◣
Vendor risk tiering
ComplianceGiven a vendor and the data they touch, assign a risk tier and the due-diligence depth required — so you don’t pentest your snack supplier.
The routing recipe
Job typeClassification / routingPolicyBalanced
routes to
DiffusionGemma 26B-A4B nvidia
nvidia:google/diffusiongemma-26b-a4b-it
90.9
match score
84.3
task fit
100
cost
97.7
speed
Why this model from benchmarks & capabilities
- "Classification / routing" leans hardest on instruction; DiffusionGemma 26B-A4B scores 76/100 there — #40 of 54.
- Strength on this class of work shows up on IFEval, MMLU (zero-shot), where Google models are competitive.
- Cost: runs on NVIDIA free credits / self-hostable NIM — effectively $0 marginal. Speed: ~1100 tok/s (estimated).
- Chosen over Nemotron 3.5 Lightning 30B-A3B for faster.
| Capability the job needs | Weight | DiffusionGemma 26B-A4B | Catalog rank |
|---|---|---|---|
| instruction | 0.90 | #40 of 54 | |
| speed | 0.90 | #1 of 54 | |
| knowledge | 0.30 | #39 of 54 |
Relevant benchmarksIFEval MMLU (zero-shot)
EconomicsCost: runs on NVIDIA free credits / self-hostable NIM — effectively $0 marginal.
Speed: ~1100 tok/s (estimated). vs runner-upChosen over Nemotron 3.5 Lightning 30B-A3B for faster. (Nemotron 3.5 Lightning 30B-A3B, score 87.1)
Speed: ~1100 tok/s (estimated). vs runner-upChosen over Nemotron 3.5 Lightning 30B-A3B for faster. (Nemotron 3.5 Lightning 30B-A3B, score 87.1)
Example result
Sample input ▾
Vendor: a transactional email provider that processes customer email addresses and sends on our behalf; has API access to our app.
Tier: High.
Why: processes customer personal data (emails) and holds standing API access to your app — a compromise reaches your users.
Due diligence: SOC 2 Type II review (or ISO 27001), signed DPA with SCCs, a security questionnaire (auth, encryption, breach SLA, sub-processors), and scoped API keys with least privilege. Reassess annually or on a security incident.
Test it on your own data