01
Define the workload
- Which models: open-weight (Llama, Qwen, DeepSeek, GPT-OSS and others), proprietary (Claude, Gemini, GPT), or your own fine-tuned weights
- Traffic shape: interactive and latency-sensitive, steady high volume, or offline batch
- Context length, tool calling, structured output, and vision needs
- Expected tokens per month, so you can compare per-token and per-GPU-hour costs
Write one sentence on what “done” looks like, including target latency you will measure yourself, monthly volume, and acceptable error rate.
02
Choose a deployment model
- Serverless per-token API: shared capacity, pay per token, no infrastructure. Check rate limits and model deprecation policy.
- Dedicated or provisioned capacity: single-tenant GPUs billed per minute or hour, or reserved throughput units. Predictable capacity; you pay for idle time.
- Bring your own model: upload weights or a container (for example Truss, Cog, or a vLLM image). Check supported architectures and whether custom models run only on dedicated hardware.
- Aggregator or router: one API across many providers. The provider that serves each request sets its own data policy.
- Cloud provider platform: models inside your AWS, Google Cloud, or Azure account, with that cloud’s IAM, networking, and billing.
03
Check API compatibility
Most providers offer an OpenAI-compatible Chat Completions endpoint, but coverage varies: some say “mostly compatible” or list unsupported parameters. Test your exact calls (streaming, tools, JSON mode, embeddings) against each shortlisted endpoint before you commit, and keep the base URL and model name in configuration so you can switch.
04
Read the data-handling terms
Ask in writing: are prompts and outputs stored, for how long, and why (abuse monitoring, batch jobs, stored responses, caching)? Is zero data retention the default, an account setting, or an approval? Are inputs ever used for training? Several providers keep data for specific features even when inference is zero-retention, and cloud platforms set retention per model and per region.
05
Confirm regions and data residency
Check where requests are processed, not only where data is stored. Global or cross-region routing can move processing between regions. If you need EU or US processing, confirm which models are available in that region and whether region pinning costs extra.
06
Security and compliance evidence
Ask for current reports, not badges: SOC 2 Type II report, ISO/IEC 27001 certificate and scope, HIPAA BAA if you handle PHI, DPA and subprocessor list for GDPR. On cloud platforms, confirm the specific AI service is in audit scope. A certification on a website may cover only part of a company.
07
Commercials
Compare unit of pricing (per token, per cached token, per GPU-minute, per reserved unit), batch discounts, minimums, rate limits by tier, SLA terms, model deprecation notice, and egress. Per-token prices change often; record the date you checked them.
Shortlist checklist
- Model list and context limits confirmed for each provider
- Your own latency and error-rate test on real prompts
- Data retention and training terms confirmed in the contract or DPA
- Processing region confirmed for every model you will use
- Security reports reviewed by your team
- Rate limits, SLA, and deprecation policy agreed
Ready to shortlist? Filter the vendor landscape or compare up to four vendors.