Skip to content
CloudSitus

Alternatives

CloudSitus vs OpenRouter — when residency is the constraint.

Both are OpenAI-compatible gateways. OpenRouter wins on model breadth and per-model price visibility. CloudSitus wins when a regulator asks where the call ran. Here is the honest side-by-side — and how to use them together.

Get an API keyRead the docs

At a glance

Side-by-side, on the dimensions buyers actually compare.

Where a row says “Not published,” we mean it — we will not guess what a competitor ships in private. The CloudSitus column reflects what is live in the registry today, with in-progress items labeled as such.

  • Drop-in OpenAI API shape

    OpenRouter
    Yes:Yes — OpenAI-compatible base URL.
    CloudSitus
    Yes:Yes — swap base_url to https://cloudsitus.com/api/v1 and your SDK works.

  • PHI tier with enforced quarantine

    OpenRouter
    No:Not a published feature. Healthcare is not a marketed vertical.
    CloudSitus
    Yes:X-PHI: true pins traffic to PHI-eligible providers; refused if none.

  • Per-request data residency

    OpenRouter
    No:No per-call region pin. Routing follows model availability.
    CloudSitus
    Yes:X-Region pins each request to a jurisdiction at the edge.

  • Where the proxy sits

    OpenRouter
    Partly:US-fronted aggregator; traffic crosses provider boundaries.
    CloudSitus
    Yes:PHI pins to region-resident providers (CH: Infomaniak/Azure; EU: Scaleway/Azure; US: Azure); no silent failover.

  • Audit headers on every response

    OpenRouter
    No:Not advertised — build your own logging.
    CloudSitus
    Yes:x-phi-tier, x-phi-routed, x-phi-attempts on every call.

  • Prompt + response logging

    OpenRouter
    Partly:Per-provider settings; defaults vary. Opt-out is per provider.
    CloudSitus
    Yes:Stateless proxy. No payload storage. No tenant database.

  • Sub-processor transparency

    OpenRouter
    Partly:Provider list is public, but DPA chain is provider-by-provider.
    CloudSitus
    Yes:Named PHI sub-processors per region (Infomaniak, Scaleway, Azure) under reviewed DPAs / BAA.

  • HIPAA BAA program

    OpenRouter
    No:No published BAA program. Not marketed to healthcare.
    CloudSitus
    Partly:HIPAA BAA coverage via Azure routes — in the US, OCR, speech-to-text and text-to-speech only; US chat, vision and embeddings PHI are not available. Infomaniak & Scaleway PHI routes are nFADP/GDPR (DPA), not HIPAA.

  • Pricing model

    OpenRouter
    Yes:Per-model token pricing.
    CloudSitus
    Yes:Per-model token pricing from prepaid credits. No subscription, no seats.

Note on the “HIPAA BAA” row: CloudSitus's HIPAA coverage is partial — it rides the Azure-hosted PHI routes (OCR and speech in CH/EU/US) under a BAA, while the Infomaniak and Scaleway routes are nFADP/GDPR (DPA), not HIPAA. We label it that way on the compliance page and on this comparison — even though the procurement question wants a clean yes/no.

When to pick each

Honest scenarios — no winner-takes-all.

These gateways are not the same product. OpenRouter is a model breadth play. CloudSitus is a residency and PHI play. Most teams who land on this page end up using both.

  • Pick OpenRouter when…

    • You want the widest possible model menu — niche, open-source, and pre-release weights in one bill.
    • Your workload is not regulated and per-request residency is not a compliance requirement.
    • You optimize on per-model price visibility and want to swap models opportunistically.

  • Pick CloudSitus when…

    • You handle PHI or other regulated data and need a hard PHI vs general gate enforced per request.
    • Auditors ask where each call ran — and "the response header" is an acceptable answer.
    • You need region pinning at the call level, not at the account level.

  • Hybrid pattern

    • Route PHI requests to CloudSitus (X-PHI: true) — they pin to a region-resident PHI-eligible provider.
    • Route the rest of your traffic to OpenRouter for model breadth and cheap experimentation.
    • Both speak OpenAI’s API shape, so a thin client picker is all you need.
    See the routing contract

FAQ

Questions buyers ask before they switch.

Is CloudSitus HIPAA-compliant today?
Partly, and only via specific routes. HIPAA BAA coverage exists for CloudSitus PHI traffic that runs on Azure (Swiss North, EU, or US Azure regions) for the modalities hosted there — OCR, speech-to-text and text-to-speech; in the US those are the only PHI modalities, and US chat, vision and embeddings PHI are not available. The Infomaniak (CH) and Scaleway (EU) PHI routes are not HIPAA — they handle health data under Swiss nFADP and GDPR via reviewed DPAs, and those providers make no HIPAA representation. So CloudSitus is not a blanket "HIPAA-compliant gateway"; it is a Swiss/EU nFADP+GDPR-resident gateway with HIPAA-BAA coverage available on the Azure routes. In all cases the router refuses (403 phi_blocked) rather than spill PHI to a non-eligible provider.
Can I use OpenRouter and CloudSitus together?
Yes. Both expose the OpenAI-compatible /v1/chat/completions and /v1/embeddings shapes, so a thin client-side picker can route regulated traffic to CloudSitus and general traffic to OpenRouter. The CloudSitus SDK swap is one line: change base_url to https://cloudsitus.com/api/v1.
Does OpenRouter offer a BAA?
OpenRouter does not publish a BAA program at the time of writing and does not market to healthcare. If you handle PHI, contact them directly before assuming coverage — and verify any provider in their chain has its own BAA with you.
How is per-request residency different from account-region selection?
Account-region (the typical cloud model) sets the region once per account or per project. Per-request pinning sets it on every call via an X-Region header, so the same key can serve CH traffic resident in Switzerland and EU traffic resident in the EU — and a wrongly tagged request fails closed, it does not silently cross a border.
Does CloudSitus retain my prompts or responses?
No. CloudSitus is a stateless proxy: no database holds tenant data, there is no payload logging and no prompt retention. Only usage amounts, aggregated per model and region, are sent to Stripe for metering, and the auth tokens themselves are self-contained HMAC-signed values, not stored sessions.

Next step

Read the posture before you read the contract.

The compliance page lists what is earned, what is in progress, and where the sub-processor sits. The signup page gives you a key you can paste into the OpenAI SDK in under a minute.

See the live postureGet an API key

Prepaid credits from $10 · No subscription · No data retained