Floor-weighted, not averaged. The weakest factor caps the level. Nothing here is weak, but data control only reaches moderate - so the substantial bar, strong on both use-and-modify and data-control, is not met, and the level is partial.

You own your workloads here in the ways that matter most: the Terms leave you owning your inputs and outputs, ZDR-by-default with no-training keeps them yours, and the open-weight catalogue on an OpenAI-compatible API is a clean portable exit. But overall ownership is partial, not substantial: the no-retention posture is Together's own self-attestation rather than independently audited, and the US HQ with DPA-confirmed North America default routing carries standing CLOUD Act exposure even for EU-hosted workloads, so data-control is moderate rather than strong. Pin the EU region on a paid tier if residency matters, and teams needing an audited no-retention guarantee should contract it in the DPA rather than rely on the default terms.

Use and modify freelyCan you use it freely and leave without lock-in?

Strong

OpenAI-compatible /v1 API (documented and read this session) serving portable open-weight models - the same checkpoints run on other providers or self-hosted, so exit cost is low.

How this scores (AOI sub-dimensions)

Transparency & lock-in4/5how portable it is and how easily you can leaveOpenAI-compatible /v1 API (documented and read this session) serving portable open-weight models (Llama, DeepSeek, Qwen, Mistral, gpt-oss), with third-party analysis corroborating the same checkpoints run across many providers - a strong exit path.

Cost4/5how the pricing model compares and how predictable it isCompetitive per-token serverless rates plus dedicated GPU endpoints; Together's own pricing page lists the model, and independent third-party price analysis corroborates the approximate rates, which move frequently.

TransparencyAre the binding terms published, legible and independently checkable?

Moderate

The retention/no-training/ownership terms were actually read this session in the binding Privacy Policy and Terms of Service - a real improvement over a marketing page - but they are Together's own self-attestation, not independently audited, and no sub-processor list is published.

How this scores

Not a scored AOI dimension. For a hosted provider, transparency is whether the binding terms are published, legible and were actually read - the read/unverified evidence below, not a certification. A strong rating here must trace to a retrieved binding document.

Doesn't fail youDoes it stay up and stay secure?

Moderate

SOC 2 Type II is announced via an independent audit and the security docs describe encryption and pen-testing, but there is no public uptime SLA, status page or SOC 2 report obtained this session.

How this scores (AOI sub-dimensions)

Reliability2/5whether it stays up, with an SLA and status historyNo incidents surfaced in research, but no public uptime SLA, status page or failover documentation was found or independently verified this session.

Security4/5the controls protecting your traffic and dataThe SOC 2 announcement and security docs describe encryption in transit and at rest, audit logging, MFA/RBAC and regular pen-testing, and the DPA requires encryption of controller data in transit and storage.

Compliance4/5which independent certifications and attestations it holdsSOC 2 Type II is announced via an independent multi-month audit, and a GDPR DPA (read this session) binds Together to EU Standard Contractual Clauses.

Doesn't extract your dataDo the binding terms keep your data and IP yours?

Moderate

The Terms (read this session) leave you owning Your Content and Output, and ZDR-by-default with training opt-in/off keeps your data yours - but the no-retention guarantee is self-attested, and the US HQ plus DPA-confirmed North America default routing carry standing CLOUD Act exposure even for EU-hosted workloads.

How this scores (AOI sub-dimensions)

Data governance4/5retention, training-on-inputs and data ownershipGrounded in the binding Privacy Policy and Terms of Service, both read this session: inputs and outputs are not stored by default (ZDR), training on your data requires explicit org-admin opt-in and is off by default, and you retain ownership of Your Content and Output.

Residency4/5where your data is processed and storedA support KB (read this session) confirms EU data centres and dedicated endpoints including EU locations, and the DPA confirms EU transfers under SCCs.

How the AOI score is computed

The seven dimensions above, each scored 0 to 5, weighted and summed to the 0 to 100 headline. The score is the analytical input behind the ownership verdict, not the verdict itself.

DimensionScoreWeightPoints

Data governance4/50.2419.2

Compliance4/50.1814.4

Residency4/50.1612.8

Security4/50.1411.2

Reliability2/50.124.8

Transparency & lock-in4/50.108.0

Cost4/50.064.8

HeadlineB · 75.2/100

Dossier coverageAssess 89%Implement 63%Use 43%Support 29%How complete our four-domain documentation is, a measure of our coverage, not of the model. Each domain links to its page.

Sources

Every rating traces to a primary document. Read means the text was verified; unverified means it is known to exist but has not yet been read.

DocumentWhat it grounds

Privacy Policyread2026-07-25

Privacy Policy: inputs and outputs are not stored by default (zero data retention); under ZDR content is not stored, retained, or used for model training or product improvement except as needed to provide the Services; temporary caching may be used for performance; training on data is opt-in and off by default, controlled by an org-admin Privacy & Security setting.

Documentationread2026-07-25

Privacy and security docs: HIPAA-aligned data encryption in transit and at rest, audit logging and business associate agreements; layered security architecture with MFA/RBAC, continuous monitoring and regular vulnerability assessments; ZDR restated.

Vendor announcementread2026-07-25

SOC 2 Type II announcement: achieved via an independent, multi-month audit validating access management, data encryption, incident response and change management; regular penetration testing.

Documentationread2026-07-25

EU data centres and dedicated model deployment - dedicated endpoints on targeted data centres including EU locations (Sweden GPU capacity) - are available only on Scale and Enterprise tier plans.

Vendor announcementunverified2026-07-25

Serverless per-token pricing page (live rates not read from source this session): gpt-oss-120B ~$0.15/$0.60, Qwen3-235B ~$0.20/$0.60, DeepSeek-V3 ~$1.25/M - approximate and move frequently.

Documentationread2026-07-25

OpenAI-compatibility docs: an OpenAI-compatible /v1 REST API at api.together.ai/v1, used by pointing an existing OpenAI client at Together's base URL and API key (TOGETHER_API_KEY), with chat/completions, streaming, tool use and structured outputs across the open-weight catalogue.

Terms of serviceread2026-07-25

Terms of Service: as between you and Company you exclusively own all right, title and interest in Your Content and Output, granting Company only a limited license to operate them to provide the Services; Together does not use your data to train its models without your explicit opt-in and consent; the Company owns Company IP and Usage Data.

Third-party analysisread2026-07-25

Independent third-party price/performance analysis of Together AI corroborates the approximate serverless rates and shows the same open-weight models served across many providers (portability).

Data Processing Addendumread2026-07-25

Data Processing Addendum: Together (US) Inc.