Corporate procurement of a relay service: invoices, contracts, compliance and risk control

How corporate procurement differs from personal use

For personal use: it takes payment, it works, it is cheap, it is stable. That is enough.

Corporate procurement has three additional gates:

1. Invoicing: can they issue a VAT invoice, and under which category
2. Contracting entity: who signs, and is there a real business behind it
3. Compliance: where does the data go, and will it pass an internal security review

Fail any one of these and you should not use the service even at a rate of 0.1 — the downstream compliance cost and the difficulty of pursuing liability dwarf whatever you saved.

Gate one: invoicing

What you must confirm:

• Can they issue a VAT special invoice (专票), or only a general one
• What category is it issued under (technical service fee, information service fee, software service fee)
• Does the invoicing entity name match the contracting entity
• Can they invoice on demand, or only on a fixed cycle

Why it matters: many relay services are run by individuals or very small entities and cannot issue a special invoice at all. Without one, your finance team cannot book the expense.

What to do: before you top up, ask for a sample of an invoice they have already issued and for the invoicing entity's details. Do not discover that they cannot invoice after tens of thousands are already on the account.

Gate two: the contracting entity

What you must confirm:

• Is the contracting party a company that can be looked up, and is its registration in good standing
• Does the contract state the service scope, SLA, refund terms and data ownership
• Will they accept your own contract template (larger companies usually insist on theirs)

Risk signals:

• They accept only personal transfers and cannot take a corporate payment
• They refuse to sign a contract, or offer nothing but the site's terms of service
• The contracting entity, the payee and the invoicing entity are three different parties

Those three being inconsistent is a classic risk signal: if something goes wrong, there is nobody to pursue.

Gate three: data compliance

This is the gate most often skipped and the most important one for data-sensitive businesses.

What to ask:

• Is data retained? Does the relay pass requests through, or store them? For how long?
• Which upstreams does data flow to? Which providers do they forward to, and are any of them overseas?
• Is data used for training? Some low-cost channels, reverse-engineered endpoints especially, carry this risk
• Is transit encrypted? HTTPS at minimum, and is the internal hop encrypted

The three questions internal audit will ask:

1. Can a third party see the content of our prompts?
2. Does this data leave the jurisdiction?
3. If there is a breach, who is liable?

If the provider cannot answer those three in writing, security almost certainly will not sign off.

A procurement process that works

1. Requirements   — which models, estimated monthly volume, whether you need an SLA
2. Screening      — company registration, invoice sample, contract template, data terms
3. Small trial    — use a personal account or the smallest plan to get the technical path working
4. Security review— submit the data-flow description to security/compliance
5. Formal purchase— sign a contract, pay corporately, settle monthly rather than prepaying large sums
6. Ongoing monitoring — reconcile usage, uptime and billing every month

Specific risk controls

• Buy monthly; do not prepay large sums. Not even for an annual discount. The relay sector is volatile and prepaying means carrying the operator's business risk.
• Prepare a backup route. Configure at least two services and switch with an environment variable. If the primary fails you can move immediately.
• Build technical fallbacks. Implement retries, degradation (switch to a backup model when the primary is unavailable) and usage alerts in your code.
• Keep reconciliation records. Regularly compare the provider's bill against your own usage statistics and raise discrepancies promptly.

When to connect directly instead

If the following hold, skip the relay service:

• You can solve overseas payment and network access
• Your monthly volume is large enough that a direct vendor relationship earns a volume discount
• You have strict latency, SLA or data-compliance requirements
• You only need one or two vendors' models

The value of a relay service is low barrier, multi-model aggregation, CNY settlement. When those stop mattering to you, all that is left in the middle layer is risk.

What this site can do

What we provide is the factual basis for shortlisting: measured uptime and latency for each service, model coverage, endpoint verification status, and the rates and minimum top-ups the services publish themselves (labelled as such).

We do not endorse vendors and we are not part of any transaction. The final call in corporate procurement has to combine our data with your own compliance requirements.