Comparison
Concentrate and Aptible for HIPAA inference
Both companies publish a BAA for models reached through the gateway. This page compares the published price, token markup, and what each one stores.
Monthly cost at $100,000 of usage
Concentrate bills inference at provider rates with no markup, plus the $499 BAA plan. Aptible publishes $200 a month plus a 15% markup on list model price.
| Monthly cost | Concentrate | Aptible |
|---|---|---|
| Inference at provider list rates | $100,000 | $100,000 |
| Token markup | $0 | $15,000 |
| Monthly plan | $499 | $200 |
| Total | $100,499 | $115,200 |
Illustrative. Assumes the same models, token mix, and features, before negotiated discounts and other charges. Aptible also publishes volume and startup discounts. Aptible prices from their LLM Gateway page, read October 27, 2026.
Agreements and data handling
Aptible details are from their security and compliance docs.
- BAA
ConcentrateOne BAA with Concentrate. We hold separate BAAs with each provider that serves a covered route.
AptibleOne BAA covering the models and providers accessed through the gateway.
- Prompt and response storage
ConcentrateRequest-content logging is locked off on a HIPAA organization. Operational metadata is kept.
AptibleFull request and response payloads are logged and kept for 6+ years.
- PHI removal
ConcentrateRedaction is a separate setting you turn on.
AptibleDe-identification is marked as coming soon.
Questions about alternatives
- How much does Aptible charge for its LLM Gateway?
- Aptible publishes $200 a month plus usage at list model price plus a 15% markup, with volume and startup discounts available. Read Aptible’s page. Concentrate’s BAA plan is $499 a month for access to the BAAs. Inference is billed separately at provider rates, with no markup. On $100,000 of provider list rates, the illustrative totals are $100,499 and $115,200 before discounts and other charges.
- Does Aptible store prompts?
- Aptible’s documentation says every request and response is logged, including full payloads, and that Aptible keeps those logs for 6+ years. Read the docs. On a Concentrate HIPAA organization, request-content logging is locked off, so prompt and response bodies are not stored. Operational metadata is still kept. Aptible marks de-identification as coming soon. Concentrate redaction is a separate setting. See data redaction.
- Does OpenRouter offer a HIPAA BAA?
- OpenRouter’s public documentation says it does not offer a HIPAA Business Associate Agreement. Read OpenRouter’s statement.
- Does a Kong or Bifrost gateway include provider BAAs?
- Their documentation describes connecting upstream provider accounts with provider credentials. That shows how to route requests. It does not show an inference purchase under BAAs the gateway company maintains. Bifrost documentation. Kong documentation.