrity/Confidentiality/Privacy criteria); HIPAA and GDPR are independently confirmed + on the Security Practices and DPA pages. A prior claim of ISO 27001 certification is + RETRACTED - an independent Cowork browser pass found no trace of it (or of ISO 27701, + PCI DSS, FedRAMP, or CSA STAR) on any retrievable Baseten page; the Vanta Trust Center + that would carry such certificates is fully JS-gated and unreadable. Score held at 4 + (not lower) because SOC 2 Type II + HIPAA already satisfy the anchor-4 "two of + {SOC2 II, ISO 27001, HIPAA/BAA}" bar on their own, plus GDPR documented; short of 5 + pending independent verification of anything beyond these three. + + ' + evidence_refs: + - ev-soc2 + - ev-dpa + - ev-security + residency: + score: 2 + rationale: 'A "regional environments" feature exists, routing a deployment exclusively to + a designated geographic region, but no published list of available regions - including + whether an EU region is among them - was found; the docs direct customers to contact + support. The practical EU-residency path is the enterprise Baseten Self-Hosted tier + (workload plane inside the customer''s own VPC, any region), which is a real option but + not a documented, named managed-region boundary. Meets the score-2 anchor (an EU-capable + path exists for some workloads, without pinning guarantees or a documented data + boundary on the managed service). + + ' + evidence_refs: + - ev-regions + - ev-selfhosted + security: + score: 4 + rationale: 'CORRECTED 2026-09-21 (description, not score): independently browser-confirmed + isolation is logical namespace separation for shared use (access controls, unique + customer identifiers, namespace isolation) plus single-tenant dedicated Kubernetes + namespaces with Calico/Cilium network policies ("GPUs never shared across users") and + self-hosted deployment inside the customer''s own VPC - not an explicit "three-tier" + model as an earlier draft described it, though the practical effect is similar. Plus TLS + 1.2+ in transit, AES-256 at rest, enforced MFA for all personnel, and periodic + third-party penetration testing (independently confirmed verbatim). Held at 4, not 5, + because no public bug-bounty programme was found and the pen-testing attestation is a + general claim rather than a named, independently published report; the three logged + incidents this period were brief availability degradations, resolved same/next day, not + security breaches. + + ' + evidence_refs: + - ev-security + reliability: + score: 4 + rationale: 'UPGRADED 2026-09-21: an independent Cowork browser session found and directly + read a real, committed SLA (baseten.co/service-level-agreement, Sec 2.0) - 99.9% uptime + for both Dedicated Inference and Model APIs, with a service-credit remedy (capped at 40% + of monthly fees, Sec 4.2) and a 24-hour claim window (Sec 4.3). A prior draft held this at + 3 because no SLA document had been located; one now has been. The status page + (independently browser-read) shows all systems operational with three brief, + same/next-day-resolved incidents in the current window. Meets the score-4 anchor + (contractual SLA with credits, a solid public uptime record, documented incident + communication) - short of a long multi-year track record, which keeps it below 5. + + ' + evidence_refs: + - ev-sla-verified + - ev-status + transparency_lockin: + score: 4 + rationale: 'An OpenAI-compatible API (plus a beta Anthropic-compatible API) over a + predominantly open-weight catalogue keeps workloads portable, and the Terms & Conditions + give a documented 30-day post-termination export window plus an on-request deletion + right. Held below 5 because the sub-processor list''s actual routing/vendor detail was + not independently confirmed this pass. + + ' + evidence_refs: + - ev-tc + - ev-docs + cost: + score: 4 + rationale: 'Detailed, public per-token rates for Model APIs and per-GPU-minute rates + across a wide range of GPU classes (T4 through B200) are both published directly on + Baseten''s pricing page, with clear tier definitions (Basic/Pro/Enterprise). Held below + 5 because Enterprise-tier custom pricing is not public and no independent + competitive-benchmarking pass was done this session. + + ' + evidence_refs: + - ev-pricing + +documentation: + assess: + completeness: 80.8 + originality: 0.0 + items: + - key: data-governance + title: "Data governance - retention, ZDR & training" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-tc, ev-security] + summary: "Zero Data Retention by default for Model APIs and Dedicated Inference (security-practices page, read directly); Terms & Conditions bar Baseten from using Customer Content - including deployed model weights and outputs - to train or improve its own models. Caveat: Async Inference queues inputs up to 72 hours before deletion." + - key: data-ownership + title: "Data & IP ownership" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-tc] + summary: "Terms & Conditions (read directly): 'Customer reserves all rights, title, and interest in and to Customer Content,' defined to include deployed Customer Models and Model Outputs. A MUTUAL confidentiality clause (same care as own information, three-year survival) is a genuine positive beyond the retention/training terms." + - key: residency + title: "Data residency & jurisdiction" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-regions, ev-selfhosted] + summary: "No published, named EU region exists for the managed service; a 'regional environments' feature is gated behind a sales conversation. The practical EU-residency path is the enterprise Self-Hosted tier (workload plane in the customer's own VPC). US HQ carries standing CLOUD Act exposure for the managed product." + - key: compliance + title: "Compliance & attestations" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-soc2, ev-dpa] + summary: "CORRECTED 2026-09-21: SOC 2 Type II is confirmed with a named audit firm; HIPAA and a GDPR DPA are both confirmed. A prior ISO 27001 claim is RETRACTED - an independent browser pass found no trace of it, or of ISO 27701/PCI DSS/FedRAMP/CSA STAR, on any retrievable Baseten page; the Vanta Trust Center is fully JS-gated." + - key: security + title: "Security controls" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-security] + summary: "CORRECTED 2026-09-21 (description): logical namespace isolation for shared use, single-tenant dedicated Kubernetes namespaces, and self-hosted VPC deployment - not an explicit 'three-tier' model as previously described, though the practical effect is similar. TLS 1.2+/AES-256, MFA-enforced least-privilege access, and periodic third-party penetration testing, all independently confirmed verbatim. No public bug-bounty programme found." + - key: pricing + title: "Pricing & cost model" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-pricing] + summary: "Per-token Model API pricing and per-GPU-minute dedicated pricing (T4 through B200) are both published directly on Baseten's pricing page, across Basic/Pro/Enterprise tiers." + - key: reliability + title: "Reliability posture" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-status, ev-sla-verified] + summary: "UPGRADED 2026-09-21: a real, committed SLA was found and independently read - 99.9% uptime for Dedicated Inference and Model APIs, service credits capped at 40% of monthly fees, a 24-hour claim window. The status page (independently confirmed) shows all systems operational with three brief, same/next-day-resolved incidents in the current window." + implement: + completeness: 50.0 + originality: 0.0 + items: + - key: integration + title: "API integration" + doc_type: howto + source_type: aggregated + coverage: full + refs: [ev-docs] + summary: "Hosted Model APIs support the OpenAI Chat Completions API and a beta Anthropic Messages API (docs.baseten.co/overview, read directly); custom deploys use customer-authored Truss/Docker configs, not a Baseten-proprietary format." + - key: authentication + title: "Authentication & account setup" + doc_type: reference + source_type: gap + gap_reason: "Public docs describe API-key-based access but org/workspace key-scoping granularity was not detailed in the sources read this pass." + - key: region-config + title: "Region & residency configuration" + doc_type: howto + source_type: aggregated + coverage: partial + refs: [ev-regions, ev-selfhosted] + summary: "'Regional environments' route a deployment to a designated region but require Baseten to configure it (contact support); Self-Hosted lets the workload plane run in any customer-chosen region/VPC." + - key: rate-limits + title: "Rate limits, tiers & quotas" + doc_type: reference + source_type: gap + gap_reason: "Baseten's pricing page documents GPU/token rates and account tiers (Basic/Pro/Enterprise) but a specific rate-limit/quota table was not located in the sources read this pass." + - key: portability + title: "Portability & exit" + doc_type: explanation + source_type: aggregated + coverage: full + refs: [ev-tc] + summary: "Terms & Conditions give a documented exit right: Customer Content may be exported for 30 days after the Term ends, and Baseten will delete Customer Content on written request. Open-weight models and customer-authored deploy configs keep the workload itself portable." + use: + completeness: 50.0 + originality: 0.0 + items: + - key: models-served + title: "Models served" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-models, ev-pricing] + summary: "A curated Model Library (baseten.co/library, read directly) - DeepSeek V4.1 Flash, GLM-5.3, Kimi K3, Llama 3.3 70B, Qwen3.5/TTS/Reranker/Embedding, Whisper Large V3, Flux.2, embeddings models - plus a general bring-your-own/custom-model deploy platform on dedicated GPUs." + - key: features + title: "Inference features" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-docs] + summary: "OpenAI Chat Completions API and a beta Anthropic Messages API for hosted Model APIs; per-model tool-calling/structured-output support follows each served model and was not individually verified." + - key: fine-tuning + title: "Fine-tuning / custom models" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-docs] + summary: "Training Jobs/Loops are documented as a platform pathway (docs.baseten.co/overview) alongside Model APIs and custom dedicated-GPU deploys; the specific fine-tuning workflow detail was not read in full this pass." + - key: context-limits + title: "Context & token limits" + doc_type: reference + source_type: gap + gap_reason: "Baseten does not publish a single per-model context-limit table in the sources read; limits track each served model's native window (e.g. DeepSeek V4.1 Flash's 1M-token context is noted on its own model page) and should be confirmed per model." + support: + completeness: 42.9 + originality: 0.0 + items: + - key: status-uptime + title: "Status page & uptime history" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-status] + summary: "A public status page (status.baseten.co) is referenced in security/support materials, corroborated via search rather than independently fetched this pass; one recent operational incident (2026-08-30/31, resolved) is documented." + - key: security-disclosure + title: "Security disclosure & trust centre" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-security] + summary: "A Trust Center exists at trust.baseten.co (Vanta-hosted, fully JS-gated - every path tried returns only a meta description) covering, per Baseten's own claims, SOC 2 and a sub-processor list. A prior claim that it also covers ISO 27001 is unconfirmed - no trace of an ISO 27001 claim was found anywhere. No public vulnerability-disclosure programme (security.txt / bug bounty) was found." + - key: channels + title: "Support & community channels" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-docs] + summary: "Product/console documentation (docs.baseten.co) is the primary support surface; support-tier response commitments were not detailed in the sources read." + - key: deprecation + title: "Model deprecation policy" + doc_type: reference + source_type: gap + gap_reason: "No published model-deprecation/EoL policy was found on Baseten's public docs in the sources read this pass." + +ownership: + level: substantial + factors: + use_modify: { level: strong, rationale: "OpenAI/Anthropic-compatible APIs over a predominantly open-weight Model Library keep workloads portable, and the Terms & Conditions confirm the customer retains all IP in Customer Content including deployed model weights and outputs - the three-tier deployment ladder (shared/dedicated/self-hosted) gives real control over where and how the workload runs." } + transparency: { level: moderate, rationale: "The Terms & Conditions and DPA are legible and were independently browser-read (Sec 11 mutual confidentiality confirmed on two separate fetches) - but a prior ISO 27001 claim was RETRACTED (not found anywhere, not even as a self-attestation) and the Vanta Trust Center that would carry PCI/FedRAMP/CSA STAR status is fully JS-gated and unreadable, so the sub-processor list's actual named contents also remain unverified." } + reliability: { level: strong, rationale: "UPGRADED 2026-09-21: a real, committed SLA was independently browser-read (99.9% uptime, 40%-capped service credits, 24h claim window) - a prior draft held this at moderate because no SLA had been located. The public status page shows all systems operational with three brief, same/next-day-resolved incidents in the current window." } + data_control: { level: strong, rationale: "The Terms & Conditions and security-practices page (independently browser-read, Sec 11 confirmed on two fetches) state Zero Data Retention by default for Model APIs and Dedicated Inference, a contractual never-train clause, and a MUTUAL confidentiality duty - among the strongest standard-terms data-control postures reviewed, now independently verified rather than resting on a single automated read. Caveat: Async Inference queues inputs for up to 72 hours, and no published EU region exists for the managed service." } + verdict: "You substantially own inference here: an independent Cowork browser session confirmed, on two separate fetches, that Baseten's Terms & Conditions state Zero Data Retention by default, a contractual bar on using your content (including deployed model weights) to train its models, and a genuinely mutual confidentiality duty - a stronger standard-terms posture than most peers, and now independently verified rather than resting on a single automated read. A real, committed 99.9% SLA with service credits was also confirmed. It falls short of full ownership because a prior ISO 27001 claim was retracted (not found anywhere on independent verification), the Vanta Trust Center is fully JS-gated so PCI/FedRAMP/CSA STAR status and the named sub-processor list remain unverified, no published EU region exists for the managed service (EU residency means the enterprise Self-Hosted tier), and Async Inference has a 72-hour retention exception. If you need EU data residency or want certifications independently confirmed, use the Self-Hosted tier or ask for the underlying reports directly." + +evidence: +- id: ev-tc + claim: "Baseten Terms & Conditions (read directly): Sec on Customer Content ownership - + 'Customer reserves all rights, title, and interest in and to Customer Content,' where + Customer Content includes Customer Models (deployed weights) and Model Outputs; a + training-prohibition clause bars Baseten from using Customer Content to train, fine-tune, or + otherwise develop ML/AI models, limiting its license to providing/maintaining the Services + and preventing/addressing technical problems, plus anonymized/de-identified telemetry; + mutual confidentiality clause requiring 'the same degree of care it uses for its own (but no + less than reasonable care),' surviving three years post-termination, with prior-notice + compelled disclosure; a documented exit right - Customer Content exportable for 30 days + after Term end, deletable on written request." + source_type: publisher + doc_type: terms + retrieved: true + url: https://www.baseten.co/terms-and-conditions/ + date: '2026-09-20' +- id: ev-security + claim: "Baseten security-practices page (read directly): Zero Data Retention for Model APIs + and Dedicated Inference ('will not store, retain, or otherwise make a persistent copy of + model inputs or outputs'); Async Inference queues inputs up to 72 hours before deletion, + outputs never stored; three-tier tenant isolation (shared logical separation; dedicated + single-tenant Kubernetes namespaces with Calico/Cilium network policies, 'never shares GPUs + across users'; self-hosted in customer VPC); TLS 1.2+ in transit, AES-256 at rest with + periodic key rotation; least-privilege access, enforced MFA, quarterly access reviews; + periodic third-party penetration testing; KV cache never persisted to disk." + source_type: publisher + doc_type: security + retrieved: true + url: https://www.baseten.co/security-practices/ + date: '2026-09-20' +- id: ev-dpa + claim: "Baseten DPA (read directly): 'Baseten shall not log, record, or save Customer Personal + Data contained in model inputs or outputs to persistent storage after real-time + processing'; Baseten as Processor, Customer as Controller; SCCs incorporated, governing + law/jurisdiction Ireland (Clause 17/18); UK Addendum (ICO template B.1.0) for UK transfers; + a sub-processor list is maintained with at least fifteen (15) days' prior notice before + engaging a new sub-processor." + source_type: publisher + doc_type: dpa + retrieved: true + url: https://www.baseten.co/dpa + date: '2026-09-20' +- id: ev-soc2 + claim: "Baseten blog post confirming SOC 2 Type II certification, audited by Sensiba San + Filippo LLP, covering Security/Availability/Processing Integrity/Confidentiality/Privacy + criteria with a clean opinion across 70+ sub-criteria; the report itself is gated under + NDA." + source_type: publisher + doc_type: marketing + retrieved: true + url: https://www.baseten.co/blog/soc-2-type-2/ + date: '2026-09-20' +- id: ev-regions + claim: "Baseten regional-environments docs (read directly): routes inference traffic for a + deployment 'exclusively to workload planes within a designated geographic region'; requires + initial configuration by Baseten - 'Contact support to confirm availability for the region + you need.' No published list of specific region names was found." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.baseten.co/deployment/regional-environments + date: '2026-09-20' +- id: ev-selfhosted + claim: "Baseten Self-Hosted product page (read directly): the full workload plane runs inside + the customer's own VPC/cloud, with inference input/output 'never touching Baseten's + premises'; marketed toward the Enterprise pricing tier." + source_type: publisher + doc_type: docs + retrieved: true + url: https://www.baseten.co/deployments/baseten-self-hosted/ + date: '2026-09-20' +- id: ev-status + claim: "UPGRADED 2026-09-21: Baseten's public status page (status.baseten.co), independently + browser-read: 'All Systems Operational' across 6 components (Dedicated Inference, Model + APIs, Training, Model Management API, Web Application, Homepage and Docs); 90-day history, no + numeric % shown on the face. Three incidents this window: 2026-09-09 Nemotron Ultra partial + (Dedicated Inference unaffected, resolved 10:49 PDT); 2026-09-14 India cluster elevated + errors + Kimi K3 non-US partial (resolved same day); 2026-09-20 Kimi K3 US endpoint outage + (restored 01:13 PDT). A prior draft cited a single, differently-dated incident from a search + snippet - corrected to this independently-read list." + source_type: publisher + doc_type: sla + retrieved: true + url: https://status.baseten.co/ + date: '2026-09-20' +- id: ev-sla-verified + claim: "Baseten Service Level Agreement (independently browser-read 2026-09-21, verbatim): Sec + 2.0 - 'ninety-nine point nine percent (99.9%)' committed uptime, applying to both Dedicated + Inference and Model APIs on Baseten-managed infrastructure. Sec 1.5 defines System + Availability against status.baseten.co. Sec 4.2 caps monthly Service Credits at 'forty + percent (40%).' Sec 4.3 requires a claim within 24 hours with evidence. Sec 1.4 lists standard + exclusions. Enterprise plan offers 'Custom SLAs.' A prior draft stated no SLA document had + been located; this corrects that." + source_type: publisher + doc_type: sla + retrieved: true + url: https://www.baseten.co/service-level-agreement/ + date: '2026-09-21' +- id: ev-pricing + claim: "Baseten pricing page (read directly): per-token Model API rates (e.g. GLM-5.3 + $1.40/$0.14-cached/$4.40, DeepSeek V4.1 Flash $0.30/$0.03-cached/$1.20, Kimi K3 + $3.00/$0.30-cached/$15.00) and per-GPU-minute dedicated rates (T4 $0.01052, A10G $0.02012, + A100 80GB $0.06667, H100 80GB $0.10833, B200 180GB $0.16633) across Basic/Pro/Enterprise + tiers." + source_type: publisher + doc_type: marketing + retrieved: true + url: https://www.baseten.co/pricing/ + date: '2026-09-20' +- id: ev-models + claim: "Baseten Model Library page (read directly): current curated catalogue includes + DeepSeek V4.1 Flash, GLM-5/5.3/5.3 Fast, Llama 3.3 70B Instruct, Kimi K3, Qwen3.5 35B-A3B + + TTS + Reranker/Embedding + Image, Whisper Large V3 variants, Flux.2 [dev], EmbeddingGemma, + Nomic Embed Code, BGE Embedding ICL, Inkling." + source_type: publisher + doc_type: docs + retrieved: true + url: https://www.baseten.co/library/ + date: '2026-09-20' +- id: ev-docs + claim: "Baseten platform overview docs (read directly): three pathways - hosted Model APIs + supporting the OpenAI Chat Completions API and a beta Anthropic Messages API, deploying an + open-source/fine-tuned/custom model on dedicated GPUs, and Training Jobs/Loops." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.baseten.co/overview + date: '2026-09-20' +changelog: +- date: '2026-09-20' + change: 'Initial entry. Primary-source research: read the Terms & Conditions, DPA, + security-practices, regional-environments, self-hosted, pricing, model-library and + platform-overview pages directly; corroborated SOC 2 Type II via Baseten''s own blog post + (named audit firm). Confidentiality coded mutual (explicit same-care clause, three-year + survival). Coded eu_region_available and region_pinning as unknown - no published, named EU + region exists for the managed service; the practical EU path is the enterprise Self-Hosted + tier. Dedicated availability coded self_serve for the broadly-priced Dedicated Deployments + tier, with true self-hosted/air-gapped isolation flagged as enterprise-only in + dedicated_notes. The Trust Center portal (trust.baseten.co) is JS-gated and its ISO + 27001/PCI/FedRAMP claims and sub-processor list contents were not independently read - flag + for a future deeper pass.' +- date: '2026-09-21' + change: 'CORRECTION - independent Cowork browser verification pass, following up on the + flagged Trust Center gap. Net result is mostly positive: the mutual confidentiality clause + (Sec 11) is now CONFIRMED on two separate live fetches, and a real, committed SLA (99.9% + uptime, 40%-capped credits) was found at baseten.co/service-level-agreement - a prior draft + had located none. reliability score 3 -> 4. Two corrections downward: a prior ISO 27001 claim + is RETRACTED (no trace found anywhere, not even self-attested; Vanta Trust Center remains + fully JS-gated) - iso_27001 changed from yes to unknown, though compliance stays at 4 since + SOC 2 Type II + HIPAA already clear that anchor on their own; and the "three-tier isolation + model" description is corrected to logical namespace + single-tenant dedicated + self-hosted + VPC (the practical effect is the same; security score unchanged at 4). Also corrected: ZDR + default lives in the Security Practices page, not the Terms directly (Terms Sec 2.5 merely + honours it by reference); and the incident list updated to the three actually-current + incidents (Sep 9/14/20) in place of a differently-dated one from a search snippet. Headline + 71.2 -> recomputed by score.py.' +last_verified: '2026-09-21' +freshness_sla: + fast_days: 30 + score_days: 90 + slow_days: 180 diff --git a/inference-providers/baseten/implement.md b/inference-providers/baseten/implement.md new file mode 100644 index 0000000..ef0a81d --- /dev/null +++ b/inference-providers/baseten/implement.md @@ -0,0 +1,41 @@ +# Implement - Baseten + +_How do we integrate it? API integration, region configuration, and portability live here; +authentication and rate limits are documented gaps below._ + + +## API integration + +Hosted **Model APIs** support the **OpenAI Chat Completions API** and a **beta Anthropic Messages +API** (docs.baseten.co/overview, read directly). Custom deploys use customer-authored +**Truss/Docker configs** rather than a Baseten-proprietary format, which itself aids portability +of the deployment definition. + + +## Authentication & account setup + +Public docs describe API-key-based access, but org/workspace key-scoping granularity was not +detailed in the sources read this pass - confirm the exact setup in the Baseten console. + + +## Region & residency configuration + +**"Regional environments"** route a deployment exclusively to a designated geographic region, but +require Baseten to configure it - the docs say to **contact support** to confirm availability for +the region you need; there is no published, self-serve region list. **Self-Hosted** is the +alternative: the workload plane runs in any customer-chosen region/VPC, including the EU. + + +## Rate limits, tiers & quotas + +Baseten's pricing page documents GPU/token rates and account tiers (Basic/Pro/Enterprise) in +detail, but a specific rate-limit/quota table was not located in the sources read this pass - +confirm current throughput limits for your account before sizing a production workload. + + +## Portability & exit + +Terms & Conditions give a documented exit right: **Customer Content may be exported for 30 days** +after the Term ends, and Baseten will **delete Customer Content on written request**. Open-weight +models in the Model Library and customer-authored deploy configs keep the workload itself +portable beyond Baseten. diff --git a/inference-providers/baseten/support.md b/inference-providers/baseten/support.md new file mode 100644 index 0000000..4b0184d --- /dev/null +++ b/inference-providers/baseten/support.md @@ -0,0 +1,34 @@ +# Support - Baseten + +_How do we keep it running and get help? Status/uptime, security disclosure, and support +channels live here; model deprecation is a documented gap below._ + + +## Status page & uptime history + +A public **status page** (status.baseten.co) is referenced in security/support materials, +corroborated via search rather than independently fetched this pass. One recent operational +incident (elevated inference 500s in a single US-based cluster, 2026-08-30/31) is documented and +was resolved. + + +## Security disclosure & trust centre + +A **Trust Center** exists at trust.baseten.co (SafeBase-hosted, JS-gated; not independently read +this pass), covering **SOC 2**, **ISO 27001**, and a **sub-processor list**. No public +vulnerability-disclosure programme (`security.txt` / bug bounty) was found. + + +## Support & community channels + +Product/console documentation (docs.baseten.co) is the primary support surface. Support-tier +response commitments were not detailed in the sources read this pass - confirm what comes with +your account tier during onboarding. + + +## Model deprecation policy + +No published model-deprecation or end-of-life policy was found on Baseten's public docs in the +sources read this pass. Because the Model Library is predominantly open-weight and custom deploys +use customer-owned configs, a removed model can generally be redeployed elsewhere - but confirm +Baseten's own migration practice directly if this matters for your workload. diff --git a/inference-providers/baseten/use.md b/inference-providers/baseten/use.md new file mode 100644 index 0000000..8f328ab --- /dev/null +++ b/inference-providers/baseten/use.md @@ -0,0 +1,43 @@ +# Use - Baseten + +_What can it do and how do we use it? The served model catalogue and inference features live +here; context limits are a documented gap below._ + + +## Models served + +Baseten's curated **Model Library** (baseten.co/library, read directly) currently features: + +- **DeepSeek V4.1 Flash** (552B MoE, multimodal, 1M-token context) +- **GLM-5 / GLM-5.3 / GLM-5.3 Fast** +- **Kimi K3** +- **Llama 3.3 70B Instruct** +- **Qwen3.5 35B-A3B**, Qwen3 TTS, Qwen3 8B Reranker/Embedding, Qwen Image +- **Whisper Large V3** (transcription) +- **Flux.2 [dev]** (image generation) +- Embeddings: EmbeddingGemma, Nomic Embed Code, BGE Embedding ICL + +Beyond the curated library, Baseten is equally a **bring-your-own-model deploy platform**: any +open-source, fine-tuned, or fully custom model can be deployed on dedicated GPUs. + + +## Inference features + +Hosted Model APIs support the **OpenAI Chat Completions API** and a **beta Anthropic Messages +API**. Per-model tool-calling and structured-output support follows each served model's own +capabilities and was not individually verified on Baseten's endpoints - confirm per model. + + +## Fine-tuning / custom models + +**Training Jobs/Loops** are documented as a platform pathway alongside Model APIs and custom +dedicated-GPU deploys (docs.baseten.co/overview), but the specific fine-tuning workflow was not +read in full this pass - confirm supported methods and base models before planning a custom-model +workflow. + + +## Context & token limits + +Baseten does not publish a single per-model context-limit table in the sources read; limits track +each served model's native window (DeepSeek V4.1 Flash's 1M-token context is noted on its own +model page) and should be confirmed per model. diff --git a/inference-providers/berget/entry.yaml b/inference-providers/berget/entry.yaml index eb96c7a..488ba59 100644 --- a/inference-providers/berget/entry.yaml +++ b/inference-providers/berget/entry.yaml @@ -516,7 +516,9 @@ changelog: subprocessors_disclosed false -> true. Added confidentiality: explicit and dedicated_availability: coming_soon. No dimension score changed (never-train rests on the service-scoped licence + DPA purpose-limitation, not an express clause; still no independent attestation).' -last_verified: '2026-08-06' +- date: '2026-09-21' + change: 'Freshness re-verification (Cowork browser session). Confidentiality (explicit, ToS Sec 18) and content ZDR by default (ToS Sec 7) re-confirmed verbatim, unchanged. Positive delta: the DPA was refreshed 2026-09-10 (after the prior grounding) and now states verbatim all data centres are within the EEA, and the customer may choose which Berget data centre(s) process their data; Appendix 1 now names five sub-processors (Acebit AB, AI Iron AB, Obenet AB, Stripe Payments Europe Limited, Toriv AB) with 30-day advance notice and objection rights - both eu_region_available and subprocessors_disclosed were already coded correctly and residency was already at ceiling (5), so this strengthens the grounding without moving the score. ISO 27001 remains a stated claim ("actively working toward" per ToS 6.7), not a dated certificate - unchanged. No incidents or SLA changes found. No score change; grade holds at B.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/inference-providers/deepinfra/README.md b/inference-providers/deepinfra/README.md index 6e00992..105bc1a 100644 --- a/inference-providers/deepinfra/README.md +++ b/inference-providers/deepinfra/README.md @@ -1,9 +1,9 @@ # DeepInfra - OneHill Inference-Provider Dossier -> **Score: 60.4/100 · Grade C** · HQ: United States · EU residency: no · Trains on inputs: never -> Last verified: 2026-07-25 +> **Score: 56.8/100 · Grade C** · HQ: United States · EU residency: no · Trains on inputs: never +> Last verified: 2026-09-21 > -> _Right for cost-sensitive open-model serving; the biggest caveat is that its zero-retention covers only its own open models - closed models routed through it fall under those vendors' terms - and there is no EU residency._ +> _A rewritten Terms of Service (effective 2026-08-17, independently re-verified 2026-09-21) added a genuine mutual confidentiality clause and made Zero Data Retention contractual and controlling with a bounded exception - correcting an earlier D grade. The biggest caveats are that zero-retention still covers only its own open models - closed models routed through it fall under those vendors' terms - no EU residency, and compliance (SOC 2/ISO dated status, DPA/SCCs) was not re-examined this pass._ **Hard flags:** none @@ -13,7 +13,7 @@ | Dimension | Score | One-line reason | |---|---|---| -| Data Governance & Privacy | 4/5 | Zero-retention, no training, scoped to its own open-model serving | +| Data Governance & Privacy | 4/5 | Mutual confidentiality (Sec 17) + contractual, bounded ZDR (Sec 7(b)) - scoped to its own open-model serving | | Compliance & Certifications | 3/5 | ISO 27001 + SOC 2 Type 1 only (not Type II); HIPAA unattested | | Data Residency & Sovereignty | 1/5 | US-only data centres; no EU residency surfaced | | Security Posture | 3/5 | ISO 27001 + Type 1 SOC 2; no independent pen-test surfaced | diff --git a/inference-providers/deepinfra/assess.md b/inference-providers/deepinfra/assess.md index 389fe17..0ebeab6 100644 --- a/inference-providers/deepinfra/assess.md +++ b/inference-providers/deepinfra/assess.md @@ -1,18 +1,21 @@ # Assess - DeepInfra _Should we route our data through this provider? Data governance, compliance, residency, -security, pricing, and reliability - plus the provider AOI score (60.4/100 · Grade C) - +security, pricing, and reliability - plus the provider AOI score (56.8/100 · Grade C) - live here._ ## Data governance - retention, ZDR & training -DeepInfra runs a **zero-retention policy** for inputs and outputs by default and **does not -train** on submitted data; per its data-privacy documentation it logs only **debugging -metadata** (request ID, cost, sampling parameters), reserving the right to log small portions -of requests for debugging or security, and batch requests may store data **temporarily, -encrypted on disk, then delete it** after inference. That is a strong default posture, and it -is grounded in the retrieved Terms and data-privacy pages rather than a marketing claim. +**Correction (2026-09-21):** a rewritten Terms of Service (effective 2026-08-17) makes Zero Data +Retention **contractual and controlling** - Sec 7(b): *"Provider will not retain, store, or log +any Customer Data submitted to or generated by the Services beyond the period strictly necessary +to process and return the applicable request... ('Zero Data Retention')"*, and Sec 5(a) states +this "controls over the Privacy Policy and any other Provider policy." The old open-ended +debugging carve-out is replaced by **bounded** exceptions: support diagnostics deleted within +**30 days**, operational metadata (excludes content), and legal-compliance records. Training +remains **never** by contract, properly scoped: *"Provider will not use Customer Data to train, +fine-tune, or otherwise improve any model, except as necessary to provide the Services."* The decisive caveat is **scope**: this covers **DeepInfra's own open-model serving only**. The same documents state that when you route requests to the **closed models it re-sells** - @@ -25,11 +28,13 @@ open-model and closed-model traffic when governance matters. ## Data & IP ownership -For DeepInfra's **own open-model serving**, the ownership story is clean and now grounded in -the retrieved Terms of Service, which state you **retain any intellectual property rights over -your Submissions, which will remain private**. Combined with **zero-retention** and **no -training on submitted data**, your inputs, outputs and any derived knowledge stay yours - -**customer_retains**. But ownership is **not uniform across the catalogue**. The **closed models +For DeepInfra's **own open-model serving**, the ownership story is clean and grounded in the +Terms of Service, which state you **retain any intellectual property rights over your +Submissions**. **Correction (2026-09-21):** the rewritten Terms add Sec 17, a genuine **bilateral +confidentiality duty** (three-year survival) - replacing the prior "will remain private" +non-commitment. Combined with **zero-retention** and **no training on submitted data**, your +inputs, outputs and any derived knowledge stay yours - **customer_retains**. But ownership is +**not uniform across the catalogue**. The **closed models DeepInfra re-sells** - Anthropic Claude, Google - are **transferred to those vendors** and route your data under **their** storage and training terms rather than DeepInfra's, so whether your data stays proprietary depends on which model you call. The **sub-processor list is not disclosed**. diff --git a/inference-providers/deepinfra/entry.yaml b/inference-providers/deepinfra/entry.yaml index 99cda2b..3ec2489 100644 --- a/inference-providers/deepinfra/entry.yaml +++ b/inference-providers/deepinfra/entry.yaml @@ -12,11 +12,16 @@ hq_country: United States summary: 'A US-headquartered, low-cost inference provider serving ~77-90+ open models (Llama 3.x/4.x, DeepSeek V3/V3.2/V4 variants, Qwen3, Kimi K2, GLM-5, gpt-oss-120B, MiniMax-M2, Nemotron, Gemma) over pay-as-you-go per-token pricing plus by-the-hour - dedicated GPUs, and is among the cheapest providers available. Its standout fact - is aggressive cost with a zero-retention policy; the biggest caveat is that its - zero-retention covers only its own open-model serving, while closed models (Anthropic - Claude, Google) routed through it fall under those vendors'' terms - and no EU data-residency - option was surfaced. + dedicated GPUs, and is among the cheapest providers available. A rewritten Terms of + Service (effective 2026-08-17, independently re-verified 2026-09-21) materially + strengthened its data-governance posture: a genuine mutual confidentiality clause + (Sec 17), Zero Data Retention made contractual and controlling with a bounded 30-day + diagnostics exception (Sec 7(b), replacing the old open-ended debugging carve-out), + and a properly scoped no-training commitment. The biggest caveats are that + zero-retention still covers only its own open-model serving - closed models (Anthropic + Claude, Google) routed through it fall under those vendors'' terms - no EU + data-residency option was surfaced, and its compliance posture (no independently dated + SOC 2/ISO cert, no confirmed DPA/SCCs) was not re-examined this pass. ' models_served: @@ -43,15 +48,31 @@ pricing: - 'gpt-oss-120B: ~$0.08/M (blended)' - 'GPU/hr: A100 $0.89, H100 $1.79, H200 $2.19, B200 $2.79' data_governance: - default_retention: zero-retention for inputs/outputs; batch may store data temporarily - (encrypted on disk) then delete after inference + default_retention: 'CORRECTED 2026-09-21: the ToS was rewritten 2026-08-17 (after the prior + 2026-08-06 grounding) into a full 20-section MSA-style agreement. Sec 7(b) (verbatim): + "Provider will not retain, store, or log any Customer Data submitted to or generated by the + Services beyond the period strictly necessary to process and return the applicable request, + after which such Customer Data is deleted from Provider''s systems in the ordinary course of + operations (''Zero Data Retention'')." Sec 5(a): this ZDR commitment "controls over the + Privacy Policy and any other Provider policy." The prior open-ended, no-numeric-limit + debugging carve-out is replaced by BOUNDED exceptions: support diagnostics deleted within 30 + days, operational metadata (excludes content), and legal-compliance records. docs/data-privacy + corroborates: input data exists only in memory during inference (not stored to disk); output + data is not stored (narrow exception for image-gen outputs and encrypted temporary disk for + bulk inference, both short-lived).' trains_on_inputs: never zdr_available: yes_default - zdr_scope_caveats: 'Batch requests may store data temporarily, encrypted on disk, and delete - it after inference. Beyond batch, the ToS permits storing Submissions (content) "for a limited - time for the purpose of debugging" with no numeric limit, and the content licence has an "other - internal uses only" tail - so "zero retention" is not absolute. There is no ZDR toggle. - Zero-retention covers DeepInfra''s OWN open-model serving only. + zdr_scope_caveats: 'CORRECTED 2026-09-21: Sec 7(b) of the rewritten ToS (independently + browser-read) makes ZDR contractual and controlling, with the old unbounded debugging carve-out + replaced by a bounded 30-day diagnostics exception. Sec 7(b) also states: "Provider will not use + Customer Data to train, fine-tune, or otherwise improve any model, except as necessary to + provide the Services (e.g., fine-tuning a model for Customer''s use)" - a properly scoped + no-train commitment. Zero-retention still covers DeepInfra''s OWN open-model serving only; see + third_party_routing_leakage. OPEN CAVEAT flagged by the research: the ToS reads as an + enterprise/Service-Order MSA published at the canonical /terms URL - the code session is + crediting it to the base self-serve product (the standard reading of a canonical /terms page), + but this should be explicitly re-confirmed in a future pass if a separate self-serve-only ToS + surfaces. ' customer_data_ownership: customer_retains @@ -60,17 +81,24 @@ data_governance: DeepInfra, data is subject to THAT vendor''s storage and training policy - DeepInfra''s Terms state it transfers data to those endpoints to fulfil the request, and its zero-retention/no-training does NOT extend to third-party model routing. This is a - key finding, grounded in the Terms of Service and the data-privacy documentation. + key finding, grounded in the Terms of Service and the data-privacy documentation. Re-confirmed + 2026-09-21 as still real and unchanged in the rewritten ToS - a bounded, disclosed residual + weakness, not a ceiling-setter. ' subprocessors_disclosed: false - confidentiality: functional_only - confidentiality_caveats: 'No confidentiality clause; the ToS states only that Submissions "will - remain private" (a privacy statement, not a duty of confidence). Read 2026-08-06, two soft spots - beyond it: the no-store/no-train commitment carries an open-ended debugging carve-out - "We might - store some Submissions for a limited time for the purpose of debugging our Services" with no - numeric limit (Submissions = content, not only metadata) - and the content licence has an - "other internal uses only" tail. For trade-secret material, negotiate an NDA/enterprise terms.' + confidentiality: mutual + confidentiality_caveats: 'CORRECTED 2026-09-21: the rewritten ToS (effective 2026-08-17, + independently browser-read) adds Section 17 "Confidentiality" - verbatim: "The Receiving Party + shall maintain the Confidential Information in strict confidence and disclose the Confidential + Information only to its employees, subcontractors, consultants, and representatives who have a + need to know such Confidential Information." This is bilateral ("Each Party (as ''Disclosing + Party'') may disclose...") with a three-year survival period - a genuine mutual duty, replacing + the prior "no confidentiality clause, only ''will remain private''" finding entirely. Sec 17(f) + permits the provider to use the customer''s name/logo for marketing (a minor carve-out, not a + content licence). Combined with the now-bounded ZDR (Sec 7(b)) and properly scoped no-train + commitment, this is a materially stronger data-governance posture than the prior grounding + found. OPEN CAVEAT: the MSA-scope question above applies here too.' compliance: soc2: type_i iso_27001: "yes" @@ -105,12 +133,19 @@ dedicated_notes: 'Genuinely self-serve dedicated: dedicated instances billed per repos plus LoRA adapters on dedicated GPU allocations ("your weights, your endpoint, your isolation"). Single-tenancy is described in docs, not warranted in the contract.' trust_considerations: -- No confidentiality clause - the ToS says only that Submissions "will remain private". Combined - with an open-ended "debugging" carve-out that may store Submissions (content) with no time limit - and an "other internal uses only" licence tail, "zero retention" is not absolute; negotiate an - NDA/enterprise terms for trade-secret material. Under rubric 1.2 this holds data_governance at 3. +- 'CORRECTED 2026-09-21: a rewritten ToS (effective 2026-08-17) replaces the prior "no + confidentiality clause" finding with a genuine mutual confidentiality duty (Sec 17, bilateral, + three-year survival) and replaces the old open-ended debugging carve-out with a bounded 30-day + diagnostics exception under a now-contractual, controlling Zero Data Retention commitment (Sec + 7(b)/5(a)). data_governance moved from 3 to 4 on this finding.' - Zero-retention covers DeepInfra's own open-model serving only; closed models (Claude, - Google) routed through it fall under those vendors' storage/training terms. + Google) routed through it fall under those vendors' storage/training terms. Re-confirmed + unchanged 2026-09-21. +- 'OPEN CAVEAT (2026-09-21): the rewritten ToS reads as an enterprise/Service-Order MSA published + at the canonical /terms URL. Credited to the base self-serve product as the standard reading of + a canonical Terms page - re-confirm explicitly in a future pass if a separate self-serve-only + ToS is found. Compliance trust centre (SOC 2/ISO 27001 dated-vs-claim, DPA/SCCs) was not + re-examined this pass and remains at its prior grounding.' - SOC 2 is Type 1 only (not Type II) and self-attested on an unreachable trust centre; HIPAA/BAA is not a formal attestation. No signable DPA and no SCCs / EU transfer mechanism are offered (verified 2026-08-06) - the Privacy Policy names a DPO and acknowledges GDPR rights but processes data in the @@ -119,27 +154,30 @@ trust_considerations: - US HQ implies standing CLOUD Act exposure. score: rubric_version: '1.2' - headline: 52.0 - grade: D + headline: 56.8 + grade: C hard_flags: [] dimensions: data_governance: - score: 3 - rationale: 'Explicit no-store/no-sell/no-train on Submissions and customer-retained IP are a - genuine strength, grounded in the retrieved Terms and data-privacy docs. But the - zero-retention claim is not clean: the ToS (re-read 2026-08-06) permits storing SUBMISSIONS - (content, not only metadata) "for a limited time for the purpose of debugging" with NO - numeric limit, the content licence has an "other internal uses only" tail, there is no - express confidentiality duty (only "will remain private"), and the guarantee covers only - DeepInfra''s own open-model serving - Google/Anthropic closed models routed through it fall - under those vendors'' terms. Under rubric 1.2 that unbounded debugging-content carve-out - misses the score-4 "short bounded retention" bar, so 3. + score: 4 + rationale: 'CORRECTED 2026-09-21: a rewritten ToS (effective 2026-08-17, independently + browser-read) resolves the two findings that previously held this at 3. Sec 17 gives a + genuine bilateral confidentiality duty (three-year survival) in place of the prior "will + remain private" non-commitment. Sec 7(b)/5(a) make Zero Data Retention contractual and + controlling, replacing the old unbounded debugging carve-out with a bounded 30-day + diagnostics exception, and properly scope the no-train commitment. Customer-retained IP is + unchanged. Held at 4, not 5, because the guarantee still covers only DeepInfra''s own + open-model serving (Google/Anthropic closed models routed through it fall under those + vendors'' terms) and sub-processors remain undisclosed - matching the anchor-4 bar + ("contractually no training; short bounded retention... short of zero-retention-by-default") + rather than anchor 5. ' evidence_refs: - ev1 - ev2 - ev7 + - ev-tos-rewrite compliance: score: 2 rationale: 'SOC 2 (Type 1 only, not Type II) and ISO 27001 appear as claims on the @@ -214,7 +252,7 @@ score: # so there are no onehill_generated items and originality = 0. documentation: assess: - completeness: 80.8 + completeness: 88.5 originality: 0.0 items: - key: data-governance @@ -222,15 +260,15 @@ documentation: doc_type: reference source_type: aggregated coverage: full - refs: [ev1, ev2] - summary: "Zero-retention for inputs/outputs by default, only debugging metadata (request ID, cost, sampling parameters) logged, and no training on submitted data (batch data held encrypted on disk, then deleted). Key caveat, per the retrieved Terms and data-privacy docs: this covers DeepInfra's own open-model serving only - closed models (Claude, Google) routed through it fall under those vendors' terms." + refs: [ev1, ev2, ev-tos-rewrite] + summary: "CORRECTED 2026-09-21: a rewritten ToS (effective 2026-08-17) makes Zero Data Retention contractual and controlling (Sec 7(b)/5(a)), with the old unbounded debugging carve-out replaced by a bounded 30-day diagnostics exception, and properly scopes the no-train commitment. Key caveat, unchanged: this covers DeepInfra's own open-model serving only - closed models (Claude, Google) routed through it fall under those vendors' terms." - key: data-ownership title: "Data & IP ownership" doc_type: reference source_type: aggregated - coverage: partial - refs: [ev1, ev2, ev7] - summary: "The retrieved Terms state customers retain IP rights over their Submissions, which remain private, and DeepInfra does not train on or share that data - so for its own open-model serving your data and outputs stay yours (customer_retains). Ownership is not uniform, though: closed models (Anthropic Claude, Google) re-sold through DeepInfra are transferred to those vendors and fall under their storage/training terms. Sub-processors are not disclosed." + coverage: full + refs: [ev1, ev2, ev7, ev-tos-rewrite] + summary: "CORRECTED 2026-09-21: the rewritten Terms add Sec 17, a genuine bilateral confidentiality duty (three-year survival) - replacing the prior 'no confidentiality clause' finding. Customers retain IP rights over their Submissions and DeepInfra does not train on or share that data - so for its own open-model serving your data and outputs stay yours (customer_retains). Ownership is not uniform, though: closed models (Anthropic Claude, Google) re-sold through DeepInfra are transferred to those vendors and fall under their storage/training terms. Sub-processors are not disclosed." - key: compliance title: "Compliance & attestations" doc_type: reference @@ -367,9 +405,9 @@ ownership: # grounded in: ev2 (privacy_policy, retrieved), ev7 (terms, retrieved), ev3 (security, not retrieved) reliability: { level: moderate, rationale: "SOC 2 and ISO 27001 certification give baseline controls, but the Type designation is unverified and no public uptime SLA, status page or independent pen-test was found." } # grounded in: ev1 (docs, retrieved - no SLA), ev3 (security, not retrieved) - data_control: { level: moderate, rationale: "For DeepInfra's own open-model serving the retrieved Terms and data-privacy docs confirm zero-retention, no-training and customer-retained IP (customer_retains). It falls short of strong because closed models (Claude, Google) re-sold through it are transferred to those vendors under their storage/training terms, sub-processors are undisclosed, and residency is US-only with CLOUD Act exposure." } - # grounded in: ev7 (terms, retrieved - IP retention), ev2 (privacy_policy, retrieved - no-train + closed-model routing), ev5 (docs, retrieved - US-only) - verdict: "You substantially control your data on DeepInfra's own open-model serving: the retrieved Terms let you keep IP over your Submissions, and zero-retention plus no-training keep inputs and outputs yours, with the open checkpoints a clean portable exit. Ownership is capped at partial because that control is not uniform - the re-sold closed models (Claude, Google) are transferred to those vendors and carry their data terms rather than DeepInfra's, so route no sensitive data through them - and US-only residency rules it out where EU data sovereignty is required." + data_control: { level: moderate, rationale: "CORRECTED 2026-09-21: for DeepInfra's own open-model serving, the rewritten ToS (independently browser-read) now adds a genuine mutual confidentiality duty (Sec 17) and makes Zero Data Retention contractual and controlling with a bounded exception (Sec 7(b)), on top of the already-confirmed no-training and customer-retained IP. It falls short of strong because closed models (Claude, Google) re-sold through it are transferred to those vendors under their storage/training terms, sub-processors are undisclosed, residency is US-only with CLOUD Act exposure, and the ToS's self-serve-vs-enterprise scope is not fully confirmed." } + # grounded in: ev7 (terms, retrieved - IP retention), ev2 (privacy_policy, retrieved - no-train + closed-model routing), ev5 (docs, retrieved - US-only), ev-tos-rewrite (terms, retrieved - mutual confidentiality + bounded ZDR) + verdict: "You substantially control your data on DeepInfra's own open-model serving, and more so than a prior grounding found: an independently re-verified rewrite of the Terms of Service (2026-08-17) adds a genuine mutual confidentiality clause and makes Zero Data Retention contractual and controlling with a bounded 30-day exception, on top of the already-confirmed no-training and customer-retained IP. Ownership is capped at partial because that control is not uniform - the re-sold closed models (Claude, Google) are transferred to those vendors and carry their data terms rather than DeepInfra's, so route no sensitive data through them - and US-only residency rules it out where EU data sovereignty is required. The ToS's self-serve-vs-enterprise scope and the compliance trust centre remain to be independently re-confirmed." # Evidence. `doc_type` = which kind of primary document; `retrieved` = true only where the # document's substantive content was actually obtained this session. deepinfra.com and @@ -444,6 +482,31 @@ evidence: retrieved: false url: https://deepinfra.com/pricing date: '2026-07-25' +- id: ev-tos-rewrite + claim: 'DeepInfra Terms of Service, rewritten into a full 20-section MSA-style agreement, effective + 2026-08-17 (independently browser-read 2026-09-21, after the prior 2026-08-06 grounding). Sec 17 + "Confidentiality" (verbatim): "The Receiving Party shall maintain the Confidential Information in + strict confidence and disclose the Confidential Information only to its employees, subcontractors, + consultants, and representatives who have a need to know such Confidential Information." Bilateral + ("Each Party (as ''Disclosing Party'') may disclose..."), three-year survival; 17(f) permits + provider marketing use of customer name/logo. Sec 7(b) (verbatim): "Provider will not retain, + store, or log any Customer Data submitted to or generated by the Services beyond the period + strictly necessary to process and return the applicable request, after which such Customer Data + is deleted from Provider''s systems in the ordinary course of operations (''Zero Data + Retention'')," with bounded exceptions (support diagnostics deleted within 30 days, operational + metadata excluding content, legal-compliance records); Sec 5(a) states this ZDR commitment + "controls over the Privacy Policy and any other Provider policy." Sec 7(b) also: "Provider will + not use Customer Data to train, fine-tune, or otherwise improve any model, except as necessary to + provide the Services (e.g., fine-tuning a model for Customer''s use)." OPEN CAVEAT: the ToS reads + as an enterprise/Service-Order MSA at the canonical /terms URL; scope to standard self-serve users + is credited as the standard reading of a canonical Terms page but not independently confirmed + beyond that. The compliance trust centre (trust.deepinfra.com/compliance) was not re-examined this + pass and returned 403 again.' + source_type: publisher + doc_type: terms + retrieved: true + url: https://deepinfra.com/terms + date: '2026-09-21' changelog: - date: '2026-07-25' change: Initial entry. @@ -471,7 +534,19 @@ changelog: DPO named): corrected gdpr_dpa yes -> no and **compliance 3 -> 2** (fails the "GDPR/DPA available" bar). Added confidentiality: functional_only and dedicated_availability: self_serve. Net headline 60.4 -> 52.0 (grade C -> D).' -last_verified: '2026-08-06' +- date: '2026-09-21' + change: 'Freshness re-verification (Cowork browser session) surfaced a MATERIAL POSITIVE rewrite of + the Terms of Service (effective 2026-08-17, after the prior grounding). Sec 17 adds a genuine + bilateral confidentiality duty (confidentiality: functional_only -> mutual). Sec 7(b)/5(a) make + Zero Data Retention contractual and controlling, replacing the old unbounded debugging carve-out + with a bounded 30-day diagnostics exception, and properly scope the no-train commitment. + **data_governance 3 -> 4** (52.0 -> 56.8; grade D -> C). Compliance (SOC 2/ISO dated-vs-claim, + DPA/SCCs) was NOT re-examined this pass (trust centre 403''d again) and is unchanged pending a + future check - flagged, not credited. Open caveat: the rewritten ToS reads as an + enterprise/Service-Order MSA at the canonical /terms URL; credited to the base self-serve product + as the standard reading of a canonical Terms page, but this should be explicitly re-confirmed if a + separate self-serve-only ToS is found. No incidents since Aug 2026.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/inference-providers/fireworks-ai/README.md b/inference-providers/fireworks-ai/README.md new file mode 100644 index 0000000..67582ec --- /dev/null +++ b/inference-providers/fireworks-ai/README.md @@ -0,0 +1,56 @@ +# Fireworks AI - OneHill Inference-Provider Dossier + +> **Score: computed by scripts/score.py** · HQ: United States (Delaware) · EU residency: yes (sales-gated beyond default) · Trains on inputs: opt-in only +> Last verified: 2026-09-21 +> +> _An independent Cowork browser pass (2026-09-21) found Fireworks' Terms of Service and DPA to be unreachable (noindexed, ROBOTS_DISALLOWED) - a real correction to an earlier draft that claimed to have read them. Confidentiality is now coded unknown, not functional_only; sub-processor disclosure is unconfirmed._ + +**Hard flags:** none + +--- + +## 1. What it serves & how it's priced + +Fireworks AI serves a broad, fast-moving open-weight catalogue - Kimi K3, DeepSeek V4-generation, +GLM-5.3, Qwen3.8, Llama 3.x, Mistral, NVIDIA Nemotron, gpt-oss 120B, plus embeddings and FLUX +image models - over per-token serverless and per-GPU-second dedicated deployments. + +## 2. Data governance - where your prompts go + +**Correction:** the Terms of Service and DPA - the two documents that would settle the exact ZDR +clause, the confidentiality direction, and the sub-processor list - are both page-level noindexed +and unreachable to a real browser. What IS independently confirmed via readable docs: Zero Data +Retention for serverless/dedicated inference (the Response API is the one exception - stores by +default, 30-day auto-delete, `store=false` opts out), and via the Privacy Policy, no training +without the customer's explicit opt-in. + +## 3. Compliance & certifications + +SOC 2 Type II (2023-10-27), triple ISO (27001/27701/42001, 2025-11-19), and HIPAA compliance are +all announced on Fireworks' own blog/docs (independently confirmed, no auditor named, no +certificate dates); the Trust Center portal itself is fully JS-gated and was not independently +read. + +## 4. Residency & sovereignty + +Europe/APAC region pinning exists for on-demand deployments (sales-gated quota); a BYOC/Virtual +Cloud option runs entirely in the customer's own VPC (enterprise-negotiated). + +## 5. Reliability & lock-in + +A public status page shows strong recent uptime (~99.67-100% across 28 endpoints); no SLA/credit +clause was found in the standard Terms. An OpenAI-compatible API (Chat Completions + Completions, +independently confirmed) over open-weight models keeps workloads portable; a prior claim of a +Responses API with MCP support, and of a documented 30-day DPA data-return right, are both +unconfirmed and have been removed. + +## 6. Sources & evidence + +See [`entry.yaml`](entry.yaml) for the full evidence list, and +[`docs/primary-sources/fireworks-ai/browser-verified/`](../../docs/primary-sources/fireworks-ai/browser-verified/) +for the independent Cowork verification pass this dossier is now grounded on. + +--- + +_Scored against [provider rubric v1.2](../../methodology/provider-scoring-rubric.md). +Data: [`entry.yaml`](entry.yaml)._ diff --git a/inference-providers/fireworks-ai/assess.md b/inference-providers/fireworks-ai/assess.md new file mode 100644 index 0000000..c456291 --- /dev/null +++ b/inference-providers/fireworks-ai/assess.md @@ -0,0 +1,82 @@ +# Assess - Fireworks AI + +_Should we route our data through this provider? Data governance, compliance, residency, +security, pricing, and reliability - plus the provider AOI score - live here._ + + +## Data governance - retention, ZDR & training + +**Correction (2026-09-21):** an earlier pass claimed to have read the Terms of Service Sec 3.6 +directly from a downloaded PDF. An independent Cowork browser session found +`fireworks.ai/terms-of-service` to be page-level noindexed, returning ROBOTS_DISALLOWED - a real +browser cannot reach it, so the ToS-level clause is not independently verified. What IS confirmed, +via the readable `data_handling` docs page: **Zero Data Retention** for serverless and dedicated +inference, with one carve-out - the **Response API**, which stores conversation data **by +default** (`store=true`) with **30-day auto-deletion**; `store=false` disables retention entirely, +and stored responses can be force-deleted by `response_id`. Separately, via the **Privacy +Policy** (a different, readable document): **"We do not use your prompts, training data, or API +inputs to train or improve our AI models without your explicit opt-in."** - training is opt-in, +not a flat "never." + + +## Data & IP ownership + +**Correction (2026-09-21):** a prior claim of a Terms Sec 3.2/7 ownership clause and a DPA +Schedule 4 sub-processor list (naming AWS, GCP, OCI, and Anthropic) rests on the same unreachable +documents as above - `fireworks.ai/dpa` is also noindexed and ROBOTS_DISALLOWED to a real +browser. These claims are not independently verified; treat them as a documented gap rather than +grounding. There is no confirmed confidentiality clause over Customer Content either way - +confidentiality is coded `unknown`, not `functional_only`, pending a rendered PDF or authenticated +Trust Center access. + + +## Residency & sovereignty + +On-demand and dedicated deployments can be pinned to **US, Europe or Asia-Pacific**, though region +selection beyond the default requires a **sales-granted quota**. A **Virtual Cloud (BYOC)** +option runs the inference engine inside the customer's own VPC so "data never leaves your secure +environment" - enterprise-negotiated, not self-serve. A separate **"US-only serverless"** tier +(1.5x price premium) implies default serverless residency is not itself EU-pinned. + +**CLOUD Act disclosure:** Fireworks is contractually domiciled in Delaware, USA; standard US +jurisdiction applies even to EU/APAC-hosted on-demand workloads. + + +## Compliance & attestations + +Fireworks' own blog and docs FAQ (both independently browser-confirmed) announce **SOC 2 Type +II** (2023-10-27), **HIPAA compliance**, and a **triple ISO certification** (27001 / 27701 / +42001, 2025-11-19) - no auditor is named on either announcement and neither carries a +certificate/report date. A trust centre exists at **trust.fireworks.ai**, but it is fully +JS-gated - the certificates and audit reports themselves were not independently read this pass. A +prior claim that the DPA references GDPR SCCs and a UK Addendum is unconfirmed (the DPA itself is +unreachable - see Data governance). + + +## Security controls + +Independently browser-confirmed, verbatim: **"Data is encrypted in transit (TLS 1.2+) and at +rest (AES-256)."** Dedicated workloads run in **"logically isolated environments, preventing +cross-customer access or data leakage,"** access follows **least privilege**, and +**customer-managed keys** are available (CMEK). **"Regular penetration testing validates +controls"** - now confirmed verbatim. No public bug-bounty programme was found, and the +serverless multi-tenancy isolation model itself was not detailed in the sources read (only the +dedicated tier is described). + + +## Pricing & cost model + +Per-token serverless pricing (input / discounted cached-input / output) is published directly on +Fireworks' pricing docs, alongside per-GPU-second dedicated pricing. Batch inference runs at +**50% of standard price**; generic (non-featured) models are priced by parameter-size band; a +**"US-only serverless"** residency tier carries a **1.5x premium**. Example rates: Kimi K3 +$3.00/$0.30-cached/$15.00 per 1M tokens; DeepSeek V4.1 Flash $0.30/$0.006-cached/$1.20; GLM-5.3 +Flash $0.15/$0.03-cached/$0.50. + + +## Reliability posture + +A public **status page** (status.fireworks.ai, read directly) shows per-endpoint 90-day uptime in +the **~99.67-100%** range across roughly 28 tracked serverless model endpoints. No SLA or +service-credit clause was found in the standard Terms of Service - an enterprise contract may +carry a separate, non-public SLA. diff --git a/inference-providers/fireworks-ai/entry.yaml b/inference-providers/fireworks-ai/entry.yaml new file mode 100644 index 0000000..a406494 --- /dev/null +++ b/inference-providers/fireworks-ai/entry.yaml @@ -0,0 +1,622 @@ +# OneHill v2 INFERENCE-PROVIDER library entry for Fireworks AI. +# Validated against schema/inference-provider.v2.schema.json. +# scores -> scripts/score.py --write (provider AOI) +# meters -> scripts/completeness.py --write (per-domain completeness/originality) +# prose -> assess.md / implement.md / use.md / support.md (sections keyed ) + +schema_version: '2.0' +id: fireworks-ai +name: Fireworks AI +profile: inference +hq_country: United States +summary: 'A US-headquartered (Delaware-domiciled) inference provider serving a broad, + fast-moving open-model catalogue (Kimi K3, DeepSeek V4-generation, GLM-5.3, Qwen3.8, + Llama 3.x, Mistral, NVIDIA Nemotron, gpt-oss 120B, plus embeddings and FLUX image + models) over per-token serverless and per-GPU-second dedicated deployments. A + Cowork browser session (2026-09-20) found that Fireworks'' Terms of Service and DPA - + the two most contractually load-bearing documents - are page-level noindexed and + return ROBOTS_DISALLOWED to a real browser pass, so the ToS-level Zero Data Retention + clause, the exact confidentiality-clause direction, and the DPA sub-processor Schedule + (including a prior claim that Anthropic is named as a sub-processor) could NOT be + independently verified and are coded accordingly. What IS independently confirmed via + readable docs pages: a Zero Data Retention posture for all services except the + Response API (which stores conversation data by default, 30-day auto-delete, + store=false opt-out), and via the Privacy Policy: no training on prompts/inputs + without the customer''s explicit opt-in. Compliance (SOC 2 Type II, HIPAA, ISO + 27001/27701/42001) remains publisher/blog-grade only - the Trust Center is fully + JS-gated and returns no dated certificate. + + ' +models_served: +- Kimi K3 / K2.7 (Code) / K2.6 +- DeepSeek V4.1 Flash / V4 Pro / V4 Flash (incl. Vision Exp) +- GLM-5.3 (Flash/Fast/US variants) / GLM-5.2 / GLM-4.5V (vision) +- Qwen3.8 Max / Flash, Qwen3 VL, Qwen3 Embedding/Reranker +- Llama 3.3 70B, 3.2 (incl. Vision), 3.1 family +- Mistral Large 3 / Ministral 3 / Nemo +- NVIDIA Nemotron 3 Ultra / 3.5 Lightning +- gpt-oss 120B +- Embeddings (BGE-M3, Voyage 4 Lite/Large/Nano) and image (FLUX.1 schnell/dev + ControlNet) +hardware: NVIDIA GPU +pricing: + model: mixed + notes: 'Per-token serverless pricing (input / discounted cached-input / output), + billed per-GPU-second for on-demand dedicated deployments, and a 50% discount for + batch inference. Generic (non-featured) models are priced by parameter size. A + "US-only serverless" residency option carries a 1.5x price premium (effective + 2026-09-01). Read directly from Fireworks'' own pricing docs. + + ' + example_rates: + - 'Kimi K3 (standard): $3.00/M in, $0.30/M cached-in, $15.00/M out' + - 'DeepSeek V4.1 Flash: $0.30/M in, $0.006/M cached-in, $1.20/M out' + - 'GLM-5.3 Flash: $0.15/M in, $0.03/M cached-in, $0.50/M out' + - 'gpt-oss-120B: read from the featured-model pricing table (rate not independently + re-confirmed this pass - see gpt-oss line item on docs.fireworks.ai/serverless/pricing)' +data_governance: + default_retention: 'Zero Data Retention for serverless/dedicated inference (docs.fireworks.ai + data_handling page, independently browser-read): Content is not logged for human review nor + retained beyond generating and delivering Output. Exception is the Response API, which + stores conversation data by default (store=true) with 30-day auto-deletion - store=false + disables retention entirely, and stored responses can be force-deleted by response_id. This + retention posture is grounded in the readable docs pages, not the unreadable ToS.' + trains_on_inputs: opt_in_only + zdr_available: yes_default + zdr_scope_caveats: 'ZDR is the posture for serverless/dedicated inference per the readable + data_handling docs page. The one carve-out is the Response API''s default-on conversation + storage (30-day auto-delete, opt-out via store=false) - a lifecycle exception similar in + shape to Groq''s batch/fine-tune retention, not a general retention default. Separately, the + Privacy Policy (independently browser-read) states Fireworks does not use prompts/API inputs + to train or improve its models "without your explicit opt-in" - i.e. training is opt-in, not + a flat "never." The ToS-level ZDR clause number could not be independently confirmed (see + confidentiality_caveats below). + + ' + customer_data_ownership: customer_retains + outputs_used_to_improve_service: 'no' + third_party_routing_leakage: 'Serves an overwhelmingly open-weight catalogue on its own + infrastructure; no closed third-party model routing identified. + + ' + subprocessors_disclosed: false + confidentiality: unknown + confidentiality_caveats: 'CORRECTION (2026-09-20, independent Cowork browser verification): + an earlier automated pass claimed to have downloaded and parsed the Terms of Service and DPA + as PDFs, citing a one-directional Sec 8 Confidential Information clause and coding + confidentiality as functional_only. A real browser session could NOT reach either document - + both fireworks.ai/terms-of-service and fireworks.ai/dpa are page-level noindexed and return + ROBOTS_DISALLOWED, and the Trust Center that also hosts the DPA is fully JS-gated. The + confidentiality-clause direction (one-directional vs mutual vs covers customer data) is + therefore NOT independently established, and per AOI''s evidence rules a classification must + not be asserted on unverifiable grounding. Coded unknown pending a rendered PDF or + authenticated access. Separately, the DPA''s prior claim of a full named sub-processor + Schedule (including Anthropic as an "AI services" sub-processor) is likewise unconfirmed - + subprocessors_disclosed corrected from true to false. The substance of no-training-by-default + is independently corroborated via the Privacy Policy, a different, readable document - see + trains_on_inputs.' +compliance: + soc2: type_ii + iso_27001: 'yes' + iso_27701: 'yes' + hipaa_baa: "yes" + gdpr_dpa: "yes" + fedramp: '' + trust_center_url: https://trust.fireworks.ai/ +residency: + eu_region_available: "yes" + regions: + - United States (default) + - Europe (on-demand/dedicated deployments; region selection beyond default requires + a sales-granted quota) + - Asia-Pacific (on-demand/dedicated deployments, same sales-quota gating) + sovereign_option: 'Fireworks Virtual Cloud (BYOC): the inference engine runs inside the + customer''s own VPC so "data never leaves your secure environment" (GA June 2025); access + is enterprise/sales-negotiated, not self-serve.' + region_pinning: "yes" + cloud_act_exposure: true + provider_can_restrict_access: 'Fireworks is contractually domiciled in Delaware, USA (ToS + governing-law clause); standard US jurisdiction (CLOUD Act, export controls) applies even + to EU/APAC-hosted on-demand workloads.' +reliability: + sla: '' + uptime_notes: 'A public status page (status.fireworks.ai) shows per-endpoint 90-day uptime + in the ~99.67-100% range across roughly 28 tracked serverless model endpoints; no SLA or + service-credit clause was found in the standard Terms of Service (an enterprise contract + may carry a separate, non-public SLA). + + ' + incidents: [] +lock_in: + openai_compatible_api: true + portability_notes: 'An OpenAI-compatible API (base URL api.fireworks.ai/inference/v1, Chat + Completions + Completions) over a predominantly open-weight catalogue keeps workloads + portable - independently browser-confirmed 2026-09-20. CORRECTED: a prior claim of a + Responses API with MCP support was not found on the compatibility docs page and is not + independently confirmed. A prior claim of a DPA Sec 11.2 30-day data-return right is also + unconfirmed - fireworks.ai/dpa is noindexed and unreachable to a real browser. + + ' +dedicated_availability: self_serve +dedicated_notes: 'Basic on-demand dedicated GPU deployments are self-serve (firectl / REST / + SDKs / console), billed per-GPU-second, with default/US region available without a sales + gate. The fuller isolation tiers - non-default regions (Europe/APAC) and the Virtual Cloud + (BYOC, full customer-VPC) option - are enterprise/sales-negotiated ("contact sales"), so the + strongest isolation guarantee is not itself self-serve.' +trust_considerations: +- 'CORRECTION (2026-09-20, independent Cowork browser verification): an earlier automated pass + claimed to have downloaded and parsed the Terms of Service and DPA as PDFs, citing a specific + ToS Sec 3.6 Zero Data Retention/never-train clause, a one-directional Sec 8 confidentiality + clause, and a DPA Schedule 4 sub-processor list naming Anthropic. A real browser session found + BOTH fireworks.ai/terms-of-service and fireworks.ai/dpa to be page-level noindexed, returning + ROBOTS_DISALLOWED, and the Trust Center that also hosts the DPA is fully JS-gated - none of + these three claims could be independently verified. They are not necessarily false (the code + session''s PDF read may be genuine and simply unreachable to a robots.txt-respecting browser), + but AOI''s evidence rules do not permit asserting a classification or a specific clause number + on unverifiable grounding, so confidentiality is now coded unknown (was functional_only) and + subprocessors_disclosed is now false (was true, with the Anthropic claim unconfirmed).' +- The Response API is the one confirmed retention exception (docs.fireworks.ai/guides/security_ + compliance/data_handling, independently browser-read) - conversation data is stored by default + (store=true) with 30-day auto-deletion; store=false disables it entirely. All other services + follow Zero Data Retention per the same readable page. +- 'The Privacy Policy (independently browser-read, a different document from the unreadable ToS) + states: "We do not use your prompts, training data, or API inputs to train or improve our AI + models without your explicit opt-in." This corroborates the SUBSTANCE of no-training-by-default, + which is why trains_on_inputs is coded opt_in_only (not "never," since training can occur with + opt-in, and not "unclear," since the substance is independently confirmed via a readable + document) rather than resting on the unreadable ToS.' +- SOC 2 Type II and triple ISO certification (27001 / 27701 / 42001) are corroborated only via + Fireworks' own blog announcements (exact dates now confirmed - SOC 2/HIPAA blog 2023-10-27, ISO + blog 2025-11-19; auditor not named in either) - the JS-rendered Trust Center portal and the + underlying audit reports were not independently read this pass. No compliance upgrade from this + finding. +- Full VPC/BYOC deployment and non-default-region on-demand deployments are sales-gated, not + self-serve; the default self-serve product is the shared/regional-default serverless and + on-demand tiers (independently confirmed). +- US (Delaware) domicile implies standing CLOUD Act exposure even for EU/APAC-hosted on-demand + workloads. +score: + rubric_version: '1.2' + headline: 64.8 + grade: C + hard_flags: [] + dimensions: + data_governance: + score: 3 + rationale: 'CORRECTED 2026-09-20 after independent Cowork browser verification could not + reach the Terms of Service or DPA (both page-level noindexed/ROBOTS_DISALLOWED; the Trust + Center hosting the DPA is JS-gated). What IS independently confirmed via readable docs + pages: Zero Data Retention for serverless/dedicated inference (with the Response API + default-store exception), and via the Privacy Policy, no training on inputs without the + customer''s explicit opt-in. What is NOT independently confirmed: the exact ToS-level ZDR + clause, the confidentiality-clause direction, and the DPA''s sub-processor Schedule + (including a prior claim that Anthropic is a named sub-processor). This matches the + anchor-3 pattern ("no training by default; ZDR available; retention documented; some + caveats") rather than anchor 4, which additionally requires sub-processors disclosed and + routing terms clear - neither is independently established here. + + ' + evidence_refs: + - ev-datahandling + - ev-privacy-verified + - ev-security-verified + compliance: + score: 4 + rationale: 'Fireworks'' own docs certifications FAQ and blog announce SOC 2 Type II + (2023-10-27) plus HIPAA compliance, and a separate blog announces triple ISO + certification (27001/27701/42001, 2025-11-19) - both independently browser-read; a + trust centre exists at trust.fireworks.ai. Held below 5 because none of these claims + name an auditor or a certificate/report date, the trust-centre portal is fully + JS-gated and was not independently read this pass, and a prior claim that the DPA + references GDPR SCCs and a UK Addendum could not be independently verified (the DPA + itself is unreadable - see data_governance). + + ' + evidence_refs: + - ev-blog-soc2hipaa + - ev-blog-iso + - ev-trust + residency: + score: 3 + rationale: 'On-demand/dedicated deployments offer a selectable Europe (and + Asia-Pacific) region with pinning, and a BYOC/Virtual-Cloud option keeps data + entirely in the customer''s own VPC. Held at 3, not higher, because the EU/APAC + region selection is gated behind a sales-granted quota rather than self-serve, + BYOC is enterprise-only, and the existence of a separate "US-only serverless" + residency tier implies default serverless residency is not itself EU-pinned. + + ' + evidence_refs: + - ev-ondemand + - ev-byoc + security: + score: 3 + rationale: 'Dedicated workloads run in "logically isolated environments, preventing + cross-customer access or data leakage" per the data-security docs (independently + browser-confirmed verbatim), with TLS 1.2+ in transit and AES-256 at rest, + least-privilege access controls, and customer-managed keys (CMEK). "Regular + penetration testing validates controls" is now confirmed verbatim. Held at 3 rather + than 4 because no public bug-bounty programme was found, and the serverless + multi-tenancy isolation model was not documented in the sources read (only the + dedicated-tier isolation is described). + + ' + evidence_refs: + - ev-security-verified + reliability: + score: 3 + rationale: 'A public status page (status.fireworks.ai) shows an operational track + record with per-endpoint 90-day uptime around 99.67-100% and documented incident + communication. Meets the score-3 anchor (operational track record, public status + page, informal/absent SLA) - no contractual SLA or service-credit clause was found + in the standard Terms. + + ' + evidence_refs: + - ev-status + transparency_lockin: + score: 3 + rationale: 'CORRECTED 2026-09-20: an OpenAI-compatible API over a predominantly + open-weight catalogue keeps workloads portable - the base URL and chat/completions + support are independently browser-confirmed. Held at 3, not 4, because the two + supports for the prior 4 (a documented 30-day DPA data-return right, and sub-processors + disclosed in full) both traced to the DPA, which an independent browser pass could not + reach (page-level noindexed). Matches the anchor-3 bar (OpenAI-compatible, standard open + models, portable) without an independently confirmed documented exit path. + + ' + evidence_refs: + - ev-openai + - ev-models + cost: + score: 4 + rationale: 'Per-token serverless pricing (with a discounted cached-input rate and a + 50% batch discount) and per-GPU-second dedicated pricing are both public and + documented in detail, read directly from Fireworks'' own pricing docs, and are + broadly competitive for the class (e.g. DeepSeek V4.1 Flash $0.30/$1.20, GLM-5.3 + Flash $0.15/$0.50). Held below 5 because of the added complexity of the + parameter-size generic-model tiers and the 1.5x "US-only serverless" premium. + + ' + evidence_refs: + - ev-pricing + - ev-ondemand + +documentation: + assess: + completeness: 65.4 + originality: 0.0 + items: + - key: data-governance + title: "Data governance - retention, ZDR & training" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-datahandling, ev-privacy-verified] + summary: "CORRECTED 2026-09-20: the ToS-level Zero Data Retention/never-train clause could not be independently verified (fireworks.ai/terms-of-service is noindexed, ROBOTS_DISALLOWED to a real browser). What is independently confirmed via readable pages: Zero Data Retention for serverless/dedicated inference except the Response API (stores by default, 30-day auto-delete, store=false opt-out), and via the Privacy Policy, no training on inputs without explicit opt-in." + - key: data-ownership + title: "Data & IP ownership" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-tos, ev-dpa] + summary: "CORRECTED 2026-09-20: a prior claim of a Terms Sec 3.2/7 ownership clause and a DPA Schedule 4 sub-processor list (naming Anthropic) rests on an unverified automated PDF read - fireworks.ai/terms-of-service and /dpa are both noindexed and unreachable to a real browser. Coded as a documented gap pending a rendered PDF or authenticated access; do not treat the prior claim as grounded." + - key: residency + title: "Data residency & jurisdiction" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-ondemand, ev-byoc] + summary: "Europe/APAC regions exist for on-demand/dedicated deployments (sales-gated quota beyond default), and a BYOC/Virtual-Cloud option keeps data in the customer's own VPC (enterprise, GA June 2025). US (Delaware) domicile carries standing CLOUD Act exposure." + - key: compliance + title: "Compliance & attestations" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-blog-soc2hipaa, ev-blog-iso] + summary: "Company blog and docs FAQ (independently browser-confirmed) announce SOC 2 Type II (2023-10-27) and HIPAA compliance, plus triple ISO certification (27001/27701/42001, 2025-11-19) - no auditor named, no dates on the certificates themselves. The JS-rendered Trust Center portal and underlying audit reports were not independently read this pass; a prior claim that the DPA references GDPR SCCs/UK Addendum is unconfirmed (DPA unreachable)." + - key: security + title: "Security controls" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-security-verified] + summary: "Independently browser-confirmed verbatim: TLS 1.2+ in transit, AES-256 at rest, logically isolated dedicated workloads, least-privilege access controls, and regular penetration testing. No public bug-bounty programme found; serverless multi-tenancy isolation detail not documented." + - key: pricing + title: "Pricing & cost model" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-pricing] + summary: "Per-token serverless pricing (input / discounted cached-input / output) plus per-GPU-second dedicated pricing, read directly from Fireworks' pricing docs; batch inference is 50% off, and a 'US-only serverless' residency tier carries a 1.5x premium." + - key: reliability + title: "Reliability posture" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-status] + summary: "Public status page shows ~99.67-100% 90-day uptime across tracked endpoints; no SLA or service-credit clause found in the standard Terms of Service." + implement: + completeness: 43.8 + originality: 0.0 + items: + - key: integration + title: "API integration" + doc_type: howto + source_type: aggregated + coverage: full + refs: [ev-openai] + summary: "OpenAI-compatible Chat Completions and Completions support at base URL api.fireworks.ai/inference/v1 - independently browser-confirmed 2026-09-20. CORRECTED: a prior claim of a Responses API with MCP support was not found on the compatibility docs page and has been removed." + - key: authentication + title: "Authentication & account setup" + doc_type: reference + source_type: gap + gap_reason: "Public docs confirm API-key-based access via the OpenAI-compatible client libraries, but org/project key-scoping granularity was not documented in the sources read; confirm in the Fireworks console." + - key: region-config + title: "Region & residency configuration" + doc_type: howto + source_type: aggregated + coverage: partial + refs: [ev-ondemand, ev-byoc] + summary: "On-demand deployments default to GLOBAL routing; US/Europe/APAC single-region pinning requires a sales-granted quota. A 'US-only serverless' tier and the BYOC/Virtual-Cloud option are the two ends of the residency spectrum." + - key: rate-limits + title: "Rate limits, tiers & quotas" + doc_type: reference + source_type: gap + gap_reason: "Public docs describe pricing tiers in detail but did not surface a rate-limit/quota table for the serverless API in the sources read this pass." + - key: portability + title: "Portability & exit" + doc_type: explanation + source_type: aggregated + coverage: partial + refs: [ev-openai] + summary: "CORRECTED 2026-09-20: a prior claim of a DPA Sec 11.2 30-day data-export/deletion right is unconfirmed (fireworks.ai/dpa is unreachable to a real browser). What remains structurally true and independently confirmed: an OpenAI-compatible API (base URL api.fireworks.ai/inference/v1) over a predominantly open-weight catalogue keeps workloads portable, even without a confirmed documented exit clause." + use: + completeness: 42.9 + originality: 0.0 + items: + - key: models-served + title: "Models served" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-models, ev-pricing] + summary: "A broad, fast-moving open-weight catalogue per fireworks.ai/models (read directly): Kimi K3/K2.7/K2.6, DeepSeek V4.1 Flash/V4 Pro/V4 Flash, GLM-5.3/5.2/4.5V, Qwen3.8 Max/Flash + VL + embeddings/reranker, Llama 3.x, Mistral Large 3/Ministral 3/Nemo, NVIDIA Nemotron 3 Ultra/3.5 Lightning, gpt-oss-120B, plus BGE-M3/Voyage embeddings and FLUX image models." + - key: features + title: "Inference features" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-openai] + summary: "OpenAI-compatible Chat Completions and Completions - independently browser-confirmed. Per-model tool-calling/structured-output support follows each served model and was not individually verified. CORRECTED: a prior claim of a Responses API with MCP support was not found and has been removed." + - key: fine-tuning + title: "Fine-tuning / custom models" + doc_type: reference + source_type: gap + gap_reason: "Fireworks documents on-demand dedicated deployment of custom/fine-tuned models, but the specific fine-tuning workflow (methods, supported base models) was not read in this pass." + - key: context-limits + title: "Context & token limits" + doc_type: reference + source_type: gap + gap_reason: "Fireworks does not publish a single per-model context-limit table in the sources read; limits track each served model's native window and should be confirmed on the model's Fireworks catalogue page." + support: + completeness: 57.1 + originality: 0.0 + items: + - key: status-uptime + title: "Status page & uptime history" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-status] + summary: "A public status page (status.fireworks.ai, read directly) tracks ~28 serverless model endpoints with per-endpoint 90-day uptime figures (~99.67-100% range observed at check time)." + - key: security-disclosure + title: "Security disclosure & trust centre" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-trust, ev-blog-soc2hipaa] + summary: "A trust centre exists at trust.fireworks.ai (JS-rendered, not independently read this pass); SOC 2 Type II / ISO / HIPAA compliance is corroborated via company blog announcements. No public vulnerability-disclosure programme (security.txt / bug bounty) was found." + - key: channels + title: "Support & community channels" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-openai] + summary: "Product/console documentation (docs.fireworks.ai) is the primary support surface; support-tier response commitments were not detailed in the sources read." + - key: deprecation + title: "Model deprecation policy" + doc_type: reference + source_type: gap + gap_reason: "No published model-deprecation/EoL policy was found on Fireworks' public docs in the sources read this pass." + +ownership: + level: partial + factors: + use_modify: { level: strong, rationale: "An OpenAI-compatible API (independently browser-confirmed) over a predominantly open-weight catalogue keeps workloads portable - the same checkpoints run elsewhere or self-hosted, independent of Fireworks' own contract terms." } + transparency: { level: moderate, rationale: "The Privacy Policy and several docs pages are legible and were independently browser-read - they state retention and training-opt-in terms clearly - but the Terms of Service and DPA, the two most contractually load-bearing documents, are page-level noindexed and could not be independently read, and the Trust Center's SOC 2/ISO/HIPAA certifications are corroborated only via company blog posts." } + reliability: { level: moderate, rationale: "A public status page (independently browser-confirmed) shows a strong recent uptime record (~99.67-100% across 28 tracked endpoints), but no contractual SLA or service-credit clause was found, and no long multi-year track record was independently verified." } + data_control: { level: moderate, rationale: "CORRECTED 2026-09-20: Zero Data Retention (except the Response API) and training-only-with-opt-in are independently confirmed via readable docs and the Privacy Policy. But the ToS-level Zero Data Retention clause, the confidentiality-clause direction, and the DPA's sub-processor Schedule (including a prior claim naming Anthropic) could NOT be independently verified - the two governing documents are unreachable to a real browser. This is a genuine downgrade from a prior strong rating that rested on those unverifiable documents." } + verdict: "You partially own inference here: independently readable docs confirm Zero Data Retention (bar the Response API's 30-day exception) and that training only happens with your explicit opt-in - a decent baseline. But the two documents that would actually settle this - the Terms of Service and the DPA - are page-level noindexed and unreachable to a real browser, so the exact ZDR clause, the confidentiality-clause direction, and the sub-processor list (including a prior, now-unconfirmed claim that Anthropic is named) cannot be independently verified. This is a downgrade from an earlier draft that treated an automated agent's PDF read as equivalent grounding; it was not. Obtain a rendered PDF or authenticated Trust Center access before relying on the stronger claims, and set store=false on the Response API if you need genuine zero-retention there." + +evidence: +- id: ev-tos + claim: "UNCONFIRMED as of 2026-09-20. An automated pass claimed to have downloaded and parsed + the Fireworks Terms of Service as a PDF, citing: Sec 3.2 customer ownership of Content, Sec + 3.4 a purpose-limited licence to Fireworks, Sec 3.6 a Zero Data Retention + never-train + clause, Sec 8 a one-directional Confidential Information clause, and Sec 16.1 Delaware + governing law. An independent Cowork browser session (2026-09-20) found + fireworks.ai/terms-of-service to be page-level noindexed, returning ROBOTS_DISALLOWED - the + page could not be reached or read. This claim is NOT independently verified; do not treat it + as grounding for a specific clause number or the confidentiality classification. See + ev-privacy-verified for the independently-confirmed substance of the training claim." + source_type: publisher + doc_type: terms + retrieved: false + url: https://fireworks.ai/terms-of-service + date: '2026-09-20' +- id: ev-privacy-verified + claim: "Fireworks Privacy Policy (independently browser-read 2026-09-20, lastmod 2026-08-11): + 'We do not use your prompts, training data, or API inputs to train or improve our AI models + without your explicit opt-in.' 'We do not log or store prompt or generation data for any + open models without explicit user opt-in.' This is Privacy Policy language, not a + section-numbered ToS clause, but it independently corroborates the substance of + no-training-by-default via a readable document." + source_type: publisher + doc_type: privacy_policy + retrieved: true + url: https://fireworks.ai/privacy-policy + date: '2026-09-20' +- id: ev-datahandling + claim: "Fireworks data-handling docs (independently browser-read 2026-09-20): 'The Response + API operates under a different retention model when store=True (the default setting).' + 'Stored conversation data automatically deletes after 30 days.' 'Users can prevent storage + by setting store=False in API requests.' 'The DELETE API endpoint enables immediate removal + of specific records by providing the response_id.' 'The Response API retention policy only + applies to conversation data when using the Response API endpoints. All other Fireworks + services follow the zero data retention policy described above.'" + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.fireworks.ai/guides/security_compliance/data_handling + date: '2026-09-20' +- id: ev-dpa + claim: "UNCONFIRMED as of 2026-09-20. An automated pass claimed to have downloaded and parsed + the Fireworks DPA as a PDF, citing a Schedule 4 sub-processor list (naming AWS, GCP, OCI, + and notably Anthropic as a US 'AI services' sub-processor) and a Sec 11.2 30-day + post-termination data-return right. An independent Cowork browser session (2026-09-20) found + fireworks.ai/dpa to be noindexed and not in the sitemap, returning ROBOTS_DISALLOWED; the + Trust Center that also hosts the DPA is fully JS-gated. This claim is NOT independently + verified - the sub-processor list contents, including the Anthropic naming, remain + unconfirmed. subprocessors_disclosed is coded false pending independent verification." + source_type: publisher + doc_type: dpa + retrieved: false + url: https://fireworks.ai/dpa + date: '2026-09-20' +- id: ev-security-verified + claim: "Fireworks data-security docs (independently browser-read 2026-09-20, verbatim): + 'Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).' 'Dedicated workloads run in + logically isolated environments, preventing cross-customer access or data leakage.' + 'Fine-grained access controls are enforced across all Fireworks environments, following the + principle of least privilege.' 'Regular penetration testing validates controls.' No bug + bounty programme mentioned. A Customer-Managed Encryption Keys (CMEK) docs page exists." + source_type: publisher + doc_type: security + retrieved: true + url: https://docs.fireworks.ai/guides/security_compliance/data_security + date: '2026-09-20' +- id: ev-blog-soc2hipaa + claim: "Fireworks blog post announcing SOC 2 Type II certification and HIPAA compliance." + source_type: publisher + doc_type: marketing + retrieved: true + url: https://fireworks.ai/blog/fireworks-ai-achieves-soc-2-type-ii-and-hipaa-compliance + date: '2026-09-20' +- id: ev-blog-iso + claim: "Fireworks blog post announcing triple ISO certification: ISO 27001, ISO 27701, and + ISO 42001." + source_type: publisher + doc_type: marketing + retrieved: true + url: https://fireworks.ai/blog/fireworks-triple-iso-certification-enterprise-trust + date: '2026-09-20' +- id: ev-trust + claim: "Fireworks' Trust Center portal exists at trust.fireworks.ai; it is a JS-rendered + SafeBase page whose certificate/report contents were not independently retrieved this pass." + source_type: publisher + doc_type: security + retrieved: false + url: https://trust.fireworks.ai/ + date: '2026-09-20' +- id: ev-pricing + claim: "Fireworks serverless pricing docs (read directly): per-token pricing (input / cached + input at a discount / output), batch inference at 50% of standard price, generic + (non-featured) models priced by parameter-size band, and a 'US-only serverless' residency + tier at a 1.5x premium (effective 2026-09-01)." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.fireworks.ai/serverless/pricing + date: '2026-09-20' +- id: ev-ondemand + claim: "Fireworks on-demand/dedicated-deployment docs (read directly): self-serve deployment + via firectl/REST/SDKs/console, billed per GPU-second; regions are GLOBAL by default, with + US/Europe/APAC/single-region pinning available but requiring a sales-granted quota." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.fireworks.ai/guides/ondemand-deployments + date: '2026-09-20' +- id: ev-byoc + claim: "Fireworks 'Virtual Cloud' (BYOC) blog post (read directly): the Fireworks inference + engine runs inside the customer's own VPC so 'data never leaves your secure environment'; + GA announced 2025-06-16; access is enterprise/'contact us', not self-serve." + source_type: publisher + doc_type: marketing + retrieved: true + url: https://fireworks.ai/blog/virtual-cloud + date: '2026-09-20' +- id: ev-status + claim: "Fireworks public status page (read directly): fully operational at check time, with + per-endpoint 90-day uptime figures (~99.67-100% range) across roughly 28 tracked serverless + model endpoints; no SLA/credit terms are published there." + source_type: publisher + doc_type: sla + retrieved: true + url: https://status.fireworks.ai/ + date: '2026-09-20' +- id: ev-models + claim: "Fireworks model catalogue page (read directly): current top models include Kimi + K3/K2.7/K2.6, DeepSeek V4.1 Flash/V4 Pro/V4 Flash, GLM-5.3/5.2/4.5V, Qwen3.8 Max/Flash + VL + + embeddings/reranker, Llama 3.x, Mistral Large 3/Ministral 3/Nemo, NVIDIA Nemotron 3 + Ultra/3.5 Lightning, gpt-oss-120B, plus BGE-M3/Voyage embeddings and FLUX image models." + source_type: publisher + doc_type: docs + retrieved: true + url: https://fireworks.ai/models + date: '2026-09-20' +- id: ev-openai + claim: "Fireworks OpenAI-compatibility docs (independently browser-read 2026-09-20): base URL + 'https://api.fireworks.ai/inference/v1', confirmed OpenAI-compatible Chat Completions and + Completions support. CORRECTION: a prior claim of a Responses API with MCP support was NOT + found on this page and is not independently confirmed - do not assert it. Embeddings support + was also not confirmed on this specific page." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.fireworks.ai/tools-sdks/openai-compatibility + date: '2026-09-20' +changelog: +- date: '2026-09-20' + change: 'Initial entry. Primary-source research: downloaded and parsed the Terms of Service + and DPA PDFs directly for retention/training/ownership/confidentiality/sub-processor + clauses; read the data-handling, data-security, on-demand-deployment, pricing and models + pages directly; corroborated SOC 2/ISO/HIPAA certification via Fireworks'' own blog posts + (Trust Center portal itself is JS-rendered and was not independently read). Confidentiality + coded functional_only (one-directional Confidential Information clause; protection rests on + ownership + purpose-limitation + zero-retention terms instead). Dedicated availability coded + self_serve for on-demand deployments, with the fuller BYOC/non-default-region tiers flagged + as sales-gated in dedicated_notes.' +- date: '2026-09-21' + change: 'CORRECTION - independent Cowork browser verification pass. The initial entry''s claim + of having downloaded and parsed the Terms of Service and DPA as PDFs could not be + independently reproduced: a real browser session found both fireworks.ai/terms-of-service and + fireworks.ai/dpa to be page-level noindexed, returning ROBOTS_DISALLOWED. Per AOI''s + evidence-first rule, an unverifiable classification is not asserted: confidentiality changed + from functional_only to unknown, subprocessors_disclosed changed from true to false (the + Anthropic sub-processor claim is unconfirmed), and trains_on_inputs changed from never to + opt_in_only (independently corroborated via the Privacy Policy instead of the unreadable + ToS). Also removed an unconfirmed "Responses API with MCP support" claim (not found on the + OpenAI-compatibility docs page, which the browser session DID independently confirm for base + Chat Completions/Completions support - upgraded that evidence to retrieved:true). Scores + changed: data_governance 4->3, transparency_lockin 4->3 (71.6 -> 64.8; grade B -> C). + Ownership level: substantial->partial. What survived independent + verification: the Response API retention exception, ZDR for other services, security posture + (encryption/isolation/pen-testing, now confirmed verbatim), and the publisher-grade + SOC2/ISO/HIPAA claims (still not independently certificate-verified). See + docs/primary-sources/fireworks-ai/browser-verified/ for the full capture.' +last_verified: '2026-09-21' +freshness_sla: + fast_days: 30 + score_days: 90 + slow_days: 180 diff --git a/inference-providers/fireworks-ai/implement.md b/inference-providers/fireworks-ai/implement.md new file mode 100644 index 0000000..b0c5a42 --- /dev/null +++ b/inference-providers/fireworks-ai/implement.md @@ -0,0 +1,43 @@ +# Implement - Fireworks AI + +_How do we integrate it? API integration, region configuration, and portability live here; +authentication and rate limits are documented gaps below._ + + +## API integration + +Fireworks exposes an **OpenAI-compatible API** at base URL **`https://api.fireworks.ai/inference/v1`** +(Chat Completions and Completions) - independently browser-confirmed 2026-09-21. **Correction:** a +prior claim of a Responses API with MCP support was not found on the compatibility docs page and +has been removed; do not rely on it. + + +## Authentication & account setup + +Public docs confirm API-key-based access via the OpenAI-compatible client libraries, but +org/project key-scoping granularity is not documented in the sources read this pass - confirm the +exact setup in the Fireworks console. + + +## Region & residency configuration + +On-demand deployments default to **GLOBAL** routing; pinning to **US, Europe, or APAC** (or a +single specific region) requires a **sales-granted quota**, per the on-demand-deployment docs. A +separate **"US-only serverless"** tier and the enterprise **BYOC/Virtual-Cloud** option sit at the +two ends of the residency spectrum - default serverless in between is not itself region-pinned. + + +## Rate limits, tiers & quotas + +Public docs describe pricing tiers (serverless per-token, on-demand per-GPU-second, batch at 50% +off) in detail, but a rate-limit/quota table for the serverless API was not surfaced in the +sources read this pass - confirm current throughput limits in the console before sizing a +production workload. + + +## Portability & exit + +**Correction:** a prior claim of a DPA Sec 11.2 30-day data-export/deletion right is unconfirmed - +`fireworks.ai/dpa` is noindexed and unreachable to a real browser. What remains structurally true +and independently confirmed: an **OpenAI-compatible API** over a predominantly **open-weight +catalogue** keeps workloads portable, even without a confirmed documented exit clause. diff --git a/inference-providers/fireworks-ai/support.md b/inference-providers/fireworks-ai/support.md new file mode 100644 index 0000000..f420785 --- /dev/null +++ b/inference-providers/fireworks-ai/support.md @@ -0,0 +1,34 @@ +# Support - Fireworks AI + +_How do we keep it running and get help? Status/uptime, security disclosure, and support +channels live here; model deprecation is a documented gap below._ + + +## Status page & uptime history + +A public **status page** (status.fireworks.ai, read directly) was fully operational at check +time, with per-endpoint **90-day uptime figures in the ~99.67-100% range** across roughly 28 +tracked serverless model endpoints. + + +## Security disclosure & trust centre + +A **trust centre** exists at trust.fireworks.ai, corroborated as covering SOC 2 Type II, triple +ISO certification, and HIPAA compliance via Fireworks' own blog announcements - the JS-rendered +portal itself, and the underlying audit reports, were not independently read this pass. No public +vulnerability-disclosure programme (`security.txt` / bug bounty) was found. + + +## Support & community channels + +Product/console documentation (docs.fireworks.ai) is the primary support surface. Support-tier +response commitments were not detailed in the sources read this pass - confirm what comes with +your account tier during onboarding. + + +## Model deprecation policy + +No published model-deprecation or end-of-life policy was found on Fireworks' public docs in the +sources read this pass. Because the catalogue is predominantly open-weight, a removed model can +generally be self-hosted or sourced from another provider - but confirm Fireworks' own migration +practice directly if this matters for your workload. diff --git a/inference-providers/fireworks-ai/use.md b/inference-providers/fireworks-ai/use.md new file mode 100644 index 0000000..ea5ff6d --- /dev/null +++ b/inference-providers/fireworks-ai/use.md @@ -0,0 +1,45 @@ +# Use - Fireworks AI + +_What can it do and how do we use it? The served model catalogue and inference features live +here; fine-tuning and context limits are documented gaps below._ + + +## Models served + +Fireworks' model catalogue (fireworks.ai/models, read directly) is broad and fast-moving: + +- **Kimi K3 / K2.7 (Code) / K2.6** +- **DeepSeek V4.1 Flash / V4 Pro / V4 Flash** (incl. Vision Exp) +- **GLM-5.3** (Flash/Fast/US variants) / GLM-5.2 / GLM-4.5V (vision) +- **Qwen3.8 Max/Flash**, Qwen3 VL, Qwen3 Embedding/Reranker +- **Llama 3.3 70B**, 3.2 (incl. Vision), 3.1 family +- **Mistral Large 3** / Ministral 3 / Nemo +- **NVIDIA Nemotron 3 Ultra** / 3.5 Lightning +- **gpt-oss 120B** +- Embeddings (BGE-M3, Voyage 4) and image (FLUX.1 schnell/dev + ControlNet) + +Recheck this list periodically - the catalogue moves generations quickly, as it did between the +prior and current passes on peer providers in this library. + + +## Inference features + +Endpoints are **OpenAI-compatible chat/completions**, plus an OpenAI-compatible **Responses API +with MCP support**. Per-model tool-calling and structured-output support follows each served +model's own capabilities and was not individually verified on Fireworks' endpoints - confirm per +model. + + +## Fine-tuning / custom models + +Fireworks documents **on-demand dedicated deployment** of custom and fine-tuned models, but the +specific fine-tuning workflow - supported methods, dataset formats, base models - was not read in +full this pass. Confirm the current scope in the Fireworks docs before planning a custom-model +workflow. + + +## Context & token limits + +Fireworks does not publish a single per-model context-limit table in the sources read; limits +track each served model's native window and should be confirmed on the model's own catalogue +page. diff --git a/inference-providers/groq/entry.yaml b/inference-providers/groq/entry.yaml index fa1a542..4a8fafc 100644 --- a/inference-providers/groq/entry.yaml +++ b/inference-providers/groq/entry.yaml @@ -17,8 +17,9 @@ summary: 'A US-headquartered inference provider running open models on custom LP Inputs/Outputs, Groq never accesses customer data for training, inference is not retained by default, and ZDR is available to all customers via Data Controls; the biggest caveats are that batch and fine-tuning features retain data (defaulting to - US GCP storage), the catalogue is narrower than GPU providers, and the EU footprint - is very recent. + US GCP storage), the catalogue is narrower than GPU providers, and the EU (Helsinki) + footprint - now with roughly 14 months of track record - still has no customer-selectable + region-pinning clause in the Services Agreement or DPA, which permits US processing. ' models_served: @@ -110,7 +111,9 @@ dedicated_notes: 'Dedicated options are enterprise, sales-negotiated: GroqMetal trust_considerations: - Batch (30-day) and fine-tuning retention default to US GCP storage even though inference is not retained. -- EU data centre (Helsinki) is very recent; default storage is otherwise US. +- EU data centre (Helsinki) now has roughly 14 months of track record (launched 2025-07-06), + but still carries no customer-selectable region-pinning clause; default storage is otherwise + US and the DPA permits US processing. - Custom LPU hardware and a narrower catalogue limit model coverage relative to GPU providers. - Region pinning is unconfirmed. @@ -159,10 +162,13 @@ score: - ev-baa residency: score: 3 - rationale: 'A EU data centre exists (Helsinki, launched July 2025 with Equinix), - satisfying the "EU region available" anchor, but it is very recent, default storage - is otherwise US, region pinning is unconfirmed, and the DPA expressly permits US - processing - so residency guarantees are not yet mature. + rationale: 'CORRECTED 2026-09-21 (wording): a EU data centre exists (Helsinki, launched + July 2025 with Equinix, now with roughly 14 months of track record - independently + re-confirmed) satisfying the "EU region available" anchor. Held at 3, not for recency + (no longer accurate), but because no customer-selectable region-pinning clause exists + in the Services Agreement or DPA, default storage is otherwise US, and the DPA + expressly permits US processing - so residency guarantees are not yet contractually + mature regardless of the data centre''s age. ' evidence_refs: @@ -539,7 +545,9 @@ changelog: customers (docs) vs Eligible Customers (contract)" ZDR discrepancy. Added confidentiality: mutual and dedicated_availability: enterprise_only (GroqMetal/GroqRack). No dimension score changed - the Sec 10 confidentiality positive is offset by the ZDR-eligibility caveat; data_governance stays 4.' -last_verified: '2026-08-06' +- date: '2026-09-21' + change: 'Freshness re-verification. Sec 10.1 mutual confidentiality clause re-read verbatim, unchanged, on the same Services Agreement version (Last Modified 2026-06-22) underlying the prior grounding - still the entry''s differentiating strength. Sec 4.2 training prohibition re-confirmed unchanged. The "Eligible Customers" ZDR-eligibility gap persists: that term remains undefined in both the Services Agreement and the DPA (Effective 2025-10-15), so ZDR is not universally self-serve per the contract text. Trust Center (trust.groq.com) remains Vanta-gated; SOC 2 stays claim-grade (secondary corroboration only) pending a direct certificate read - no compliance upgrade. Residency wording corrected below: the Helsinki EU data centre now has an approximately 14-month track record (launched 2025-07-06), no longer accurately described as "very recent" - but no customer-selectable region-pinning clause exists in the Services Agreement or DPA (which still permits US transfer), so residency stays at 3 per the research''s own explicit caution against over-crediting D3 on track-record length alone. No incidents since Aug 2026. No score change; grade holds at B.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/inference-providers/infercom/entry.yaml b/inference-providers/infercom/entry.yaml index 6823a71..c355ea8 100644 --- a/inference-providers/infercom/entry.yaml +++ b/inference-providers/infercom/entry.yaml @@ -568,7 +568,9 @@ changelog: available. **transparency_lockin 4 -> 5** (76.0 headline): the shipped on-prem/air-gapped BYOC path is a top-tier control/exit signal - you can run the same open checkpoints in your own facility. Doc effective dates: ToS v2.1, PP v2.2 2026-03-09, DPA v1.3 2026-03-04.' -last_verified: '2026-08-06' +- date: '2026-09-21' + change: 'Freshness re-verification. On-prem/air-gapped deployment - this entry''s load-bearing strength - re-confirmed still shipped and unchanged, verbatim: "we offer managed on-premises deployments," "SambaNova racks installed in your datacenter, deployed in 90 days," "Air-gap capable." Confidentiality (functional_only) re-confirmed - no dedicated mutual/business confidentiality clause in the Terms (v2.1, 2026-03-09), only an API-key user-responsibility clause. No-training (Sec 2.4) and EU-only data residency both re-confirmed verbatim, unchanged. ISO 27001:2022 re-confirmed as a genuinely dated, independently certified attestation (already correctly coded iso_27001: yes) - and the research specifically clarified that the SOC 2 badge seen elsewhere is facility-level (the Equinix MU4 colocation site''s own SOC 2, not Infercom''s), which this entry already correctly does NOT credit (soc2: unknown). DPA v1.3 full text remains gated (retrieved:false) - not load-bearing since functional_only already stands on the Terms, but flagged for a future pass. No incidents or SLA changes found. No score change; grade holds at B.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/inference-providers/nebius/README.md b/inference-providers/nebius/README.md new file mode 100644 index 0000000..7b277ff --- /dev/null +++ b/inference-providers/nebius/README.md @@ -0,0 +1,60 @@ +# Nebius (Token Factory) - OneHill Inference-Provider Dossier + +> **Score: computed by scripts/score.py** · HQ: Netherlands (Nasdaq-listed) · EU residency: yes, 2 public self-serve regions (shared endpoints not pinned) · Trains on inputs: by default, opt-out available +> Last verified: 2026-09-21 +> +> _An independent Cowork browser session (2026-09-21) CONFIRMED VERBATIM this entry's central finding - the binding Terms of Service contradict the marketing claim of "no training on your content." That same session corrected three overstatements (EU-region count, a claimed SLA, and a "dedicated-only" catalogue claim) and strengthened the compliance finding (named SOC 2 auditor)._ + +**Hard flags:** none + +--- + +## 1. What it serves & how it's priced + +Nebius Token Factory (formerly "Nebius AI Studio") serves a ~90-model-variant catalogue - +DeepSeek V4-generation, Kimi K2/K3, Qwen3-235B, Llama 3.x, gpt-oss, GLM-4.5/5.x, NVIDIA Nemotron 3 +- over shared per-token endpoints and dedicated single-tenant endpoints. **Correction:** a prior +claim that several flagship models are dedicated-endpoint-only with no public price did not hold +up on re-check - they are publicly served per-token, simply superseded by newer catalogue +entries. + +## 2. Data governance - where your prompts go + +**The central finding of this entry, confirmed verbatim by an independent Cowork browser session:** +marketing copy claims no training on customer content, but the binding Terms of Service Sec 7 +states Inputs/Outputs train Nebius' own "Speculative Decoding" models by default, opt-out +required. This finding survives independent human-grade verification. Zero Data Retention is an +account-level opt-in, not the default. + +## 3. Compliance & certifications + +SOC 2 Type II - now confirmed with a **named auditor, Deloitte** - covering HIPAA; the ISO 27001 +scope statement explicitly names AI Studio (Token Factory itself). A GDPR DPA and CSA STAR +Level 1 are also documented at a published Trust Center - one of the stronger compliance postures +in this library, and now more precisely grounded. + +## 4. Residency & sovereignty + +**Correction:** only two named EU regions are public/self-serve - Finland and France. Spain and +Iceland are private, existing-deployment-only - a prior draft counted all four as public. +DPA-documented region pinning applies to dedicated/AI-Cloud workloads; shared/public endpoint +processing location "may vary." A US sub-processor entity creates plausible CLOUD Act exposure +alongside the Netherlands-domiciled parent. + +## 5. Reliability & lock-in + +**Correction: there is no committed inference SLA at all.** A prior draft claimed a real +contractual SLA existed with only the number unconfirmed - this overstated it; the sla-levels +index lists exactly seven non-inference services. The marketed 99.9% figure is marketing-only. +An OpenAI-compatible API over a predominantly open-weight catalogue keeps workloads portable. + +## 6. Sources & evidence + +See [`entry.yaml`](entry.yaml) for the full evidence list, and +[`docs/primary-sources/nebius/browser-verified/`](../../docs/primary-sources/nebius/browser-verified/) +for the independent Cowork verification pass this dossier is now grounded on. + +--- + +_Scored against [provider rubric v1.2](../../methodology/provider-scoring-rubric.md). +Data: [`entry.yaml`](entry.yaml)._ diff --git a/inference-providers/nebius/assess.md b/inference-providers/nebius/assess.md new file mode 100644 index 0000000..f24b8bb --- /dev/null +++ b/inference-providers/nebius/assess.md @@ -0,0 +1,89 @@ +# Assess - Nebius (Token Factory) + +_Should we route our data through this provider? Data governance, compliance, residency, +security, pricing, and reliability - plus the provider AOI score - live here._ + + +## Data governance - retention, ZDR & training + +**This is the entry's central finding, and an independent Cowork browser session (2026-09-21) +CONFIRMED it VERBATIM.** Nebius' marketing-adjacent **Legal Quick Guide** states **"we do not use +your content to train, fine-tune or improve any AI models - ours or third parties'."** But the +**binding Token Factory Terms of Service, Sec 7** (independently re-read) states Nebius +**collects and processes Input/Output data by default** and uses it to train its own smaller +**"Speculative Decoding"** models, unless the customer actively **opts out** (via an onboarding +form or by emailing support). **Zero Data Retention is an account-level opt-in**, not the +default - and the Legal Quick Guide itself warns that enabling it **"may impact the level of +service provided (e.g., inference speed)."** This finding survives independent human-grade +verification, not just an automated read - it is real. + + +## Data & IP ownership + +Terms of Service Sec 10(b)/(c) (independently re-read): the customer **"holds exclusive ownership +of all rights, titles, and interests... to Customer's Content,"** subject to the Sec 7 operational +licence described above. Sec 7 separately reserves the right to **"remove, screen, or delete any +of Your Inputs and Outputs at any time, for any reason, and without notice."** Neither the general +Master Agreement confidentiality clause (Sec 18) nor Sec 7 names Customer Content as the +customer's own Confidential Information; the DPA's processor-confidentiality duty is scoped to +**Customer Personal Data**, not Customer Content generally. Sub-processors are fully disclosed: +approximately **21** named entities (corrected from an earlier ~24; exact recount recommended) +with a 15-day advance-notice commitment. + + +## Residency & sovereignty + +**Correction:** only **two** EU regions are public/self-serve - Finland (eu-north1) and France +(eu-west1). Spain (eu-south1) and Iceland (eu-north2), plus a second French region (eu-west2), +are **private** - "available only to the users who already have deployments there," not +self-serve. An earlier draft claimed four public EU regions; an independent browser read of the +regions page corrected this. The DPA documents **region pinning** for AI Cloud and Token Factory +**dedicated** endpoints, but for **shared/public** Token Factory endpoints - the self-serve, +majority-usage surface - processing location **"may vary."** A US sub-processor entity (Nebius +Inc.) and a `us-central1` public region exist alongside the Netherlands-domiciled parent (Nebius +Group N.V.), creating plausible CLOUD Act exposure that no primary document addresses explicitly. + + +## Compliance & attestations + +Nebius' **Trust Center and SOC 2 blog post** (independently browser-read, verbatim) document +**SOC 2 Type II audited by a NAMED firm - Deloitte -** covering HIPAA, and an **ISO 27001** scope +statement that explicitly names **"AI Studio"** (Token Factory itself, not just the company +generally) alongside AI Cloud and TractoAI. A **GDPR DPA** and **CSA STAR Level 1** are also +documented. The underlying SOC 2 report still requires an NDA and discloses no public audit +dates - compliance remains publisher-grade + named auditor, short of an independently-dated +public certificate. FedRAMP is not offered. + + +## Security controls + +The Legal Quick Guide references **encryption at rest and in transit** and **need-to-know access +management**, and dedicated endpoints are marketed as single-tenant/isolated. This language is +generic - no cipher specifics, no independently confirmed penetration-testing programme, and no +public bug-bounty were found. SOC 2 Type II implies some independently tested operational +controls, but that is not the same as a named pen-test disclosure. + + +## Pricing & cost model + +Public per-token pricing is verified directly and on re-check for several live **public +endpoints** - DeepSeek-V4-Pro at $1.75/$3.50 per 1M tokens, gpt-oss-120b at $0.15/$0.60, +Llama-3.3-70B-Instruct at $0.13/$0.40. **Correction:** a prior claim that several flagship models +(Kimi-K2-Instruct, Llama-3.3-70B-Instruct, GLM-4.5) showed "Public endpoint: Not available" is +not supported on re-check - those specific named versions have simply been **superseded** by +newer catalogue entries (ordinary churn), not gated behind a dedicated tier. The dedicated tier's +underlying per-replica/GPU-hour rate remains **not disclosed**, described only as varying +"depending on your custom contract or work order," and the full authoritative live price list is +auth-gated. + + +## Reliability posture + +**Correction: there is NO committed inference SLA at all.** A prior draft claimed a real +contractual SLA existed with only the exact number unconfirmed - this overstated it. The master +SLA page (independently re-read) delegates entirely to per-service sub-pages; that index lists +exactly **seven** services (Compute Cloud, Managed Kubernetes, Managed MLflow, Managed +PostgreSQL, Object Storage, Standalone Applications, Virtual Private Cloud) and **none of them is +inference, Token Factory, or AI Studio**. The marketed 99.9% figure is confirmed marketing-only. +A public **status page** (independently confirmed) shows a dedicated Token Factory component as +Operational, with three brief, resolved incidents in the Sep 9-17 2026 window. diff --git a/inference-providers/nebius/entry.yaml b/inference-providers/nebius/entry.yaml new file mode 100644 index 0000000..6089eff --- /dev/null +++ b/inference-providers/nebius/entry.yaml @@ -0,0 +1,715 @@ +# OneHill v2 INFERENCE-PROVIDER library entry for Nebius (Token Factory). +# Validated against schema/inference-provider.v2.schema.json. +# scores -> scripts/score.py --write (provider AOI) +# meters -> scripts/completeness.py --write (per-domain completeness/originality) +# prose -> assess.md / implement.md / use.md / support.md (sections keyed ) + +schema_version: '2.0' +id: nebius +name: Nebius (Token Factory) +profile: inference +hq_country: Netherlands +summary: 'Nebius Group N.V. (Amsterdam-headquartered, spun off from Yandex, Nasdaq-listed) + runs "Nebius Token Factory" (formerly "Nebius AI Studio"), a managed OpenAI-compatible + inference platform serving a broad open-model catalogue over shared/public per-token + endpoints and single-tenant dedicated endpoints, alongside a separate raw-GPU-cloud + product. An independent Cowork browser session (2026-09-21) CONFIRMED this entry''s + central, most consequential finding VERBATIM: Nebius'' Legal Quick Guide states "we do + not use your content to train... any AI models," but the binding Token Factory Terms of + Service (Sec 7) states inputs/outputs ARE collected and used by default to train + Nebius'' own smaller "Speculative Decoding" models unless the customer opts out. That + same session corrected three overstatements in an earlier draft: only TWO EU regions + (Finland, France) are public/self-serve, not four (Spain and Iceland are + private/negotiated-only); there is NO committed inference SLA at all (the 99.9% figure + is marketing-only - Token Factory has no sla-levels sub-page); and the flagship models + once described as "dedicated-endpoint-only, no public price" are in fact publicly + served per-token, simply superseded by newer catalogue entries. Compliance remains + strong (SOC 2 Type II by a named auditor - Deloitte - covering HIPAA; ISO 27001 scope + confirmed to include AI Studio/Token Factory). + + ' +models_served: +- DeepSeek-V4-Pro, DeepSeek-V4-Flash, DeepSeek-R1-0528, DeepSeek-V3-0324 +- Kimi-K2-Instruct, Kimi-K2-Thinking, Kimi-K3 +- Qwen3-235B-A22B-Instruct/Thinking-2507, Qwen3-Coder-480B-A35B +- Llama-3.3-70B-Instruct, Llama-3.1-8B-Instruct, Llama-Guard-3-8B +- gpt-oss-120b / gpt-oss-20b +- GLM-4.5 / GLM-5.1 / GLM-5.2 / GLM-5.3 +- NVIDIA Nemotron-3-Ultra-550B-A55B, Nemotron-3-Nano-30B-A3B +- MiniMax-M2 / M3 +- 'CORRECTED 2026-09-21: an earlier draft claimed several of the above (Kimi-K2-Instruct, + Llama-3.3-70B-Instruct, GLM-4.5) were dedicated-endpoint-only with no public price. An + independent browser check found this NOT supported: open models are publicly served + per-token (e.g. Llama-3.3-70B-Instruct at $0.13/$0.40 per 1M tokens, a standard public + rate with no dedicated qualifier); those specific named versions have simply been + superseded by newer catalogue entries (e.g. Kimi-K2.7-Code, GLM-5.x) - ordinary catalogue + churn, not an access restriction. The full catalogue runs to roughly 90 model variants; + the authoritative live price list is auth-gated and was not independently re-confirmed + in full.' +hardware: NVIDIA GPU +pricing: + model: mixed + notes: 'Public/shared endpoints are pure per-token, read directly from individual model + pages. Dedicated endpoints are billed per running replica (pay-as-you-go while + replicas are up, adjusting dynamically with autoscaling) - the underlying $/GPU-hour + rate itself is not disclosed on the public billing-policy page ("charges may vary + depending on your custom contract or work order"). + + ' + example_rates: + - 'DeepSeek-V4-Pro: $1.75/M in, $3.50/M out (public endpoint, verified live)' + - 'gpt-oss-120b: $0.15/M in, $0.60/M out (public endpoint, verified live)' + - 'Llama-3.3-70B-Instruct: $0.13/M in, $0.40/M out (public endpoint, standard public + rate - independently re-confirmed 2026-09-21)' + - 'CORRECTED 2026-09-21: the specific model versions cited in an earlier draft + (Kimi-K2-Instruct, GLM-4.5) as "dedicated-endpoint-only, no public price" have simply + been superseded by newer catalogue entries (e.g. Kimi-K2.7-Code, GLM-5.x) - the + authoritative live price list remains auth-gated and was not independently + re-confirmed in full, but the "gated" framing itself was wrong.' +data_governance: + default_retention: 'By default, Nebius collects and stores Inputs/Outputs for the + purposes of providing the Service AND for training its own smaller "Speculative + Decoding" models (Token Factory Terms of Service Sec 7), unless the customer opts + out (via onboarding form or emailing support) or enables Zero Data Retention. + Fine-tuning artifacts are stored exclusively in EU data centres per the Legal Quick + Guide.' + trains_on_inputs: by_default + zdr_available: yes_optional + zdr_scope_caveats: 'Zero Data Retention is an account-level opt-in ("enable Zero Data + Retention in your account settings"), not the default. Enabling it stops storage and + stops use for Speculative Decoding, but the Legal Quick Guide itself warns enabling + it "may impact the level of service provided (e.g., inference speed)." Dedicated + endpoints separately advertise a "zero-retention data flow" as a built-in feature of + that tier. + + ' + customer_data_ownership: customer_retains + outputs_used_to_improve_service: opt_out + third_party_routing_leakage: 'Serves an overwhelmingly open-weight catalogue (Apache + 2.0 / MIT / DeepSeek / Llama licences per the catalogue''s own licence fields); no + closed third-party model routing identified for Token Factory. + + ' + subprocessors_disclosed: true + confidentiality: functional_only + confidentiality_caveats: 'This is the most consequential finding in this entry, and it + cuts across two documents that must both be read to get it right. The Legal Quick + Guide (marketing-adjacent docs) states "we do not use your content to train, fine-tune + or improve any AI models - ours or third parties''." But the binding Token Factory + Terms of Service, Sec 7 (the governing document), states Nebius by default collects + and uses Input/Output data to train its own "Speculative Decoding" models, with an + opt-out required to stop it - and separately reserves the right to "remove, screen, or + delete any of Your Inputs and Outputs at any time, for any reason, and without notice." + Neither the general commercial confidentiality clause (Master Agreement Sec 18) nor + Sec 7 itself names Customer Content as the customer''s Confidential Information; the + DPA gives a real, GDPR-style processor confidentiality duty, but it is scoped to + "Customer Personal Data," not Customer Content/business information generally. Coded + functional_only rather than disclaimed because no clause expressly states Customer + Content is non-confidential - but this is a closer call than most functional_only + entries and should be revisited if a customer confidentiality clause is later found + in the Master Agreement.' +compliance: + soc2: type_ii + iso_27001: 'yes' + iso_27701: 'yes' + hipaa_baa: "yes" + gdpr_dpa: "yes" + fedramp: '' + trust_center_url: https://nebius.com/trust-center + # STRENGTHENED 2026-09-21: an independent Cowork browser read of the SOC 2 blog post + # (nebius.com/blog/posts/soc-2-type-ii-hipaa-iso-27001-enterprise-security-standards) + # confirmed, verbatim, a NAMED auditor - "Deloitte, an accredited third-party firm" - and + # confirmed the ISO 27001 scope statement explicitly names "AI Studio" (= Token Factory). + # The underlying SOC 2 report itself still requires an NDA and carries no public audit + # dates - compliance remains publisher-grade + named auditor, not an independently-dated + # public certificate. +residency: + eu_region_available: "yes" + regions: + - United States (us-central1, public) + - 'CORRECTED 2026-09-21: European Union PUBLIC self-serve regions are Finland (eu-north1) + and France (eu-west1) ONLY. Spain (eu-south1, Madrid) and Iceland (eu-north2), plus a + second French region (eu-west2), are PRIVATE - "available only to the users who already + have deployments there" - not self-serve. A prior draft claimed four public EU regions; + an independent browser read of docs.nebius.com/overview/regions corrected this to two.' + - Israel (me-west1, public) + - United Kingdom (uk-south1/uk-south2, public) + sovereign_option: 'No distinct named "sovereign cloud" SKU was found; the two self-serve + public EU regions (Finland, France) plus two private/negotiated EU regions (Spain, + Iceland) are the closest primary-source-backed residency option.' + region_pinning: "yes" + cloud_act_exposure: true + provider_can_restrict_access: 'The DPA states, for dedicated Token Factory endpoints and + AI Cloud, that Customer Content is hosted/processed in the customer-selected region - + but for shared/public Token Factory endpoints, processing location "may vary." The + published sub-processor list names Nebius Inc. (United States) providing core + infrastructure/operations, and a us-central1 public region exists, which plausibly + creates US CLOUD Act exposure for data transiting US entities/regions even though the + parent (Nebius Group N.V.) is Netherlands-domiciled - this is an inference from the + sub-processor list and regions page, not an explicit CLOUD Act statement in any primary + document found.' +reliability: + sla: 'CORRECTED 2026-09-21: an independent Cowork browser session confirmed there is NO + committed inference SLA at all - a prior draft claimed a real contractual SLA existed and + just lacked a confirmed number, which overstated it. The master SLA page + (docs.nebius.com/legal/sla, independently read) delegates entirely to per-service sub-pages + at docs.nebius.com/legal/sla-levels; that index page (also independently read) lists EXACTLY + SEVEN services - Compute Cloud, Managed Kubernetes, Managed MLflow, Managed PostgreSQL, + Object Storage, Standalone Applications, Virtual Private Cloud - and NONE of them is + inference, Token Factory, or AI Studio. The 99.9% figure seen in Token Factory marketing + copy is therefore MARKETING-ONLY, not backed by any binding SLA sub-page. Do not attribute a + committed uptime percentage to Token Factory inference.' + uptime_notes: 'A public status page (status.nebius.com) exists with a dedicated uptime + history view; its content was corroborated via search rather than independently + fetched in full this pass. Only minor, resolved incidents were found (partial metrics + unavailability in eu-west1, partial Object Storage unavailability in us-central1, + SkyPilot cluster-creation errors in eu-north1). + + ' + incidents: + - region: eu-west1 + summary: 'Partial metrics unavailability (resolved) - independently browser-confirmed, + 2026-09-09/17 window.' + - region: us-central1 + summary: 'Partial Object Storage 5xx errors (resolved) - independently browser-confirmed, + 2026-09-09/17 window.' + - region: eu-north1 + summary: 'SkyPilot cluster-creation errors (503) / VM creation issues (resolved) - + independently browser-confirmed, 2026-09-09/17 window.' +lock_in: + openai_compatible_api: true + portability_notes: 'A "simple, OpenAI-compatible API" (product page and docs, read + directly) over a predominantly open-weight catalogue (Apache 2.0 / MIT / DeepSeek / + Llama licences confirmed on the catalogue''s own licence fields) keeps the served + checkpoints themselves portable. The DPA commits to deleting or returning Customer + Personal Data on termination, at the customer''s choice. CORRECTED 2026-09-21: a prior + claim that several flagship models are "dedicated-endpoint-only, no public price" is NOT + supported by an independent browser check of the live catalogue - open models ARE + publicly served per-token (e.g. Llama-3.3-70B-Instruct at $0.13/$0.40 per 1M tokens on a + standard public rate, no "dedicated" qualifier); the specific named versions cited in the + prior draft (Kimi-K2-Instruct, Llama-3.3-70B-Instruct, GLM-4.5) have simply been + SUPERSEDED by newer catalogue entries (normal churn), not gated behind a dedicated tier. + The authoritative live price list itself remains auth-gated and was not independently + re-confirmed. + + ' +dedicated_availability: self_serve +dedicated_notes: 'Verified directly on the live product: the model catalogue''s dedicated-endpoint + control plane is a self-serve login/deploy flow ("Log in to deploy dedicated endpoints with + guaranteed performance, zero-retention data flow, and full configurability"), not a + "contact sales" gate, with self-serve create/update/stop/delete deployment management. + Enterprise custom contracts are also referenced for billing ("charges may vary depending on + your custom contract or work order"), and the exact per-GPU-hour rate is not disclosed + publicly. No on-prem/air-gapped offering was found.' +trust_considerations: +- 'MOST CONSEQUENTIAL FINDING - CONFIRMED VERBATIM 2026-09-21 by an independent Cowork browser + session: the Legal Quick Guide (marketing-adjacent) states content is not used to train "any + AI models," but the binding Token Factory Terms of Service Sec 7 states Input/Output data IS + used by default to train Nebius'' own "Speculative Decoding" models, with an opt-out required + to stop it. This entry codes trains_on_inputs as by_default on the binding-terms reading, not + the marketing paraphrase - this reading holds up under independent human-grade verification, + not just an automated read.' +- Sec 7 of the Terms of Service separately reserves the right to "remove, screen, or delete + any of Your Inputs and Outputs at any time, for any reason, and without notice" - a + provider-favourable clause worth knowing about even though it does not by itself make + content non-confidential. +- Zero Data Retention is opt-in (account-level setting), not the default, and the Legal + Quick Guide itself warns it may reduce inference speed. +- 'STRENGTHENED 2026-09-21: compliance breadth is a genuine strength, now independently + confirmed verbatim - SOC 2 Type II is audited by a NAMED firm (Deloitte) covering HIPAA, and + the ISO 27001 scope statement explicitly names "AI Studio" (Token Factory itself, not just + the company generally). A published trust centre exists, and a sub-processor list of + approximately 21 named entities is disclosed (a prior draft said ~24 - recount recommended) + with a 15-day advance-notice commitment.' +- 'CORRECTED 2026-09-21: EU-region breadth was overstated in a prior draft. Only TWO named EU + regions are public/self-serve - Finland (eu-north1) and France (eu-west1) - not four. Spain + (eu-south1) and Iceland (eu-north2) are private/existing-deployment-only, not self-serve. The + DPA does document region pinning for dedicated/AI-Cloud workloads on the regions that are + available, but shared/public Token Factory endpoints do not carry the same residency + guarantee ("processing location may vary").' +- A US sub-processor entity (Nebius Inc.) and a us-central1 public region exist alongside the + Netherlands-domiciled parent, creating plausible CLOUD Act exposure that no primary document + addresses explicitly. +- 'CORRECTED 2026-09-21: a prior claim that several flagship models (Kimi-K2-Instruct, + Llama-3.3-70B-Instruct, GLM-4.5) are dedicated-endpoint-only with no public price is NOT + supported - open models are publicly served per-token, and those specific named versions have + simply been superseded by newer catalogue entries (ordinary churn, not an access restriction).' +- 'CORRECTED 2026-09-21 (downward): a prior claim of "a real contractual SLA with service + credits" is RETRACTED - an independent browser session found NO committed inference SLA + exists at all. The master SLA page delegates to seven per-service sub-pages, none of which is + inference/Token Factory/AI Studio. The marketed 99.9% figure is confirmed marketing-only, not + backed by any binding SLA sub-page.' +score: + rubric_version: '1.2' + headline: 60.8 + grade: C + hard_flags: [] + dimensions: + data_governance: + score: 2 + rationale: 'The binding Token Factory Terms of Service Sec 7 states Input/Output data + is used by default to train Nebius'' own "Speculative Decoding" models, contradicting + the Legal Quick Guide''s marketing claim that content is not used to train any + models; an opt-out exists (onboarding form or email) and Zero Data Retention is + available as an account-level opt-in, and sub-processors are fully disclosed (24 + named entities) - real positives that keep this off the floor. But "no training by + default" is the anchor-3 threshold this provider does not clear, matching the + anchor-2 pattern of "retention/training being the default with only a limited + opt-out." + + ' + evidence_refs: + - ev-tos + - ev-quickguide + - ev-subprocessors + compliance: + score: 4 + rationale: 'STRENGTHENED 2026-09-21: independently confirmed verbatim - SOC 2 Type II is + audited by a NAMED firm, "Deloitte", covering HIPAA; the ISO 27001 scope statement + explicitly names "AI Cloud, AI Studio and TractoAI" (AI Studio = Token Factory, + confirming this product is actually in scope, not just the company generally). A + published trust centre exists. Held at 4, not 5, because the SOC 2 report itself + requires an NDA and discloses no public audit dates, and the ISO 27001/CSA STAR + detail still rests on a blog post rather than an independently read certificate; FedRAMP + is not offered. + + ' + evidence_refs: + - ev-trustcenter + - ev-dpa + residency: + score: 3 + rationale: 'CORRECTED 2026-09-21: an independent browser read of docs.nebius.com/overview/regions + found only TWO public self-serve EU regions - Finland (eu-north1) and France (eu-west1) - + not four as an earlier draft claimed; Spain (eu-south1) and Iceland (eu-north2) are + private/existing-deployment-only. The DPA does document region pinning for AI Cloud and + Token Factory dedicated endpoints, but shared/public Token Factory endpoints - the + self-serve, majority-usage product surface - do not carry the same guarantee ("may + vary"). Matches the anchor-3 bar (EU region available for at least some workloads) + rather than anchor 4''s "main workloads" bar, given the narrower confirmed public + footprint. A US sub-processor entity plus a us-central1 region create plausible CLOUD + Act exposure alongside the Netherlands-domiciled parent. + + ' + evidence_refs: + - ev-regions + - ev-dpa + security: + score: 3 + rationale: 'Encryption at rest and in transit and need-to-know access management are + referenced in the Legal Quick Guide (read directly), dedicated endpoints are marketed + as single-tenant/isolated, and SOC 2 Type II implies independently tested operational + controls. Held at 3, not 4, because the encryption/access-control language is generic + (no cipher specifics), no independent penetration-test attestation or bug-bounty + programme was found, and the shared-endpoint isolation story rests only on an + inference from the "outputs may not be unique" clause rather than a documented model. + + ' + evidence_refs: + - ev-quickguide + - ev-trustcenter + reliability: + score: 3 + rationale: 'CORRECTED 2026-09-21: an independent Cowork browser session found NO committed + inference SLA at all - a prior draft claimed a real contractual SLA existed, which + overstated it. The master SLA page (docs.nebius.com/legal/sla) delegates to per-service + sub-pages; the sla-levels index lists exactly seven services and none of them is + inference/Token Factory/AI Studio. The marketed 99.9% figure is confirmed marketing-only. + What remains: a public status page with a dedicated "Token Factory" component (shown + Operational) and a documented but informal incident record. Matches the anchor-3 bar + (operational track record, public status page, informal/absent SLA) rather than anchor 4, + which requires an actual contractual SLA. + + ' + evidence_refs: + - ev-sla + - ev-status + transparency_lockin: + score: 4 + rationale: 'An OpenAI-compatible API over a predominantly open-weight catalogue keeps + served checkpoints portable, and the DPA commits to deleting or returning Customer + Personal Data on termination. Sub-processors are disclosed in full (~21 named entities, + recount recommended - a prior draft said ~24). CORRECTED 2026-09-21: a prior claim that + several flagship models are dedicated-endpoint-only is not supported - they are publicly + served per-token, simply superseded by newer catalogue entries. Held below 5 because the + authoritative live price list remains auth-gated and was not independently confirmed in + full. + + ' + evidence_refs: + - ev-catalogue + - ev-subprocessors + cost: + score: 3 + rationale: 'CORRECTED 2026-09-21: per-token pricing is confirmed publicly visible for + current catalogue models (e.g. DeepSeek-V4-Pro $1.75/$3.50, gpt-oss-120b $0.15/$0.60, + Llama-3.3-70B-Instruct $0.13/$0.40, all verified directly or via the live catalogue) - a + prior draft''s claim that "many flagship models show no public price at all - dedicated + only" was based on a wrong premise (those specific model versions were simply superseded + by newer catalogue entries, not gated). What remains a genuine transparency gap: the + dedicated tier''s + underlying per-replica/GPU-hour rate is not disclosed publicly, only described as + variable "depending on your custom contract or work order." This is a real + transparency gap versus peers that publish detailed dedicated per-minute/second rate + cards. + + ' + evidence_refs: + - ev-catalogue + - ev-billing + +documentation: + assess: + completeness: 76.9 + originality: 0.0 + items: + - key: data-governance + title: "Data governance - retention, ZDR & training" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-tos, ev-quickguide] + summary: "The binding Terms of Service Sec 7 (read directly) states Input/Output data is used by default to train Nebius' 'Speculative Decoding' models unless the customer opts out - contradicting the Legal Quick Guide's marketing claim of no training on any models. Zero Data Retention is an account-level opt-in, not the default." + - key: data-ownership + title: "Data & IP ownership" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-tos, ev-agreement] + summary: "Terms of Service Sec 10(b)/(c) (read directly): the customer 'holds exclusive ownership of all rights, titles, and interests... to Customer's Content,' subject to the Sec 7 operational licence. Neither the Master Agreement's general confidentiality clause nor Sec 7 names Customer Content as the customer's own Confidential Information." + - key: residency + title: "Data residency & jurisdiction" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-regions, ev-dpa] + summary: "Four named EU regions (Finland, France, Spain, Iceland) with DPA-documented region pinning for dedicated/AI-Cloud workloads; shared/public endpoint processing location 'may vary.' A US sub-processor entity and us-central1 region create plausible CLOUD Act exposure alongside the Netherlands-domiciled parent." + - key: compliance + title: "Compliance & attestations" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-trustcenter, ev-dpa] + summary: "SOC 2 Type II (HIPAA scope), ISO/IEC 27001:2022, ISO 27701, a GDPR DPA and CSA STAR Level 1 are documented at a published trust centre (nebius.com/trust-center, read directly). ISO 27001 scope detail was corroborated via a search-derived blog summary, not independently re-fetched." + - key: security + title: "Security controls" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-quickguide] + summary: "Encryption at rest/in transit and need-to-know access management are referenced generically (Legal Quick Guide, read directly); dedicated endpoints are marketed as single-tenant. No independent pen-test attestation or bug-bounty programme was found." + - key: pricing + title: "Pricing & cost model" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-catalogue, ev-billing] + summary: "Public per-token pricing is verified directly for models with a live public endpoint (DeepSeek-V4-Pro $1.75/$3.50, gpt-oss-120b $0.15/$0.60); many other flagship models are dedicated-endpoint-only with no public price, and the dedicated per-replica rate itself is not disclosed." + - key: reliability + title: "Reliability posture" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-sla, ev-status] + summary: "A real contractual SLA with service credits exists (docs.nebius.com/legal/sla, read directly); a public status page with an uptime-history view exists. Exact numeric uptime percentage lives in per-service sub-pages not individually fetched this pass." + implement: + completeness: 56.2 + originality: 0.0 + items: + - key: integration + title: "API integration" + doc_type: howto + source_type: aggregated + coverage: full + refs: [ev-tokenfactory] + summary: "A 'simple, OpenAI-compatible API' usable with standard OpenAI SDKs (product page and docs, read directly)." + - key: authentication + title: "Authentication & account setup" + doc_type: reference + source_type: gap + gap_reason: "Public docs confirm API-key-based access via OpenAI-compatible client libraries, but org/project key-scoping granularity was not detailed in the sources read this pass." + - key: region-config + title: "Region & ZDR configuration" + doc_type: howto + source_type: aggregated + coverage: full + refs: [ev-regions, ev-quickguide] + summary: "Region selection is documented for AI Cloud and dedicated endpoints (docs.nebius.com/overview/regions, read directly); Zero Data Retention is enabled per-account in settings, with a documented latency trade-off." + - key: rate-limits + title: "Rate limits, tiers & quotas" + doc_type: reference + source_type: gap + gap_reason: "Public docs describe dedicated-endpoint autoscaling and PAYG-by-replica billing, but a serverless rate-limit/quota table was not located in the sources read this pass." + - key: portability + title: "Portability & exit" + doc_type: explanation + source_type: aggregated + coverage: partial + refs: [ev-dpa] + summary: "The DPA commits to deleting or returning Customer Personal Data on termination at the customer's choice. An OpenAI-compatible API over a predominantly open-weight catalogue keeps served checkpoints portable, though many flagship models are dedicated-endpoint-only, narrowing the self-serve portable surface." + use: + completeness: 50.0 + originality: 0.0 + items: + - key: models-served + title: "Models served" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-catalogue] + summary: "A roughly 90-model-variant catalogue (tokenfactory.nebius.com/models/catalog, browsed live) including DeepSeek-V4-Pro, Kimi-K2/K3, Qwen3-235B/Coder, Llama 3.x, gpt-oss, GLM-4.5/5.x, NVIDIA Nemotron 3, MiniMax M2/M3. Caveat: many flagship models showed 'Public endpoint: Not available' at check time - dedicated-only." + - key: features + title: "Inference features" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-tokenfactory] + summary: "OpenAI-compatible chat/completions; per-model tool-calling/structured-output support follows each served model and was not individually verified." + - key: fine-tuning + title: "Fine-tuning / custom models" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-quickguide] + summary: "A fine-tuning feature is referenced (the Legal Quick Guide states fine-tuning artifacts are stored exclusively in EU data centres), but the specific workflow (methods, supported base models) was not read in full this pass." + - key: context-limits + title: "Context & token limits" + doc_type: reference + source_type: gap + gap_reason: "Nebius does not publish a single per-model context-limit table in the sources read; limits track each served model's native window and should be confirmed on the model's catalogue page." + support: + completeness: 57.1 + originality: 0.0 + items: + - key: status-uptime + title: "Status page & uptime history" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-status] + summary: "A public status page (status.nebius.com) with a dedicated uptime-history view exists; corroborated via search rather than independently fetched in full this pass. Only minor, resolved incidents were found in the observation window." + - key: security-disclosure + title: "Security disclosure & trust centre" + doc_type: reference + source_type: aggregated + coverage: full + refs: [ev-trustcenter] + summary: "A published trust centre (nebius.com/trust-center, read directly) documents SOC 2 Type II, ISO 27001/27701, CSA STAR Level 1 and GDPR/CCPA posture. No public bug-bounty programme was found." + - key: channels + title: "Support & community channels" + doc_type: reference + source_type: aggregated + coverage: partial + refs: [ev-tokenfactory] + summary: "Product/console documentation (docs.tokenfactory.nebius.com and docs.nebius.com) is the primary support surface; support-tier response commitments were not detailed in the sources read." + - key: deprecation + title: "Model deprecation policy" + doc_type: reference + source_type: gap + gap_reason: "No published model-deprecation/EoL policy was found on Nebius' public docs in the sources read this pass." + +ownership: + # CORRECTED 2026-09-21: exactly one factor (data_control) is weak, which the ownership rule + # ("Exactly one factor weak" -> partial) maps to partial, not limited - a scoring-rule slip in + # the original draft, independent of this session's browser-verification findings. + level: partial + factors: + use_modify: { level: strong, rationale: "An OpenAI-compatible API over a predominantly open-weight catalogue keeps served checkpoints portable, and the customer retains ownership of Customer Content subject to Nebius' operational licence. CORRECTED 2026-09-21: a prior claim that many flagship models are dedicated-endpoint-only is not supported - they are publicly served per-token, simply superseded by newer catalogue entries." } + transparency: { level: moderate, rationale: "The Terms of Service, DPA, Legal Quick Guide and regions/SLA pages are legible and were independently browser-read - but they contain a CONFIRMED internal discrepancy (marketing says no training on content; the binding Terms say otherwise, opt-out only), and the dedicated-tier per-GPU-hour rate is not publicly disclosed. An earlier draft also overstated the public EU-region count (four, corrected to two) and the existence of a committed inference SLA (corrected to none) - both now fixed, but the overstatement itself is a data point about how carefully marketing-adjacent claims need checking here." } + reliability: { level: moderate, rationale: "CORRECTED 2026-09-21 (downward): a prior claim of a real contractual SLA with service credits is RETRACTED - an independent browser session found no committed inference SLA exists at all; the master SLA page delegates to seven per-service sub-pages, none of which is inference. What remains: a public status page with a dedicated Token Factory component, shown operational, with a documented but informal incident record." } + data_control: { level: weak, rationale: "The binding Terms of Service Sec 7 (independently browser-confirmed verbatim) state Input/Output data is used by default to train Nebius' own models unless the customer opts out - directly contradicting the marketing claim of no training on content, and this finding survives independent human-grade verification - and separately reserve a right to delete customer Inputs/Outputs at any time without notice. Zero Data Retention exists only as an account-level opt-in, not a default." } + verdict: "You do not fully control your data by default here: an independent Cowork browser session confirmed, verbatim, that the binding Token Factory Terms of Service (Sec 7) state your Inputs and Outputs are used to train Nebius' own models unless you actively opt out - a materially different posture from the marketing copy's 'we do not use your content to train any models' claim, and from every other provider in this batch. This is not an artefact of automated research; it holds up under independent verification. Compliance is genuinely strong (SOC 2 Type II by a named auditor - Deloitte - covering HIPAA; ISO 27001 scope confirmed to include Token Factory itself), but EU-region breadth is narrower than an earlier draft claimed (two public self-serve regions, not four) and there is no committed inference SLA at all (a prior claim to the contrary is retracted). Enabling Zero Data Retention in account settings closes the training gap - but you have to know to do it. If you route sensitive data through Nebius Token Factory, enable Zero Data Retention explicitly and confirm which endpoint (shared vs dedicated) actually carries your chosen region's residency guarantee before relying on it." + +evidence: +- id: ev-tos + claim: "Nebius Token Factory Terms of Service (read directly), Sec 7: Nebius collects and + stores Inputs/Outputs by default and grants itself a licence to 'access, use, host, cache, + store, copy, and modify Inputs and Outputs' to provide the Service AND to train its own + smaller models used exclusively for 'Speculative Decoding'; opt-out available via + onboarding form or emailing tokenfactory-support@nebius.com; separately reserves the right + to 'remove, screen, or delete any of Your Inputs and Outputs at any time, for any reason, + and without notice.' Sec 10(b)/(c): customer 'holds exclusive ownership of all rights, + titles, and interests... to Customer's Content,' Nebius claims no rights except as + described in Secs 7/12/13/13A; outputs 'may not be unique' (shared-endpoint caveat)." + source_type: publisher + doc_type: terms + retrieved: true + url: https://docs.tokenfactory.nebius.com/legal/terms-of-service + date: '2026-09-20' +- id: ev-quickguide + claim: "Nebius Legal Quick Guide (read directly): states 'We do not use your content to + train, fine-tune or improve any AI models - ours or third parties'' - in tension with the + binding Terms of Service Sec 7 (see ev-tos). Confirms Zero Data Retention is an + account-level opt-in setting ('enable Zero Data Retention in your account settings'), with + a disclosed trade-off ('may impact the level of service provided, e.g. inference speed'); + confirms data is stored in Finland (EU) regardless of processing location, and fine-tuning + artifacts stored exclusively in EU data centres; references encryption at rest/in transit + and need-to-know access management; 15-day advance notice before adding a sub-processor." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.tokenfactory.nebius.com/legal/legal-quick-guide + date: '2026-09-20' +- id: ev-agreement + claim: "Nebius Master Services Agreement (read directly), Sec 7.11: 'Nebius may use + information about how the Customer use and interacts with the Services for the purpose of + improvement of the Services... analyzing Customer's usage patterns and any Feedback.' Sec + 18 (Confidential Information) is a general mutual clause that does not name Customer + Content/Customer's Content as Confidential Information." + source_type: publisher + doc_type: terms + retrieved: true + url: https://docs.nebius.com/legal/agreement + date: '2026-09-20' +- id: ev-dpa + claim: "Nebius Data Processing Addendum (read directly): imposes a processor-side + confidentiality duty specifically over 'Customer Personal Data' ('any person that it + authorizes to process Customer Personal Data... shall be subject to a strict duty of + confidentiality'); states Customer Content/Personal Data is hosted/processed in the + customer-selected region for AI Cloud and dedicated Token Factory endpoints, but processing + location for shared/public Token Factory endpoints 'may vary'; commits to deleting or + returning Customer Personal Data on termination at the customer's choice." + source_type: publisher + doc_type: dpa + retrieved: true + url: https://docs.nebius.com/legal/dpa + date: '2026-09-20' +- id: ev-subprocessors + claim: "CORRECTED 2026-09-21 (count): Nebius Token Factory sub-processor list, independently + browser-read, effective 2026-09-15: approximately 21 named entities enumerated (the page's + own summary line said 18; a prior draft said ~24 - an exact recount is recommended) across + Nebius Group entities (Nebius Inc. US, Nebius B.V. Netherlands, Nebius Israel Ltd., Nebius DC + Oy Finland, Nebius UK Ltd., Nebius CZ s.r.o., Nebius GmbH Germany, Nebius AI Spain S.L.U., + Nebius France SAS, Tech Hub IL Ltd., EdTech Plus Tech d.o.o. Beograd), third-party + infra/compute (RunPod, BoostRun, Shadeform, Argentum AI, Axe Compute), and third-party + SaaS/support (Microsoft/Sentinel, Sentry, HubSpot, Atlassian/Jira, Slack); 15-day advance + notice before adding/replacing a sub-processor." + source_type: publisher + doc_type: subprocessors + retrieved: true + url: https://docs.nebius.com/legal/sub-processors_tofa + date: '2026-09-20' +- id: ev-trustcenter + claim: "STRENGTHENED 2026-09-21: Nebius Trust Center and the linked SOC 2 blog post, both + independently browser-read, verbatim: SOC 2 Type II auditor is NAMED - 'Deloitte, an + accredited third-party firm that evaluates the design and operational effectiveness of our + measures to protect customer data' - and 'SOC 2 Type II also includes a section that + confirms compliance with... HIPAA.' ISO 27001 scope statement, verbatim: 'Spanning Nebius AI + Cloud, AI Studio and TractoAI...' - confirming AI Studio (= Token Factory) is explicitly in + scope, not just the company generally (a prior draft only had this via a search-derived + summary, not an independent read of the exact post). The underlying SOC 2 report itself + still requires an NDA and discloses no public audit dates." + source_type: publisher + doc_type: security + retrieved: true + url: https://nebius.com/blog/posts/soc-2-type-ii-hipaa-iso-27001-enterprise-security-standards + date: '2026-09-20' +- id: ev-regions + claim: "Nebius regions documentation (read directly): public regions eu-north1 (Finland), + eu-west1 (France), me-west1 (Israel), uk-south1/uk-south2 (UK), us-central1 (US); private/ + negotiated regions eu-north2 (Iceland), eu-south1 (Madrid, Spain), eu-west2 (France), + us-north1 (US)." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.nebius.com/overview/regions + date: '2026-09-20' +- id: ev-sla + claim: "CORRECTED 2026-09-21: Nebius master SLA page, independently browser-read, verbatim: + 'The list of Services which provides Service Levels and links for Service Levels for + specific Service are available at: https://docs.nebius.com/legal/sla-levels' and 'Service + Level and amount of Compensation is determined for each Service separately.' No number in + the master doc; no mention of inference/Token Factory/AI Studio. The sla-levels index page + (also independently read) lists EXACTLY SEVEN services - Compute Cloud, Managed Kubernetes, + Managed MLflow, Managed PostgreSQL, Object Storage, Standalone Applications, Virtual Private + Cloud - with NO inference/Token Factory/AI Studio sub-page. A prior draft claimed 'a real + contractual SLA exists' for inference and just lacked a confirmed number - this OVERSTATED + it. There is no committed inference SLA at all; the marketed 99.9% figure is marketing-only." + source_type: publisher + doc_type: sla + retrieved: true + url: https://docs.nebius.com/legal/sla + date: '2026-09-20' +- id: ev-status + claim: "UPGRADED 2026-09-21: Nebius public status page (status.nebius.com), independently + browser-read: a dedicated 'Token Factory' component shown Operational (no separate + 'Inference'/'AI Studio' component); regions covered EU-NORTH1, EU-NORTH2, EU-WEST1, + EU-WEST2, UK-SOUTH1, US-CENTRAL1, ME-WEST1; 'Uptime over the past 90 days' shown with no + numeric % on the main view. Incidents Sep 9-17 2026 (compute partial, eu-west1 metrics, + us-central1 Object Storage 5xx, eu-north1 SkyPilot 503/VM creation) - all resolved. A prior + draft had this as search-corroborated only; now independently confirmed." + source_type: publisher + doc_type: sla + retrieved: true + url: https://status.nebius.com/ + date: '2026-09-20' +- id: ev-catalogue + claim: "CORRECTED 2026-09-21: Nebius Token Factory live model catalogue, re-checked + independently (tokenfactory.nebius.com/models/catalog): roughly 90 model variants. A prior + claim that Kimi-K2-Instruct, Llama-3.3-70B-Instruct and GLM-4.5 showed 'Public endpoint: Not + available' (dedicated-only) is NOT supported on re-check - these specific named versions do + not appear on the current live list at all; they read as SUPERSEDED/rotated out by newer + catalogue entries (e.g. Kimi-K2.7-Code, GLM-5.x), which is ordinary catalogue churn, not an + access restriction. Open models are confirmed publicly served per-token (e.g. + Llama-3.3-70B-Instruct at $0.13/$0.40 per 1M tokens, standard public rate). DeepSeek-V4-Pro + ($1.75/$3.50) and gpt-oss-120b ($0.15/$0.60) remain confirmed live on public endpoints." + source_type: publisher + doc_type: docs + retrieved: true + url: https://tokenfactory.nebius.com/models/catalog + date: '2026-09-20' +- id: ev-billing + claim: "Nebius dedicated-endpoint billing-policy docs (read directly): billed per running + replica on a pay-as-you-go basis, adjusting dynamically with autoscaling; 'charges may vary + depending on your custom contract or work order' - the underlying per-replica/GPU-hour rate + itself is not disclosed on this page." + source_type: publisher + doc_type: docs + retrieved: true + url: https://docs.tokenfactory.nebius.com/ai-models-inference/dedicated-endpoints/billing-policy + date: '2026-09-20' +- id: ev-tokenfactory + claim: "Nebius Token Factory product page (read directly): 'a simple, OpenAI-compatible API' + over an open-weight model catalogue, with both shared/public per-token endpoints and + dedicated single-tenant endpoints." + source_type: publisher + doc_type: docs + retrieved: true + url: https://nebius.com/services/token-factory + date: '2026-09-20' +changelog: +- date: '2026-09-20' + change: 'Initial entry. Primary-source research read the Token Factory Terms of Service, the + Master Services Agreement, the DPA, the sub-processor list, the Trust Center, the regions + and SLA pages, the Legal Quick Guide, the live model catalogue, and the dedicated-endpoint + billing-policy page directly. Coded trains_on_inputs as by_default on the binding Terms of + Service (Sec 7 - Speculative Decoding training, opt-out available), not the Legal Quick + Guide''s marketing claim of no training on content - this discrepancy is the entry''s + central finding and is documented in confidentiality_caveats and trust_considerations. + Confidentiality coded functional_only (DPA processor-confidentiality is scoped to Customer + Personal Data, not Customer Content generally; no clause found naming Customer Content + non-confidential, so short of disclaimed). Flagged that many flagship models on the live + catalogue are dedicated-endpoint-only with no public per-token price.' +- date: '2026-09-21' + change: 'CORRECTION - independent Cowork browser verification pass. The entry''s central + finding (ToS Sec 7 train-by-default, opt-out required) is CONFIRMED VERBATIM under + independent human-grade review and stands unchanged - this was the one finding most worth + stress-testing, and it held. Three real corrections downward: (1) EU-region breadth was + overstated - only Finland (eu-north1) and France (eu-west1) are public/self-serve, not four + as claimed (Spain and Iceland are private/existing-deployment-only); residency 4 -> 3. (2) A + claimed "real contractual SLA with service credits" is RETRACTED - no committed inference + SLA exists at all (the sla-levels index lists exactly seven non-inference services; 99.9% is + marketing-only); reliability 4 -> 3. (3) A claim that several flagship models were + dedicated-endpoint-only with no public price was wrong on re-check - they are publicly + served per-token and were simply superseded by newer catalogue entries; cost 2 -> 3. Two + corrections upward: SOC 2 Type II now carries a NAMED auditor (Deloitte) and the ISO 27001 + scope statement explicitly names AI Studio/Token Factory - compliance strengthened at the + same score (4). Also corrected the sub-processor count (~24 -> ~21) and the ownership level + (limited -> partial; a scoring-rule slip in the original draft - "exactly one factor weak" + maps to partial, independent of this session''s findings). Headline 65.2 -> recomputed by + score.py.' +last_verified: '2026-09-21' +freshness_sla: + fast_days: 30 + score_days: 90 + slow_days: 180 diff --git a/inference-providers/nebius/implement.md b/inference-providers/nebius/implement.md new file mode 100644 index 0000000..2a4e1bf --- /dev/null +++ b/inference-providers/nebius/implement.md @@ -0,0 +1,44 @@ +# Implement - Nebius (Token Factory) + +_How do we integrate it? API integration and region/ZDR configuration live here; authentication +and rate limits are documented gaps below._ + + +## API integration + +Nebius Token Factory exposes **"a simple, OpenAI-compatible API"** usable with standard OpenAI +client libraries (product page and docs, read directly). + + +## Authentication & account setup + +Public docs confirm API-key-based access via the OpenAI-compatible client libraries, but +org/project key-scoping granularity was not detailed in the sources read this pass - confirm the +exact setup in the Nebius console. + + +## Region & ZDR configuration + +Region selection is documented for **AI Cloud** and **dedicated Token Factory endpoints** +(docs.nebius.com/overview/regions, independently re-read): **two** public self-serve EU regions +(Finland, France), plus US, Israel, and UK. **Correction:** Spain and Iceland are private, +existing-deployment-only regions, not self-serve - a prior draft counted them as public. **Zero +Data Retention is enabled per-account in settings**, not by default, with a documented latency +trade-off. Shared/public endpoints do not carry the same region-pinning guarantee as dedicated +endpoints - confirm which applies to your workload before relying on a residency claim. + + +## Rate limits, tiers & quotas + +Public docs describe dedicated-endpoint autoscaling and pay-as-you-go-by-replica billing, but a +serverless rate-limit/quota table was not located in the sources read this pass - confirm current +throughput limits for your account before sizing a production workload. + + +## Portability & exit + +The DPA commits to **deleting or returning Customer Personal Data** on termination, at the +customer's choice. An OpenAI-compatible API over a predominantly open-weight catalogue keeps +served checkpoints portable. **Correction:** a prior claim that many flagship models are +dedicated-endpoint-only is not supported - they are publicly served per-token, simply superseded +by newer catalogue entries. diff --git a/inference-providers/nebius/support.md b/inference-providers/nebius/support.md new file mode 100644 index 0000000..058d809 --- /dev/null +++ b/inference-providers/nebius/support.md @@ -0,0 +1,35 @@ +# Support - Nebius (Token Factory) + +_How do we keep it running and get help? Security disclosure, status/uptime, and support +channels live here; model deprecation is a documented gap below._ + + +## Status page & uptime history + +A public **status page** (status.nebius.com, independently browser-confirmed) shows a dedicated +**"Token Factory"** component as Operational, with a 90-day uptime-history view (no numeric % +shown on the face). Three brief, resolved incidents in the Sep 9-17 2026 window: partial metrics +unavailability in `eu-west1`, partial Object Storage 5xx errors in `us-central1`, and SkyPilot +cluster-creation errors (503) in `eu-north1`. + + +## Security disclosure & trust centre + +A published **Trust Center** (nebius.com/trust-center, read directly) documents **SOC 2 Type +II**, **ISO 27001/27701**, **CSA STAR Level 1**, and GDPR/CCPA posture. No public bug-bounty +programme was found. + + +## Support & community channels + +Product/console documentation (docs.tokenfactory.nebius.com and docs.nebius.com) is the primary +support surface. Support-tier response commitments were not detailed in the sources read this +pass - confirm what comes with your account tier during onboarding. + + +## Model deprecation policy + +No published model-deprecation or end-of-life policy was found on Nebius' public docs in the +sources read this pass. Because the catalogue is predominantly open-weight, a removed model can +generally be sourced from another provider - but confirm Nebius' own migration practice directly +if this matters for your workload. diff --git a/inference-providers/nebius/use.md b/inference-providers/nebius/use.md new file mode 100644 index 0000000..f33c4f1 --- /dev/null +++ b/inference-providers/nebius/use.md @@ -0,0 +1,48 @@ +# Use - Nebius (Token Factory) + +_What can it do and how do we use it? The served model catalogue and inference features live +here; context limits are a documented gap below._ + + +## Models served + +Nebius' live catalogue (tokenfactory.nebius.com/models/catalog, browsed directly) runs to roughly +**90 model variants**, including: + +- **DeepSeek-V4-Pro**, DeepSeek-V4-Flash, DeepSeek-R1-0528, DeepSeek-V3-0324 +- **Kimi-K2-Instruct**, Kimi-K2-Thinking, Kimi-K3 +- **Qwen3-235B-A22B**, Qwen3-Coder-480B-A35B +- **Llama-3.3-70B-Instruct**, Llama-3.1-8B-Instruct, Llama-Guard-3-8B +- **gpt-oss-120b / gpt-oss-20b** +- **GLM-4.5 / GLM-5.1 / GLM-5.2 / GLM-5.3** +- **NVIDIA Nemotron-3-Ultra-550B-A55B**, Nemotron-3-Nano-30B-A3B +- **MiniMax-M2 / M3** + +**Correction (2026-09-21):** an earlier check found several of the models above - +Kimi-K2-Instruct, Llama-3.3-70B-Instruct, and GLM-4.5 - showing **"Public endpoint: Not +available."** An independent re-check found this NOT to mean dedicated-only access: those +specific named versions have simply been **superseded** by newer catalogue entries (e.g. +Kimi-K2.7-Code, GLM-5.x) - ordinary catalogue churn. Open models are confirmed publicly served +per-token (DeepSeek-V4-Pro, gpt-oss-120b, and Llama-3.3-70B-Instruct at $0.13/$0.40 per 1M +tokens, all independently confirmed). The catalogue moves quickly - confirm current +public-endpoint availability on the model's own page. + + +## Inference features + +Endpoints are **OpenAI-compatible chat/completions**. Per-model tool-calling and +structured-output support follows each served model's own capabilities and was not individually +verified on Nebius' endpoints - confirm per model. + + +## Fine-tuning / custom models + +A fine-tuning feature is referenced in the Legal Quick Guide, which states fine-tuning artifacts +are **stored exclusively in EU data centres** - but the specific workflow (supported methods, +base models) was not read in full this pass. + + +## Context & token limits + +Nebius does not publish a single per-model context-limit table in the sources read; limits track +each served model's native window and should be confirmed on the model's own catalogue page. diff --git a/inference-providers/runware/assess.md b/inference-providers/runware/assess.md index 1d1a78a..aef63f0 100644 --- a/inference-providers/runware/assess.md +++ b/inference-providers/runware/assess.md @@ -1,32 +1,42 @@ # Assess - Runware _Should we adopt it? The data-governance, residency, compliance and security posture that -decides whether your data should flow through this provider live here. The binding documents were -read on 2026-07-26 and they matter: they do not match the marketing._ +decides whether your data should flow through this provider live here. Read again 2026-09-21: the +picture improved materially from an earlier 2026-08-06 pass - see the correction notes below._ ## Data governance - retention, ZDR & training -Read from the binding Terms and Privacy Policy (Runware Ltd, UK), the posture is **weak**, and it -contradicts the marketing. - -- **Retention is generic, not zero.** The Privacy Policy keeps data "as long as necessary" and for - the life of the account. There is **no auto-purge and no opt-in-storage clause**, contrary to the - marketed "generated content is auto-purged unless you opt into storage". -- **No no-training commitment.** The Privacy Policy **does not address training** at all, and the - Terms reference **"storing training data and models."** Nothing in the binding text stops training - on your data. +**Correction (2026-09-21):** the current Terms of Service (independently re-read, two fetches +including a targeted negative search) no longer contain the broad licence-over-inputs/outputs +finding from the prior pass. Sec 3 now states, near-verbatim: *"Runware will not use your +Training Data or Trained Models to train, fine-tune, or develop Runware's own models or those of +any third party."* Combined with Sec 2 granting Runware no rights over ordinary inputs/outputs +either, nothing in the current text permits training on your data - `trains_on_inputs` resolved +from unclear to **never**. + +- **Retention is still generic, not zero - unchanged.** The Privacy Policy keeps data "as long as + necessary" and for the life of the account, with **no auto-purge and no opt-in-storage clause**. + This remains the entry's principal residual weakness. +- **Load-bearing caveat:** the confidentiality/licence-removal finding above is *inferred* from the + current text's absence of the old clauses - web archives were proxy-blocked this pass, so no + verbatim old-vs-new diff was possible. High confidence given an evident deliberate rewrite, but + flagged as inferred rather than side-by-side quoted. ## Data & IP ownership -This is the central finding. Per the read **Terms**, the customer owns the "Generations" (outputs), -**but grants Runware a worldwide, perpetual, transferable licence over both inputs and outputs.** -Nominal ownership sits with you; a perpetual, transferable right to use your prompts and your -generated content sits with Runware. That is the opposite of "your data belongs to you and is never -reused". The Privacy Policy names only **Stripe and Google Analytics** as sub-processors, so the -processors that actually handle prompt content are not disclosed. The one clean escape is to -**self-host the same open-weight checkpoints**, which removes Runware from the data path entirely. +**Correction (2026-09-21), reversing the prior central finding.** A 2026-08-06 pass found the +customer had nominal ownership of Generations but Runware held a worldwide, perpetual, +transferable licence over both inputs and outputs. The current Terms (independently re-read) show +this is gone: Sec 2, near-verbatim - *"As between you and Runware, you own your Outputs... +Runware asserts no ownership of, and claims no intellectual property rights in, your Outputs."* +The only licence granted to Runware is name/logo for marketing (benign). A **Private Model +Protection** clause (Sec 2) separately treats privately uploaded custom models as confidential, +with an NDA available - this was already true before the rewrite and remains a genuine positive. +The Privacy Policy still names only **Stripe and Google Analytics** as sub-processors, so the +processors that actually handle prompt content remain undisclosed. Self-hosting the same +open-weight checkpoints remains the cleanest route where data control matters most. ## Data residency & jurisdiction diff --git a/inference-providers/runware/entry.yaml b/inference-providers/runware/entry.yaml index ef5c561..65f482f 100644 --- a/inference-providers/runware/entry.yaml +++ b/inference-providers/runware/entry.yaml @@ -11,20 +11,20 @@ profile: inference hq_country: United Kingdom summary: 'An inference platform ("one API for all AI") that runs a large catalogue of open-weight Hugging Face models on its own custom stack, the Sonic Inference Engine, across pods in the US - and central Europe. Runware markets a US HQ (San Francisco), but the binding legal entity read in - its Terms and Privacy Policy is Runware Ltd (United Kingdom), under UK governing law and London - arbitration. The binding documents were read on 2026-07-26 and they contradict the marketing on - data handling. The Terms give the customer nominal ownership of outputs but grant Runware a - worldwide, perpetual, transferable licence over both inputs and outputs, and reference storing - training data; the Privacy Policy sets generic retention ("as long as necessary" / account life) - with no auto-purge or opt-in-storage clause, does not address training at all, names only Stripe - and Google Analytics as sub-processors, and cites GDPR/UK GDPR without naming SCCs or the EU-US - Data Privacy Framework. SOC 2 and ISO 27001 appear as badges only, with no readable report, and - no public DPA was found (both URLs 404). The models themselves are open weights, so use and exit - stay in your hands by self-hosting, but on a hosted basis the data terms are weak: a perpetual - licence over your inputs and outputs, generic retention, and no no-training commitment. Read the - binding text before sending sensitive data, and prefer self-hosting the same open checkpoints - where data control matters. + and central Europe. Runware markets a US HQ (San Francisco), but the binding legal entity is + Runware Ltd (United Kingdom), under UK governing law and London arbitration. CORRECTED 2026-09-21: + an independent re-verification found the current Terms of Service no longer contain the adverse, + non-confidentiality clause a 2026-08-06 pass had found - the current text instead has the customer + own Outputs outright, gives no broad licence to Runware over inputs/outputs, and a Private Model + Protection clause treats uploaded custom models as confidential. This removal is inferred from the + current text''s absence of the old clauses (web archives were proxy-blocked, so no verbatim + historical diff was possible) but is high-confidence given an evident deliberate rewrite. The + adverse-confidentiality hard flag is lifted. What has NOT improved: retention is still generic + (account-lifetime, no auto-purge, no ZDR), sub-processor disclosure beyond Stripe/Google Analytics + is still thin, and SOC 2/ISO 27001 remain self-asserted badges with no readable report or dated + certificate. The models themselves are open weights, so use and exit stay in your hands by + self-hosting; on a hosted basis the data terms are now considerably less hostile than previously + graded, but retention and compliance verification remain real gaps. ' models_served: @@ -41,36 +41,55 @@ pricing: example_rates: - 'Pay-as-you-go usage-based pricing (see provider pricing page for current per-model rates)' data_governance: - default_retention: 'generic, not zero - the Privacy Policy retains data "as long as necessary" - and for the life of the account, with no auto-purge or opt-in-storage clause. This contradicts - the marketing claim that generated content is auto-purged unless storage is opted into.' - trains_on_inputs: unclear + default_retention: 'CORRECTED 2026-09-21: retention is still generic, not zero - Privacy Policy + Sec 6 retains data for the account lifetime with no numeric window or auto-purge/opt-in-storage + clause. This specific weakness is UNCHANGED. What changed is everything around it - see + confidentiality_caveats.' + trains_on_inputs: never zdr_available: "no" - zdr_scope_caveats: 'No zero-retention posture is supported by the binding text. The Privacy - Policy sets generic retention ("as long as necessary" / account life) with no auto-purge, and - the Terms grant Runware a worldwide, perpetual, transferable licence over inputs and outputs - and reference storing training data. There is no no-training commitment in either document. The - marketing claims of no-training and default auto-purge are not supported by the documents read. + zdr_scope_caveats: 'No zero-retention posture is supported by the binding text (Privacy Policy + Sec 6, unchanged) - this remains the entry''s principal residual weakness. CORRECTED 2026-09-21: + the current Terms of Service Sec 3 "Model Training and Fine-Tuning" (near-verbatim, independently + browser-read, two fetches): "Runware will not use your Training Data or Trained Models to train, + fine-tune, or develop Runware''s own models or those of any third party." trains_on_inputs + resolved from unclear to never - the clause is defined-term-scoped to the fine-tuning product, + but Sec 2 (see confidentiality_caveats) grants Runware no rights over ordinary inputs/outputs + either, so nothing in the current text permits training on inputs by any reading. The Privacy + Policy is silent on training. ' - customer_data_ownership: provider_may_use - outputs_used_to_improve_service: unclear + customer_data_ownership: customer_retains + outputs_used_to_improve_service: "no" third_party_routing_leakage: 'Runs open-weight models on its own inference pods rather than reselling a closed third-party model API. The Privacy Policy names only Stripe and Google Analytics as sub-processors, so the inference-infrastructure processors that actually handle - prompt content are not disclosed. + prompt content are not disclosed. Unchanged 2026-09-21. ' subprocessors_disclosed: true - confidentiality: adverse - confidentiality_caveats: 'Actively adverse on the standard terms (read 2026-08-06): "any - Contributions you upload ... or Generations you create using the Services will be considered - non-confidential and non-proprietary", and you grant Runware "a worldwide, non-exclusive, - royalty-free, transferable license to use, reproduce, distribute, prepare derivative works of, - display, and otherwise utilize" them in connection with the Services. Express exception: privately - uploaded custom models (weights/architectures) are treated as confidential, with a separate NDA - available. The no-training commitment covers only uploaded Training Data / Trained Models, not - ordinary prompts and generations.' + confidentiality: functional_only + confidentiality_caveats: 'CORRECTED 2026-09-21 - the adverse finding is NO LONGER SUPPORTED by the + current Terms of Service (independently browser-read, two fetches including a targeted negative + search): the current 28-section ToS contains NO Submissions/Contributions section, NO + IP-assignment of user content to Runware, NO "unrestricted use/dissemination without + acknowledgment or compensation" clause, and NO non-confidentiality disclaimer - the Termly-style + boilerplate that drove the adverse classification is simply absent. The current text is + affirmatively protective instead: Sec 2 (near-verbatim) - "As between you and Runware, you own + your Outputs... Runware asserts no ownership of, and claims no intellectual property rights in, + your Outputs"; Sec 2 Private Model Protection - "We agree to treat all such materials as + confidential" and "not to disclose, distribute, or otherwise make available these models to any + third party without the explicit written consent of the user"; Sec 4 requires the user to + protect Runware''s own proprietary information. The only licence the user grants Runware is + name/logo for marketing (benign). Coded functional_only, not mutual or explicit: there is no + general confidentiality clause covering ordinary prompts/outputs broadly - only Private Model + Protection is expressly confidential - so protection for ordinary content rests on the absence + of any licence grant plus retained ownership, not a stated duty of confidence. + LOAD-BEARING CAVEAT: this removal is INFERRED from the current text''s absence of the old + clauses, not verbatim-diffed against the prior August snapshot - all web archives + (web.archive.org, archive.ph, timetravel.mementoweb) were proxy-blocked this pass. High + confidence (an evident deliberate rewrite: new defined terms Training Data/Trained + Models/Outputs/Generations, a new Sec 3), but flagged as inferred rather than a side-by-side + quote. Retry the archive diff if a verbatim historical comparison is later required.' compliance: soc2: unknown iso_27001: unknown @@ -115,18 +134,25 @@ dedicated_notes: 'Enterprise plans advertise "dedicated capacity, custom SLAs" a any national border") point at sovereign/on-prem deployment but are a press-announcement claim, not a documented, generally-available offering.' trust_considerations: -- The binding Terms (Runware Ltd, UK; read 2026-07-26) give the customer nominal ownership of - outputs but grant Runware a worldwide, perpetual, transferable licence over inputs and outputs - and reference storing training data. This is the central finding and it contradicts the marketing - line that your data belongs to you and is never reused. The ordinary prompt/generation path is - the concern; privately uploaded custom models are the exception. -- Express exception (a genuine positive for that path) - privately uploaded custom models - (weights/architectures) ARE treated as confidential and a separate NDA is available - so the - private-model route is materially safer than ordinary prompts/generations, which the standard - Terms deem non-confidential. Prefer that route for anything sensitive. -- The Privacy Policy sets generic retention ("as long as necessary" / account life) with no - auto-purge or opt-in-storage clause and does not address training. The marketed no-training and - auto-purge claims are not supported by the document read. +- 'CORRECTED 2026-09-21, MATERIAL: a 2026-08-06 pass found the binding Terms (Runware Ltd, UK) gave + the customer nominal ownership of outputs but granted Runware a worldwide, perpetual, transferable + licence over inputs and outputs, deemed them non-confidential, and referenced storing training + data. An independent re-verification found this NO LONGER SUPPORTED by the current 28-section + Terms of Service (two fetches, targeted negative search): no Submissions/Contributions section, no + IP-assignment, no non-confidentiality disclaimer. The current text instead has the customer own + Outputs outright with no broad licence granted to Runware. LOAD-BEARING CAVEAT: this is inferred + from the current text''s absence of the old clauses - web archives were proxy-blocked, so no + verbatim old-vs-new diff was possible this pass. High confidence given an evident deliberate + rewrite (new defined terms, a new Sec 3), but flagged as inferred rather than side-by-side quoted.' +- Private Model Protection (Sec 2) remains a genuine positive - privately uploaded custom models + (weights/architectures) are treated as confidential and a separate NDA is available. This was + already true before the rewrite and remains true now; it is no longer the ONLY confidentiality + protection available, since ordinary Outputs are now customer-owned with no licence grant either. +- 'CORRECTED 2026-09-21: Sec 3 "Model Training and Fine-Tuning" now states verbatim "Runware will + not use your Training Data or Trained Models to train, fine-tune, or develop Runware''s own models + or those of any third party" - trains_on_inputs resolved from unclear to never. UNCHANGED: the + Privacy Policy still sets generic retention ("as long as necessary" / account life) with no + auto-purge or opt-in-storage clause - this remains the entry''s principal residual weakness.' - Sub-processors named are only Stripe and Google Analytics; the inference-infrastructure processors that handle prompt content are not disclosed. GDPR/UK GDPR is cited without naming SCCs or the EU-US Data Privacy Framework. @@ -138,29 +164,35 @@ trust_considerations: the same checkpoints avoids the hosted data terms. Where data control matters, prefer that route. score: rubric_version: '1.2' - headline: 45.6 + headline: 50.4 grade: D - hard_flags: - - '🚩 Adverse confidentiality: the standard Terms deem your Contributions and Generations - "non-confidential and non-proprietary" and take a worldwide, transferable, derivative-works - licence over them (private uploaded models excepted). data_governance is capped at 3 (it already - sits at 2), and trade-secret / patent-sensitive material should not go through the standard - prompt/generation path - use the private-model route or self-host.' + hard_flags: [] + # CORRECTED 2026-09-21: the adverse-confidentiality hard flag above is LIFTED. An independent + # re-verification found the current Terms of Service no longer contain the clauses that + # triggered it (see data_governance.confidentiality_caveats for the full finding and its + # load-bearing caveat: inferred from current-text absence, not a verbatim historical diff). dimensions: data_governance: - score: 2 - rationale: 'Grounded in the read Terms and Privacy Policy, and the posture is weak. The Terms - grant Runware a worldwide, perpetual, transferable licence over inputs and outputs and - reference storing training data; the Privacy Policy sets generic retention with no - auto-purge and does not address training. There is no no-training commitment and no - zero-retention posture. Held at 2: the binding text actively works against customer data - control, and only the open-weight, self-hostable nature of the models keeps it off the - floor. + score: 3 + rationale: 'CORRECTED 2026-09-21: the prior finding of a worldwide, perpetual, transferable + licence over inputs/outputs and a non-confidentiality declaration is no longer supported by + the current Terms of Service (independently browser-read, two fetches, targeted negative + search confirming the old clauses'' absence) - the current text instead has the customer own + Outputs outright, grants Runware no broad licence, and now-verbatim Sec 3 confirms no + training on Training Data/Trained Models, with nothing in the current text permitting + training on ordinary inputs either. Held at 3, not higher, because retention remains generic + (account-lifetime, no auto-purge, no numeric window - Privacy Policy Sec 6, unchanged) and + ZDR is unavailable - matching the anchor-2/3 boundary ("no training on inputs claimed, but + retention is the default with no bounded opt-out; ZDR unavailable") rather than anchor 4''s + "short bounded retention or ZDR by default" bar. Caveat: the confidentiality-clause removal + is inferred from current-text absence, not a verbatim historical diff (web archives were + proxy-blocked this pass). ' evidence_refs: - ev-terms - ev-privacy + - ev-terms-2026-09 compliance: score: 1 rationale: 'SOC 2 and ISO 27001 appear as badges only, with no readable report, and no public @@ -237,15 +269,15 @@ documentation: doc_type: reference source_type: aggregated coverage: full - refs: [ev-terms, ev-privacy] - summary: "Grounded in the read Terms and Privacy Policy. The Privacy Policy sets generic retention ('as long as necessary' / account life) with no auto-purge or opt-in-storage clause and does not address training. The Terms grant Runware a worldwide, perpetual, transferable licence over inputs and outputs and reference storing training data. There is no no-training commitment; the marketed no-training and auto-purge claims are not supported by the documents." + refs: [ev-terms-2026-09, ev-privacy] + summary: "CORRECTED 2026-09-21: the current Terms (independently re-read, two fetches) no longer grant Runware a licence over inputs/outputs and now include a verbatim Sec 3 no-train commitment - trains_on_inputs resolved unclear -> never. UNCHANGED weakness: the Privacy Policy still sets generic retention ('as long as necessary' / account life) with no auto-purge or opt-in-storage clause and does not address training." - key: data-ownership title: "Data & IP ownership" doc_type: reference source_type: aggregated coverage: full - refs: [ev-terms] - summary: "Per the read Terms, the customer owns the Generations (outputs) but grants Runware a worldwide, perpetual, transferable licence over inputs and outputs. Nominal ownership sits with the customer, but Runware holds a perpetual, transferable right to use both prompts and generated content. This is the opposite of the marketing line that your data stays yours; only self-hosting the open checkpoints avoids it." + refs: [ev-terms-2026-09] + summary: "CORRECTED 2026-09-21: per the current Terms (independently re-read), the customer owns the Generations (outputs) outright with NO licence granted to Runware over inputs or outputs - reversing a 2026-08-06 finding that Runware held a worldwide, perpetual, transferable licence. Caveat: this correction is inferred from the current text's absence of the old clauses, not a verbatim historical diff (web archives were proxy-blocked)." - key: residency title: "Data residency & jurisdiction" doc_type: reference @@ -378,13 +410,13 @@ ownership: factors: use_modify: { level: strong, rationale: "The catalogue is open-weight Hugging Face models, so you can run and adapt the same checkpoints elsewhere or self-hosted; the models themselves are fully portable, and self-hosting sidesteps the hosted data terms entirely." } # grounded in: ev-series-a, ev-home (open-model catalogue) - transparency: { level: moderate, rationale: "The binding Terms and Privacy Policy are legible, and what they show is unfavourable. Held at moderate rather than strong: the DPA returned 404 and the SOC 2 / ISO 27001 reports are badges with no readable report." } - # grounded in: ev-terms, ev-privacy (retrieved:true); ev-trust (partial) + transparency: { level: moderate, rationale: "The binding Terms and Privacy Policy are legible and independently re-read 2026-09-21. Held at moderate rather than strong: the DPA still returns 404, the SOC 2 / ISO 27001 reports remain badges with no readable report or dated certificate, and the confidentiality-clause correction below rests on inferred current-text absence rather than a verbatim historical diff (archives were proxy-blocked)." } + # grounded in: ev-terms, ev-privacy (retrieved:true); ev-trust (partial); ev-terms-2026-09 (retrieved:true, current) reliability: { level: moderate, rationale: "A USD 50M Series A and advertised enterprise custom SLAs indicate scale, but there is no public uptime SLA, status page or independent attestation, so reliability is asserted, not observable." } # grounded in: ev-series-a (third_party) - data_control: { level: weak, rationale: "The read Terms grant Runware a worldwide, perpetual, transferable licence over inputs and outputs and reference storing training data; the Privacy Policy sets generic retention with no auto-purge and does not address training; inference sub-processors are undisclosed. On a hosted basis your data and derived content are not kept proprietary." } - # grounded in: ev-terms, ev-privacy (retrieved:true, binding) - verdict: "You partly own workloads here, and the split is sharp. The models are open weights, so use, modification and exit stay fully in your hands, and self-hosting the same checkpoints avoids the hosted data terms entirely. But on a hosted basis the binding documents, now read, are weak: the Terms grant Runware a worldwide, perpetual, transferable licence over your inputs and outputs and reference storing training data, the Privacy Policy sets generic retention with no auto-purge and no no-training commitment, and no DPA or readable attestation was reachable. That is the opposite of the marketed 'your data stays yours, never trained on'. Use Runware as a fast, low-cost open-model gateway for non-sensitive work, but self-host the same open checkpoints, or get a negotiated DPA that overrides the standard licence, before putting proprietary or regulated data through it." + data_control: { level: moderate, rationale: "CORRECTED 2026-09-21: the prior worldwide, perpetual, transferable licence over inputs/outputs and non-confidentiality declaration is no longer supported by the current Terms - the customer now owns Outputs outright with no broad licence granted to Runware, and Sec 3 confirms no training on Training Data/Trained Models. Held at moderate, not strong: retention remains generic with no auto-purge (Privacy Policy Sec 6, unchanged), inference sub-processors beyond Stripe/Google Analytics are undisclosed, and the confidentiality-removal finding is inferred rather than verbatim-diffed against the prior snapshot." } + # grounded in: ev-terms-2026-09 (terms, retrieved:true, current); ev-privacy (retained retention weakness) + verdict: "You partly own workloads here, but this picture improved materially on independent re-verification (2026-09-21). The models are open weights, so use, modification and exit stay fully in your hands, and self-hosting the same checkpoints avoids the hosted data terms entirely. On a hosted basis, the current binding Terms no longer grant Runware a broad licence over your inputs and outputs or deem them non-confidential - a 2026-08-06 pass found exactly that, but the current text (independently re-read) shows the customer owns Outputs outright and Runware commits not to train on your data. Load-bearing caveat: this correction is inferred from the current text's absence of the old clauses, not a verbatim old-vs-new diff (web archives were proxy-blocked). What has not improved: retention is still generic with no auto-purge or numeric window, and SOC 2/ISO 27001 remain self-asserted badges with no readable report. Use Runware with more confidence than before for ordinary workloads, but still confirm retention terms directly and request the underlying compliance reports before regulated use." evidence: - id: ev-terms @@ -448,6 +480,28 @@ evidence: retrieved: true url: https://siliconangle.com/2025/12/11/ai-inference-startup-runware-raises-50m-make-ai-run-faster/ date: '2026-07-26' +- id: ev-terms-2026-09 + claim: 'Runware Terms of Service, current version (independently browser-read 2026-09-21, two + fetches including a targeted negative search for the prior adverse clauses). The current 28-section + text contains NO Submissions/Contributions section, NO IP-assignment of user content to Runware, + NO "unrestricted use/dissemination without acknowledgment or compensation" clause, and NO + non-confidentiality disclaimer. Instead, near-verbatim: Sec 2 - "As between you and Runware, you + own your Outputs... Runware asserts no ownership of, and claims no intellectual property rights + in, your Outputs"; Sec 2 Private Model Protection - "We agree to treat all such materials as + confidential" and "not to disclose, distribute, or otherwise make available these models to any + third party without the explicit written consent of the user"; Sec 4 requires the user to protect + Runware''s own proprietary information; Sec 3 "Model Training and Fine-Tuning" - "Runware will not + use your Training Data or Trained Models to train, fine-tune, or develop Runware''s own models or + those of any third party." The only user-granted licence (Sec 2) is name/logo for marketing + (benign). LOAD-BEARING CAVEAT: web.archive.org, archive.ph and timetravel.mementoweb were all + proxy-blocked this pass, so the August-2026 snapshot could not be read - the removal of the old + adverse clauses is inferred from their absence in the current text plus an evident deliberate + rewrite (new defined terms, a new Sec 3), not a verbatim side-by-side quote.' + source_type: publisher + doc_type: terms + retrieved: true + url: https://runware.ai/terms + date: '2026-09-21' changelog: - date: '2026-07-26' change: 'Initial v2 entry created from public/marketing claims (binding docs were 403 to the code @@ -471,7 +525,23 @@ changelog: Added confidentiality: adverse (+ hard flag) and dedicated_availability: enterprise_only (Sonic Pods announced, not GA). No dimension score changed - data_governance already sits at 2 (below the adverse cap of 3); added the private-model exception as a genuine positive for that path.' -last_verified: '2026-08-06' +- date: '2026-09-21' + change: 'Freshness re-verification (Cowork browser session, two fetches with a targeted negative + search) found the adverse-confidentiality finding is NO LONGER SUPPORTED by the current Terms of + Service: the Termly-style boilerplate that drove it (non-confidentiality declaration, broad + transferable licence over inputs/outputs) is absent from the current 28-section text, which + instead has the customer own Outputs outright with no broad licence granted to Runware, and a + verbatim Sec 3 no-train commitment. LOAD-BEARING CAVEAT: this is inferred from current-text + absence, not a verbatim diff against the prior snapshot - all web archives were proxy-blocked this + pass. Lifted the adverse hard flag; confidentiality: adverse -> functional_only; + customer_data_ownership: provider_may_use -> customer_retains; outputs_used_to_improve_service: + unclear -> no; trains_on_inputs: unclear -> never (Sec 3, scoped to the fine-tuning product but + nothing in the current text permits training on inputs either). **data_governance 2 -> 3** + (45.6 -> 50.4; grade D unchanged - other dimensions were not re-examined this pass). Ownership + data_control weak -> moderate. What did NOT improve: + retention remains generic with no auto-purge (Privacy Policy Sec 6, unchanged) and SOC 2/ISO 27001 + remain self-asserted badges with no readable report - compliance and residency scores unchanged.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/inference-providers/together-ai/assess.md b/inference-providers/together-ai/assess.md index c46c82c..7dabce8 100644 --- a/inference-providers/together-ai/assess.md +++ b/inference-providers/together-ai/assess.md @@ -27,11 +27,14 @@ DPA rather than relying on the default terms. The **Terms of Service** settle ownership directly: *as between you and Company, you exclusively own all right, title and interest in Your Content and Output*, granting Together only a **limited license** to access, host and operate that content solely to provide the -Services. Together separately owns its own Company IP and Usage Data. Combined with -**ZDR-by-default** from the Privacy Policy - nothing retained to improve the service unless an -org admin opts in - the practical posture is that **your data and the outputs derived from it -stay yours**. The one gap is disclosure: the **sub-processor list is not published**, so for a -regulated deployment pin sub-processor terms in the DPA. +Services. Together separately owns its own Company IP and Usage Data. **Correction (2026-09-21, +independently verbatim-confirmed):** Zero Data Retention is account-level **opt-in**, not the +default - Privacy Policy Sec 2.6: *"By choosing 'No', you are enabling Zero Data Retention."* +Absent ZDR, standard processing applies; training remains off by default regardless (a separate +opt-in). The practical posture is still that **your data and the outputs derived from it stay +yours** by ownership and training terms - just not by retention default. The DPA's Annex III +sub-processor list (9 named entities, including OpenAI OpCo LLC) is a findable PDF, not a +self-serve published page - pin sub-processor terms in the DPA for a regulated deployment. ## Compliance & attestations diff --git a/inference-providers/together-ai/entry.yaml b/inference-providers/together-ai/entry.yaml index 822a42c..b7733cd 100644 --- a/inference-providers/together-ai/entry.yaml +++ b/inference-providers/together-ai/entry.yaml @@ -9,42 +9,72 @@ id: together-ai name: Together AI profile: inference hq_country: United States -summary: 'A US-headquartered inference provider serving a broad open-model catalogue - (Llama 3.x/4, DeepSeek V3/R1, Qwen3 incl. 235B, Mistral/Mixtral, gpt-oss 20B/120B, - plus embeddings and image models) over per-token serverless and dedicated GPU endpoints. - Its standout governance fact, stated in Together''s own Privacy Policy and Terms of - Service, is zero-data-retention by default with training opt-in and off by default, and - Terms that leave you owning your inputs and outputs; the biggest caveat is that EU data - centres and region pinning are gated to the higher Scale/Enterprise tiers, and it carries - standing US CLOUD Act exposure. The no-retention posture is stated in the binding terms - but not independently attested. +summary: 'A US-headquartered inference provider serving a broad, fast-moving open-model + catalogue (Llama 3.3, DeepSeek V4-generation, Qwen3.5/3.7/3.8, GLM-5.3, Kimi K3, gpt-oss + 120B, plus image/video/audio models including some wrapped third-party proprietary + APIs) over per-token serverless and dedicated GPU endpoints. It no longer serves + embedding models on serverless (removed since the prior pass). Its standout governance + fact, stated in Together''s own Privacy Policy and Terms of Service, is zero-data-retention + by default with training opt-in and off by default, and Terms that leave you owning your + inputs and outputs; the biggest caveat is that EU data centres and region pinning are + gated to the higher Scale/Enterprise tiers, and it carries standing US CLOUD Act exposure. + The no-retention posture is stated in the binding terms but not independently attested. ' models_served: -- Llama 3.x / Llama 4 -- DeepSeek V3 / R1 -- Qwen3 (incl. 235B) -- Mistral / Mixtral -- gpt-oss 20B / 120B -- embeddings and image models +- Llama 3.3 70B (Llama 4 Maverick/Scout appear only as fine-tuning base models, not + confirmed servable on serverless - re-check before relying on this) +- DeepSeek V4 Pro 0813 / DeepSeek V4.1 Flash / DeepSeek V4 Flash 0731 (V3/R1 no longer + served) +- Qwen3.5-397B-A17B / Qwen3.7-Max / Qwen3.6-Plus / Qwen3.8-2.4T-A95B, plus the legacy + Qwen3-235B-A22B throughput SKU +- GLM-5.3 / GLM-5.3-Flash / GLM-5.2 (Z.ai, new since the prior pass) +- Kimi K3 (Moonshot, new since the prior pass) +- gpt-oss 120B (gpt-oss 20B not confirmed on the live serverless chat pricing table - + re-check) +- MiniMax M3 / M2.7, Gemma 4 31B, Cogito v2.1 671B (new since the prior pass) +- Mistral / Mixtral - REMOVED from serverless; Mixtral 8x7B now appears only as a + fine-tuning base model +- 'image/video/audio: FLUX.2, Ideogram 4.0, Qwen Image 2.0, Seedream/Seedance/Seedance + 2.5, Imagen 4.0, Sora 2, Kling 2.1, plus wrapped third-party proprietary APIs (GPT + Image 1.5/2, Gemini "Nano Banana" image variants)' +- embeddings - NONE offered via serverless; docs.together.ai states this explicitly + ("There are currently no embedding models offered via serverless"), same for rerank + and moderation - contradicts the prior pass''s "embeddings" line, now corrected hardware: NVIDIA GPU pricing: model: mixed notes: 'Per-token serverless pricing plus dedicated GPU endpoints on Scale/Enterprise - tiers. Rates are approximate and move frequently (third-party research). + tiers. Rates are approximate and move frequently (third-party research); live-checked + against together.ai/pricing on 2026-09-20. ' example_rates: - - 'gpt-oss-120B: ~$0.15/M in, ~$0.60/M out' - - 'Qwen3-235B: ~$0.20/M in, ~$0.60/M out' - - 'DeepSeek-V3: ~$1.25/M' + - 'gpt-oss-120B: $0.15/M in, $0.60/M out (unchanged)' + - 'Qwen3-235B-A22B (throughput SKU): $0.20/M in, $0.60/M out (unchanged)' + - 'DeepSeek V4 Pro 0813: $1.32/M in, $3.96/M out (supersedes DeepSeek-V3)' + - 'DeepSeek V4.1 Flash: $0.30/M in, $1.20/M out' + - 'Kimi K3: $3.00/M in, $15.00/M out' + - 'GLM-5.3: $1.40/M in, $4.40/M out' data_governance: - default_retention: none by default (inputs/outputs not stored); temporary caching - for performance + default_retention: 'CORRECTED 2026-09-21: an independent Cowork browser session re-read the + Privacy Policy verbatim and confirmed retention is NOT zero by default - Sec 2.6: "By + choosing ''No'', you are enabling Zero Data Retention (''ZDR'')... the content you submit ... + are not stored, retained, or used for model training, product improvements, or any secondary + purposes except as needed to provide the Services to you." ZDR is something the customer + actively enables, not the standing default; absent it, standard processing applies + (temporary caching for performance, and content used per the Terms'' purpose-limited + licence). A prior entry stated "none by default," conflating the training-opt-in default + (correctly off by default) with the retention default (not zero unless ZDR is turned on).' trains_on_inputs: opt_in_only - zdr_available: yes_default - zdr_scope_caveats: 'Temporary caching may occur for performance. The no-store default - is self-attested in Together''s own Privacy Policy and Terms of Service; it has not + zdr_available: yes_optional + zdr_scope_caveats: 'CORRECTED 2026-09-21: ZDR is account-level and OPT-IN (Privacy Policy Sec + 2.6, independently re-read verbatim), not the default. Terms of Service Sec 3 ("Your + Content") corroborates: "Under ZDR, your data and outputs are not stored, retained, or used + for model training, product improvements, or any other purpose beyond the time required to + process the specific request or transaction" - a benefit of enabling ZDR, not the baseline + state. The no-training-without-opt-in default (separately) remains correctly coded as + opt_in_only. This posture is self-attested in Together''s own binding documents; it has not been independently audited. ' @@ -103,14 +133,23 @@ trust_considerations: - Deployment ladder is a genuine strength - serverless, dedicated endpoints, self-serve bare-metal GPU clusters, and VPC/on-prem enterprise deployment. But EU dedicated endpoints are gated to Scale/Enterprise tiers and single-tenancy is in the docs, not warranted in the contract. -- ZDR-by-default and no-training-without-opt-in are stated in the binding Privacy Policy - and Terms of Service but are not independently audited. +- 'CORRECTED 2026-09-21: ZDR is account-level OPT-IN, not the default - a prior version of this + entry said "ZDR-by-default." Confirmed via an independent verbatim re-read of Privacy Policy + Sec 2.6 ("By choosing ''No'', you are enabling Zero Data Retention"). No-training-without-opt-in + is correctly stated and remains grounded in the binding Privacy Policy and Terms of Service; none + of this is independently audited.' - EU residency and region pinning are gated to Scale/Enterprise tiers, per the support KB. - ISO 27001 is unconfirmed (the DPA aligns risk management to ISO 27005 / NIST 800-37, not 27001 certification); HIPAA/BAA support is indicated in the security docs rather than shown - as a formal attestation, and the SOC 2 Type II report itself was not obtained - only the vendor announcement. + as a formal attestation, and the SOC 2 Type II report itself was not obtained - only the vendor + announcement (independently re-confirmed 2026-09-21 - published 2025-07-08, auditor not named). - US HQ implies standing CLOUD Act exposure even for EU-hosted workloads; the DPA confirms default routing through North America data centres with EU transfers under SCCs. +- 'NEW FINDING 2026-09-21: the DPA''s Annex III sub-processor list (independently browser-read, + 9 named entities) includes OpenAI OpCo, LLC (US) - an unusual entry for a peer inference + provider''s sub-processor list. This does not itself indicate served-model routing through + OpenAI (third_party_routing_leakage remains coded as none for served models), but is worth + independent follow-up if OpenAI''s role there matters to your use case.' score: rubric_version: '1.2' headline: 70.4 @@ -119,14 +158,17 @@ score: dimensions: data_governance: score: 3 - rationale: 'ZDR by default, training opt-in and off by default, and customer-retained - ownership of Your Content and Output are all grounded in the binding Privacy Policy and - Terms of Service - a genuinely strong retention/training posture. But ToS Sec 9 expressly - DISCLAIMS confidentiality ("no confidentiality obligations ... unless otherwise agreed in - writing"), so on standard terms your data is not contractually kept in confidence - under - rubric 1.2 an express confidentiality disclaimer caps data_governance at 3. Also held down - by the self-attested (unaudited) no-retention behaviour, the undisclosed sub-processor list, - and access to Third-Party Models under their own terms. + rationale: 'CORRECTED 2026-09-21: ZDR is account-level OPT-IN (Privacy Policy Sec 2.6, + independently re-read verbatim), not the default - a prior rationale overstated this as + "ZDR by default." Training opt-in-and-off-by-default and customer-retained ownership of + Your Content and Output remain correctly grounded in the binding Privacy Policy and Terms + of Service. ToS Sec 9 expressly DISCLAIMS confidentiality ("no confidentiality + obligations ... unless otherwise agreed in writing"), confirmed unchanged on two + independent live fetches - so on standard terms your data is not contractually kept in + confidence, and under rubric 1.2 an express confidentiality disclaimer caps data_governance + at 3 regardless of the retention correction above. Also held down by the self-attested + (unaudited) posture, the undisclosed sub-processor list, and access to Third-Party Models + under their own terms. ' evidence_refs: @@ -460,12 +502,17 @@ evidence: claim: 'Data Processing Addendum: Together (US) Inc. is bound to the EU Commission Standard Contractual Clauses (and UK Addendum) for EU personal-data transfers, maintains a risk management program aligned to ISO 27005 / NIST 800-37, requires encryption of controller - data in transit and storage, and defaults to routing through North America data centres.' + data in transit and storage, and defaults to routing through North America data centres. + UPDATED 2026-09-21 (independent re-read, unchanged since 2026-07-25): Annex III names 9 + sub-processors - Amazon Web Services (US), Mailgun Technologies (US), Amplitude (US), + Functional Software/Sentry (US), OpenAI OpCo LLC (US), Together Software Inc. (Canada), + Hotjar Ltd (Malta), Intercom (US), Absorb Software (Canada/US/UK/EU/Australia). No + effective/execution date is visible on the PDF itself.' source_type: publisher doc_type: dpa retrieved: true url: https://cdn.prod.website-files.com/5ce11396d0cadb55a02cabf7/696024ff5649fb30b125686c_Together%20DPA%20(Website).pdf - date: '2026-07-25' + date: '2026-09-21' changelog: - date: '2026-07-25' change: Initial entry. @@ -491,7 +538,28 @@ changelog: (75.2 -> 70.4 headline): under rubric 1.2 an express confidentiality disclaimer caps D1 at 3 - the retention/training posture is strong but standard terms give no duty of confidence. Ownership verdict/level unchanged (still partial).' -last_verified: '2026-08-06' +- date: '2026-09-20' + change: 'Catalogue/pricing freshness pass (45 days past the fast-moving SLA). Live-verified via + browser DOM read of together.ai/pricing: the served catalogue moved a full generation + (DeepSeek V3/R1 -> V4-generation, Qwen3 -> 3.5/3.7/3.8, new GLM-5.3 + Kimi K3 entries), + Mistral/Mixtral dropped from serverless (fine-tuning-only now), and the prior "embeddings" + claim in models_served was corrected - Together''s own docs now state no embedding models are + offered via serverless at all. Updated models_served and example_rates; score and governance + fields left unchanged pending a deeper re-read.' +- date: '2026-09-21' + change: 'CORRECTION - independent Cowork browser verification pass (full governance re-read, + not just catalogue). Sec 9''s express confidentiality disclaimer is CONFIRMED unchanged on + two independent live fetches - the data_governance cap at 3 stands, now independently + verified rather than resting on the 2026-08-06 pass alone. The 2026-09-20 catalogue findings + (no serverless embeddings/rerank, Mistral/Mixtral fine-tuning-only) are also independently + CONFIRMED real, not a rendering artefact. One real correction: `zdr_available` was coded + yes_default; an independent verbatim re-read of Privacy Policy Sec 2.6 ("By choosing + ''No'', you are enabling Zero Data Retention") confirms ZDR is account-level OPT-IN, not the + default - corrected to yes_optional. This does not change the score (already capped at 3 by + the confidentiality disclaimer) but corrects a real field-level inaccuracy. New finding: the + DPA''s Annex III sub-processor list names OpenAI OpCo, LLC - flagged in trust_considerations + for awareness, not scored. Headline unchanged at 70.4/B.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/ai2-olmo/entry.yaml b/models/ai2-olmo/entry.yaml index ea6d918..c4212e5 100644 --- a/models/ai2-olmo/entry.yaml +++ b/models/ai2-olmo/entry.yaml @@ -584,7 +584,9 @@ changelog: (ev-dolma, ev-apache, ev-integrity, ev-ops) from onehill_verified to publisher. - date: '2026-07-25' change: Grounded against primary sources (docs/primary-sources/ai2-olmo) - Apache-2.0 LICENSE, Dolma ODC-BY and OLMo 2/3 technical reports read verbatim; evidence retrieved:true, doc_type added. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. OLMo 2''s Apache-2.0 fully-open licence and posture re-confirmed unchanged. Flag (not folded): AI2 has shipped OLMo 3 (also Apache-2.0, fully_open, trained on the refreshed Dolma 3 corpus) - a genuinely new generation continuing the same fully-open posture; recommended as a new sibling for a future build pass, not a replacement for this OLMo 2 entry.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/deepseek-r1-distill-llama/entry.yaml b/models/deepseek-r1-distill-llama/entry.yaml index b276020..2353f20 100644 --- a/models/deepseek-r1-distill-llama/entry.yaml +++ b/models/deepseek-r1-distill-llama/entry.yaml @@ -358,7 +358,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `deepseek` entry on the licence axis. These are the R1-Distill checkpoints on Meta Llama bases (8B=Llama 3.1, 70B=Llama 3.3), carrying the Llama Community Licence (AUP, 700M-MAU, naming/attribution); the Apache-2.0 Qwen-base distils are the separate deepseek-r1-distill-qwen entry. The use restrictions drop use-and-modify to moderate and ownership to partial. Shared behavioural grounding carried from the deepseek family entry. Grounded 2026-08-03. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged (MIT distillation over the Llama-licensed base). No newer distill supersedes this entry; DeepSeek has not re-cut this distill line under V4.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/deepseek-r1-distill-qwen/entry.yaml b/models/deepseek-r1-distill-qwen/entry.yaml index ec52250..fe14696 100644 --- a/models/deepseek-r1-distill-qwen/entry.yaml +++ b/models/deepseek-r1-distill-qwen/entry.yaml @@ -360,7 +360,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `deepseek` entry on the licence axis. These are the R1-Distill checkpoints on Apache-2.0 Qwen2.5 bases (1.5B-32B); the Llama-base distils (Llama Community Licence) are the separate deepseek-r1-distill-llama entry. Apache-2.0 + small (non-systemic-risk) scale gives a cleaner legal profile (legal 3) and ownership substantial. Shared behavioural grounding carried from the deepseek family entry. Grounded 2026-08-03. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged (MIT distillation over the Qwen-licensed base). No newer distill supersedes this entry; note the base Qwen family has itself moved to Qwen3.5/3.6/3.8 (see the qwen entry), not folded here.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/deepseek-r1/entry.yaml b/models/deepseek-r1/entry.yaml index 95e7cf5..d38e1e9 100644 --- a/models/deepseek-r1/entry.yaml +++ b/models/deepseek-r1/entry.yaml @@ -353,7 +353,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `deepseek` entry. This is the pure-MIT reasoning line (R1, R1-0528). MIT (commercial + distillation expressly permitted) makes use-and-modify strong and lifts ownership to substantial; shared safety/performance/operational/governance grounding carried from the deepseek family entry. Grounded 2026-08-03 (licence read verbatim from the R1 README). -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification (Cowork browser session). Licence unchanged (MIT, verbatim re-read). No newer R1 point release supersedes this entry. Flag (not folded): DeepSeek has since shipped a materially newer generation - the V4 line (V4.1-Flash, V4-Flash-Vision-Exp, V4-Pro-0813, V4-Flash-0731) and V3.1/V3.2 - as separate new entities for a future build pass, not an update to R1.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/deepseek-v3-mit/entry.yaml b/models/deepseek-v3-mit/entry.yaml index c214a3e..383bc9c 100644 --- a/models/deepseek-v3-mit/entry.yaml +++ b/models/deepseek-v3-mit/entry.yaml @@ -355,7 +355,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `deepseek` entry. This is the MIT-licensed V3 line (V3-0324, V3.1); the original Dec-2024 V3 weights (DeepSeek License Agreement v1.0) are the separate deepseek-v3-original entry - the licence change is the split axis. MIT makes use-and-modify strong and ownership substantial; shared safety/performance/operational/governance grounding carried from the deepseek family entry. Grounded 2026-08-03. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged (MIT). Flag (not folded): superseded by V3.1/V3.2 (also MIT) and the V4 line - new entities for a future build pass.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/deepseek-v3-original/entry.yaml b/models/deepseek-v3-original/entry.yaml index c7354a6..2ebc457 100644 --- a/models/deepseek-v3-original/entry.yaml +++ b/models/deepseek-v3-original/entry.yaml @@ -372,7 +372,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `deepseek` entry on the licence axis. This is the ORIGINAL Dec-2024 V3 (Base + Chat), whose weights are the custom DeepSeek License Agreement v1.0 (RAIL-style use restrictions, non-OSI), NOT MIT; the V3-0324/V3.1 generations moved to MIT and are deepseek-v3-mit. The use restrictions drop use-and-modify to moderate and ownership to partial - the divergence that justifies the split. Shared safety/performance/operational/governance grounding carried from the deepseek family entry. Licence read verbatim from LICENSE-MODEL; grounded 2026-08-03. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged - the MIT-code / DeepSeek-License-weights split re-confirmed still real from both LICENSE files. Flag (not folded): same V3.1/V3.2/V4 supersession as the MIT variant.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/eurollm/entry.yaml b/models/eurollm/entry.yaml index d9c36a1..4b1553e 100644 --- a/models/eurollm/entry.yaml +++ b/models/eurollm/entry.yaml @@ -614,7 +614,9 @@ changelog: change: Initial v2 four-domain library entry. - date: '2026-07-25' change: Grounded evidence against primary sources (docs/primary-sources/eurollm) - Apache-2.0 licence (9B/1.7B/22B-Instruct-2512), the EuroLLM-9B technical report, and the 9B/1.7B/22B-Instruct-2512 model cards read verbatim; added doc_type + retrieved to all evidence and a docs item pinning the partial-openness nuance (SFT set released, ~4T pretraining corpus not); ownership factors and verdict grounded to clean Apache-2.0 + partial (not full) data openness. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. EuroLLM-9B''s Apache-2.0 licence and gated access re-confirmed unchanged. Flag (not folded): a newer, larger EuroLLM-22B-2512 has shipped - a new sibling for a future build pass; its licence tag (expected Apache-2.0) needs confirming from its own raw repo file before scoring.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/glm-4-9b-chat-original/entry.yaml b/models/glm-4-9b-chat-original/entry.yaml index b4c83ce..58936d5 100644 --- a/models/glm-4-9b-chat-original/entry.yaml +++ b/models/glm-4-9b-chat-original/entry.yaml @@ -363,7 +363,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `glm` entry on the licence axis. This is the ORIGINAL GLM-4-9B-Chat / -Chat-1M (THUDM, mid-2024), governed by the custom non-OSI, REVOCABLE, commercial-registration-gated "glm-4" licence; the GLM-4.5/4.6 and GLM-4-0414 series moved to MIT and remain the `glm` entry. The revocable, gated, name-prefixing licence takes use-and-modify to weak and ownership to limited - the divergence that justifies the split. Licence read verbatim from the THUDM LICENSE; grounded 2026-08-03. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. The custom glm-4 licence and its commercial-registration clause re-read verbatim, unchanged. The new GLM-5 generation (see the glm entry) does not supersede this distinct legacy glm-4-9b-chat repo, which remains live.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/glm/entry.yaml b/models/glm/entry.yaml index 8c0e221..dc0a4f5 100644 --- a/models/glm/entry.yaml +++ b/models/glm/entry.yaml @@ -701,7 +701,9 @@ changelog: LICENSE; legacy glm-4-9b custom PRC-law "glm-4" registration licence read verbatim) and the hosted Z.ai terms/privacy (Singapore law/SIAC vs the PRC weights licence); tightened ownership rationales/verdict with # grounded in comments. No score changes. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. The tracked MIT-cluster licence is unchanged. Flag (not folded): Z.ai/Zhipu has shipped a GLM-5 generation (GLM-5/5.1/5.2/5.3/5.3-Flash) under a custom GLM-5.3 License with a Model-as-a-Service security-review gate reported at a $10B threshold - licence-divergent from this MIT entry and warrants a new glm-5 entity/family split in a future build pass, not a fold-in.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/gpt-oss/entry.yaml b/models/gpt-oss/entry.yaml index 0707e2e..03d10c2 100644 --- a/models/gpt-oss/entry.yaml +++ b/models/gpt-oss/entry.yaml @@ -720,7 +720,9 @@ changelog: change: Initial v2 library entry for OpenAI gpt-oss (gpt-oss-120b / gpt-oss-20b). - date: '2026-07-25' change: Grounded evidence against primary sources (docs/primary-sources/gpt-oss) - added doc_type/retrieved to every item; read the Apache-2.0 LICENSE, the one-sentence USAGE_POLICY, the arXiv 2508.10925 model card, the OpenAI safety-report PDF and the METR third-party methodology review verbatim (retrieved:true); grounded ownership factors. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. gpt-oss-20b and gpt-oss-120b''s Apache-2.0, ungated status re-confirmed unchanged. Optional note, not folded: OpenAI has published gpt-oss-safeguard variants (complementary safety/guardrail artefacts) that could be added as siblings later; they do not change this entry''s grade.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/kimi-k2/entry.yaml b/models/kimi-k2/entry.yaml index 97ec053..b0ef7e4 100644 --- a/models/kimi-k2/entry.yaml +++ b/models/kimi-k2/entry.yaml @@ -605,7 +605,9 @@ changelog: change: Initial entry (Kimi K2 - Moonshot AI). - date: '2026-07-25' change: Grounded evidence against primary sources (docs/primary-sources/kimi-k2) - Modified-MIT 100M-MAU/$20M-revenue clause read verbatim; arXiv technical report and HF model card retrieved; added hosted platform.kimi.ai terms + privacy_policy evidence (trains-by-default, Singapore/SIAC); doc_type/retrieved added to every evidence item; ownership factors + verdict tightened around the attribution trigger and the weights-vs-hosted split. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. The modified-MIT licence''s branding clause (100M-MAU / $20M-monthly-revenue threshold requiring prominent Kimi K2 display) re-read verbatim, unchanged. Flag (not folded): Moonshot has shipped K2.5, K2.6 and K2.7-Code - distinct newer releases for a future build pass to assess sibling-vs-update.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/kimi-k3/entry.yaml b/models/kimi-k3/entry.yaml index f4c13aa..533a9ad 100644 --- a/models/kimi-k3/entry.yaml +++ b/models/kimi-k3/entry.yaml @@ -583,7 +583,9 @@ evidence: changelog: - date: '2026-07-28' change: Initial entry (Kimi K3 - Moonshot AI). Classified open-weights (not closed-frontier); grounded against primary sources in docs/primary-sources/kimi-k3 - Kimi K3 License read verbatim (new $20M Model-as-a-Service separate-agreement gate), technical report PDF text-extracted (no training-token/FLOP figure published; section 6.2.2 offensive-cyber, no refusal), hosted platform terms + privacy (train-by-default, Singapore/SIAC). -last_verified: '2026-07-28' +- date: '2026-09-21' + change: 'Freshness re-verification. The Kimi K3 License''s load-bearing $20M MaaS separate-agreement gate and branding thresholds re-read verbatim, unchanged - the K3 risk finding stands. No K4 or point release that alters the tracked terms.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/llama-4/entry.yaml b/models/llama-4/entry.yaml index 55a1a29..0e42d36 100644 --- a/models/llama-4/entry.yaml +++ b/models/llama-4/entry.yaml @@ -390,7 +390,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `meta-llama` entry. Llama 4 (Scout/Maverick/Behemoth) is scored apart from the Llama 3.x text line because of a licence + scored divergence that bites - the incorporated AUP denies EU-domiciled individuals/companies any licence to the multimodal models (verbatim), and the large Llama 4 models are systemic-risk (>1e25) - dropping legal to 2 with a hard flag, and making EU-domiciled ownership effectively none. Non-EU ownership is partial. Licence/AUP read verbatim from Meta's canonical mirror; grounded 2026-08-03. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Llama 4 Community License''s 700M-MAU threshold and gating re-confirmed unchanged. One tool-limitation caveat: the licence''s EU-domicile multimodal carve-out in the Additional Terms section was truncated by the fetch tool and could not be re-read verbatim this pass - treated as unchanged pending a manual eyeball, not evidence of a change. No Behemoth GA or newer point release.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/meta-llama/entry.yaml b/models/meta-llama/entry.yaml index 2fdcb7d..aedcee7 100644 --- a/models/meta-llama/entry.yaml +++ b/models/meta-llama/entry.yaml @@ -650,7 +650,9 @@ changelog: the score block over unchanged). - date: '2026-07-25' change: Grounded licence + AUP evidence against primary sources (docs/primary-sources/meta-llama) - 700M-MAU and EU-multimodal clauses read verbatim; evidence retrieved:true, doc_type added. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. Llama 3.x Community License 700M-MAU threshold clause re-read verbatim, unchanged. No new Llama 3.x release; Llama 4 remains tracked separately.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/mistral-research-license/entry.yaml b/models/mistral-research-license/entry.yaml index e0cef87..a9dba0b 100644 --- a/models/mistral-research-license/entry.yaml +++ b/models/mistral-research-license/entry.yaml @@ -377,7 +377,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry - split from the aggregate `mistral` entry on the licence axis. This is the non-commercial Mistral line - MRL research-only (Ministral 8B, Mistral Large 2, Pixtral Large) and MNPL non-production (Codestral); the Apache-2.0 flagship models remain the `mistral` entry. The non-commercial bar takes use-and-modify to weak and ownership to limited - the divergence that justifies the split. Licences read from Mistral's MRL-0.1 / MNPL-0.1 docs; grounded 2026-08-03. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged - Ministral-8B-2410 and Mistral-Large-2407 remain under the Mistral Research License (mrl tag re-confirmed). Note only, not a change: Mistral''s newer-generation releases appear to be trending toward Apache-2.0 (see the mistral entry); the currently-tracked MRL entries are still MRL.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/mistral/entry.yaml b/models/mistral/entry.yaml index 5390d0c..f33bcda 100644 --- a/models/mistral/entry.yaml +++ b/models/mistral/entry.yaml @@ -722,7 +722,9 @@ changelog: marked retrieved:false pending the Cowork hand-off.' - date: '2026-07-25' change: Flipped licence/DPA evidence to retrieved:true from primary sources (docs/primary-sources/mistral) - weights-page per-model licences, MRL-0.1, MNPL-0.1 and DPA clauses read verbatim. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. The tracked Apache-2.0 arm is unchanged and has expanded with new-generation releases (Mistral-Small-4-119B, Devstral-2, Voxtral, all Apache-2.0). Codestral-22B-v0.1 remains mnpl, unchanged. Flagged for a future build pass, not scored here: Mistral-Large-3-675B and Ministral-3 were read as Apache-2.0 via a summariser, not a raw LICENSE-tag read - if a genuine MRL-to-Apache reclassification, that is score-moving and needs a manual raw-tag confirmation before any re-score.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/nemotron-3-nano-omni/entry.yaml b/models/nemotron-3-nano-omni/entry.yaml index c22ddee..b1c0cbf 100644 --- a/models/nemotron-3-nano-omni/entry.yaml +++ b/models/nemotron-3-nano-omni/entry.yaml @@ -581,7 +581,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry (NVIDIA Nemotron 3 Nano Omni, multimodal), split out of the former aggregate nemotron entry so each per-licence release is scored on its own. Governed by the NVIDIA Open Model Agreement (a third distinct family licence, near-identical to the Nemotron OML); the corrected reading records it as Apache-2.0-derived, perpetual, royalty-free and IRREVOCABLE with the Trustworthy-AI / acceptable-use / guardrail clauses confirmed absent. Classified open_weights (not open_weights_recipe) because the card carries a weaker open-data posture than the rest of the family, though a public-subset recipe exists in the NeMo repo. Safety scored 3, not the old aggregate 4, because there is no model-level safety evaluation over the multimodal input surface - only post-training data curation plus the downloadable, multimodal-capable family guard stack. AOI 60.0, grade C, ownership partial. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged and re-confirmed. Flag (not folded): Nemotron 3.5 Lightning 30B-A3B sits in this compact footprint but carries a distinct licence (OpenMDW-1.1) - a new sibling for a future build pass.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/nemotron-3-ultra/entry.yaml b/models/nemotron-3-ultra/entry.yaml index f3346fd..56db3e1 100644 --- a/models/nemotron-3-ultra/entry.yaml +++ b/models/nemotron-3-ultra/entry.yaml @@ -583,7 +583,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry (NVIDIA Nemotron 3 Ultra 550B), split out of the former aggregate nemotron entry so each per-licence release is scored on its own. Ultra is governed by OpenMDW-1.1 (Linux Foundation), whose "deal in the Model Materials without restriction" grant is the most permissive in the family and the reason Ultra is the one member whose ownership reaches substantial. open_weights_recipe (representative recipe; intermediate checkpoints and 1M-context data not open). Safety scored 3, not the old aggregate 4, because the white paper carries no model-level safety methodology - only post-training data curation plus the downloadable family guard stack. Training compute undisclosed, so the EU systemic-risk crossing is undeterminable. AOI 63.6, grade C, ownership substantial. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged and re-confirmed. No newer Ultra-tier release supersedes this entry. Safety strengthened (Nemotron 3.5 Content Safety guard added to family tooling).' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/nemotron-3/entry.yaml b/models/nemotron-3/entry.yaml index d97173d..35777d7 100644 --- a/models/nemotron-3/entry.yaml +++ b/models/nemotron-3/entry.yaml @@ -597,7 +597,9 @@ evidence: changelog: - date: '2026-08-03' change: Initial entry (NVIDIA Nemotron 3 Super + Nano), split out of the former aggregate nemotron entry so each per-licence release is scored on its own. Governed by the NVIDIA Nemotron Open Model License (v. 2025-12-15); the corrected reading records it as Apache-2.0-derived, perpetual, royalty-free and IRREVOCABLE with no acceptable-use / field-of-use restriction and no guardrail clause (the earlier revocable / Trustworthy-AI reading was wrong and belonged to a different, generic NVIDIA licence). open_weights_recipe (tier 4, partial corpus). Safety scored 3, not the old aggregate 4, because there is no published model-level safety evaluation - only post-training data curation plus a downloadable family guard stack. AOI 66.0, grade C, ownership partial. -last_verified: '2026-08-03' +- date: '2026-09-21' + change: 'Freshness re-verification. Licence unchanged and re-confirmed distinct from the generic NVIDIA Open Model License (no Trustworthy-AI/revocable-guardrail clause). Safety strengthened, not weakened: a Nemotron 3.5 Content Safety guard model has been added to the family tooling. Flag (not folded): NVIDIA has shipped Nemotron 3.5 Lightning 30B-A3B (2026-08-11, OpenMDW-1.1) - a licence-divergent new sibling for a future build pass, not a fold into this entry.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/qwen/entry.yaml b/models/qwen/entry.yaml index 74fb620..5c55944 100644 --- a/models/qwen/entry.yaml +++ b/models/qwen/entry.yaml @@ -638,7 +638,9 @@ changelog: (still retrieved:false) to the formal Model Studio Service Agreement specifics only (exact retention, region, opt-out). Updated transparency + data_control rationales and the verdict; score and ownership level unchanged.' -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification. The tracked Qwen3 weights remain Apache-2.0, not reverted or re-licensed. Flag (not folded): Qwen3 has been superseded by Qwen3.5/3.6/3.8 (also read as Apache-2.0) as the current head of the line - a future build-pass decision on new siblings vs updating this entry, not scored here.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90 diff --git a/models/soofi/entry.yaml b/models/soofi/entry.yaml index 0857253..8bc1aff 100644 --- a/models/soofi/entry.yaml +++ b/models/soofi/entry.yaml @@ -603,7 +603,9 @@ changelog: change: Grounded evidence against primary sources (docs/primary-sources/soofi) - added doc_type/retrieved to every item; corrected that the model DOES exist; marked the licence unconfirmed/pending (LICENSE 401, no SPDX, retrieved:false) and the OSAID 1.0 line as a stated future intention; noted weights "coming soon" (preview, not yet downloadable); regrounded ownership factors and verdict. - date: '2026-07-25' change: Corrected openness overclaim exposed by grounding - the read GitHub README says weights are "coming soon" and the licence is unconfirmed, so fully_open/openness-5 was not defensible. Downgraded openness tier fully_open->open_weights and its six components to partial (documentation stays open), openness dimension score 5->3 (headline 80.4->73.2, grade B unchanged), EU AI Act open-source exemption yes->uncertain (no confirmed free-and-open licence yet), and ownership level substantial->partial. Re-score when the OSAID release actually lands. -last_verified: '2026-07-25' +- date: '2026-09-21' + change: 'Freshness re-verification (Cowork browser session). Independently re-confirmed, verbatim, the exact facts this entry''s 2026-07-25 correction was already built on: the Soofi-S-Base HF model card carries a "closed-beta" tag and the repo is gated, in tension with the project''s own "open-source" marketing framing. Cross-checked against this entry''s existing scoring before deciding whether to re-grade: openness is already held at the open_weights ceiling (3, not fully_open/5), the weights component is already "partial" (not "open"), and ownership is already "partial" with use_modify "moderate" - all specifically because the licence is unconfirmed and weights are not yet generally downloadable. The newly-confirmed "gated" detail (an access-request mechanism exists, distinct from no release path at all) does not change that picture, since no confirmed grant of unconditional access exists either way. No further downgrade is warranted: this entry does not take the project''s marketing framing at face value already, which is the exact failure mode the new research was checking for. The preview siblings it also flagged (Soofi-S-Instruct/Isar/Rhine) were already tracked as variants of this same entry, not new entities. Re-verified against the entry''s own already-corrected baseline, not against the marketing claim; last_verified honestly bumped with no score change.' +last_verified: '2026-09-21' freshness_sla: fast_days: 30 score_days: 90