nRouter.ai

nRouter puts one API key in front of 164 models across six provider clouds — OpenAI, Anthropic, Google Vertex AI, AWS Bedrock, Azure AI Foundry, and Alibaba Cloud's DashScope (Qwen/DeepSeek) — confirmed against its own live public model catalog endpoint on 2026-09-17 (count: 164). Requests can use either the OpenAI Chat Completions wire format or Anthropic's native Messages format on the same key, which matters if you're mixing Claude and GPT calls in one codebase without maintaining two client libraries. Official SDKs exist for Python (PyPI, MIT), TypeScript/Node (npm, MIT), Swift, Go, Java, and Kotlin; the TypeScript package sees about 226 weekly downloads, a small but real usage signal for a four-month-old product.

Confirmed on the vendor's pricing page and its embedded Product/Offer JSON-LD on 2026-09-17: Pay-as-you-go starts at a $5 minimum credit purchase with a flat 4% platform fee added on top of every credit purchase and top-up (no minimum fee beyond the $5 floor). Three monthly plans layer a fixed allowance on top of the same 4% fee structure: Starter at $20/month includes $60 in monthly credits, Pro at $50/month includes $100, and Max at $200/month includes $400. Enterprise is custom-quoted. The fine print matters here: that monthly allowance is restricted to nRouter's own auto-routing model ("nrouter/auto"), metered in rolling 8-hour windows that do not roll over, and cannot be used for named-model requests — those still draw from your separate pay-as-you-go credit balance. Rate limits, log retention, and concurrency scale with plan tier; every plan gets the same feature set (guardrails, prompt versioning, analytics, budgets) rather than gating features behind price.

nRouter publishes an unusually specific security architecture for its size: Postgres Row-Level Security on every table it operates (vendor states zero permissive USING (true) policies), SHA-256-hashed virtual API keys shown once and never stored in plaintext, AES-256 encryption at rest, TLS 1.2+ in transit, and an atomic "reserve credits, forward request, settle against actual provider cost" ledger design intended to prevent negative balances and partial debits on failed calls. These are vendor claims about its own infrastructure, not independently audited findings, but they are concrete and falsifiable rather than marketing language — a meaningfully more detailed disclosure than most gateways this size publish.

nRouter's own trust center is explicit that SOC 2 Type II is not yet certified: it describes SOC 2-aligned controls as active today with a formal audit "in progress" and the signed report targeted for Q3 2026, as of the page's August 2026 status note. ISO/IEC 27001 is similarly described as "aligned" with certification only "on the roadmap." GDPR compliance (DPA, SCCs, data-subject rights tooling) and HIPAA support (BAA available on request) are both offered, and payment data is delegated entirely to Stripe (PCI DSS Level 1), which minimizes nRouter's own PCI scope. A buyer whose procurement process requires a signed SOC 2 report today cannot get one from nRouter yet; a buyer who needs GDPR/HIPAA paperwork or PCI-scope minimization can.

nRouter commits to 99.9% uptime on every plan tier including pay-as-you-go, but its own status page is unusually candid about the limits of that number: "we publish no continuous uptime history" and 99.9% is "the target we commit to in the legal SLA, not a measured result." The SLA document confirms Service Credit claims are assessed retroactively from the vendor's internal request records for the disputed billing cycle, not against a public feed. Major incidents get a changelog postmortem within 7 days; as of the September 7, 2026 status-page snapshot, it reports zero customer-impacting incidents that quarter. This kind of plain-language admission that a metric is a target rather than a measured, continuously-published record is not something most vendors volunteer, and is worth noting as a point in the company's favor even though the underlying limitation (no third-party-verifiable uptime history) is real.

nRouter is a product of CloudAct Inc., a California C-Corp headquartered in Sunnyvale, per its own about and legal pages. The company states it was founded in 2025 and publicly launched on May 5, 2026, per its own changelog (v1.0 — Public Launch). It describes itself as a small, founder-led team where the CEO, Rama Surasani, still reads customer email and signs security questionnaires directly. We found no independent reviews (G2 and Capterra both returned bot-challenge pages rather than review data on 2026-09-17) and no third-party press coverage to corroborate the company's own account of its history or scale. Its GitHub organization holds only client SDK repositories (0 stars on the primary SDK repo as of 2026-09-17) — the gateway itself is closed-source and delivered as a hosted service, so the SDKs' MIT license says nothing about the product's own licensing.