OpenRouter

OpenRouter's core claim holds up: it bills inference at each provider's list price and takes its fee only when you buy credits (5.5% on Standard, 8% on Business), never per request — confirmed on its own pricing FAQ. The model catalog (openrouter.ai/api/v1/models, no auth required) exposes prompt/completion pricing, context length, supported parameters, and per-request limits for every model in one machine-readable place, which is a real time-saver versus checking each provider's own docs. Automatic fallback routing plus "Zero Completion Insurance" means a request that errors or returns nothing isn't billed for the failed attempt, which matters if you're relying on multi-provider fallback in production.

As of 30 September 2026, OpenRouter states 500+ models, 80+ providers, 500T+ monthly tokens, and 10M+ global users on its pricing and about pages — these are vendor-reported figures, not independently audited. The company's SafeBase-hosted trust center and enterprise page list NVIDIA, Replit, Framer, Zoom, Lovable, AMD, Amplitude, Webflow, Archer, Mintlify, WTW, and NIST as customers/logos. By actual token volume, OpenRouter's own app rankings show usage concentrated in coding agents: Hermes Agent (Nous Research), Claude Code, Kilo Code, and Cline lead the public leaderboard. The company has raised $113M (reported by the New York Times, May 2026, with Alphabet's CapitalG investing) after an earlier $40M round (Wall Street Journal); other named investors are Andreessen Horowitz, Menlo Ventures, and Sequoia Capital.

OpenRouter holds a SOC 2 Type 2 report, listed on its public trust center along with a penetration test report, subprocessor list, and a Data Processing Agreement. Its privacy policy states plainly: "OpenRouter does not use your Inputs or Outputs for model training," and its data page says "We don't sell prompt data" and shares only aggregated usage trends. Zero Data Retention routing is available on every plan, not just Enterprise. GDPR compliance rests on the privacy policy's standard mechanisms (EU adequacy decisions and Standard Contractual Clauses for data transferred outside the EEA/UK) rather than a separate GDPR certification, which doesn't exist as a certifiable standard. One thing this platform can't promise on your behalf: once a request is routed to a third-party model provider, that provider's own retention and training policy applies — OpenRouter surfaces each provider's policy on its provider-logging docs page but you have to check it per provider if you need guarantees beyond OpenRouter's own layer.

The Free plan gives access to 25+ free models across 4 providers, but caps usage at 50 requests/day (20/minute), rising to 1,000/day only after the account has purchased at least $10 of credits — and it has no auto-routing, no budgets/spend controls, no prompt caching, and no data-policy-based routing. Standard and Business (self-serve, no sales call) add those features plus BYOK: bring your own provider API key and OpenRouter charges nothing on the first $25,000/month of list-price inference, then 5% above that. SSO/SAML, contractual SLAs, and Managed Policy Enforcement are gated to Enterprise (sales contact) and are not available even on the paid, self-serve Business tier — worth checking before assuming a paid plan covers procurement requirements.