Repository navigation
OpenCode Go: clarify which models are self-hosted vs. proxied through third-party providers #24649
Description
Question
Hey,
First off, love what you're building with OpenCode Go — the curation angle and pricing make a lot of sense for reliable model access.
I have some questions about the Go plan documentation that I think need clarification:
The infrastructure claim:
Your docs state that Go models are "hosted in the US, EU, and Singapore for stable global access." However, when I tested the API with Qwen3.5 Plus (which is on your Go model list), I received this error:
Error from provider (Alibaba): You exceeded your current quota, please check your plan and billing details
This error coming directly from "provider (Alibaba)" suggests that Go is actually proxying requests to Alibaba's DashScope infrastructure, not hosting them on OpenCode-controlled servers.
Looking at your codebase (specifically the AI SDK packages referenced in the endpoint table), models like Qwen use @ai-sdk/alibaba, Kimi uses Moonshot's infrastructure, etc., which further suggests third-party proxying rather than self-hosting.
What I need clarified:
- Which Go models are actually on OpenCode-owned/controlled infrastructure?
- Which are proxied through third-party providers (Alibaba, Moonshot, etc.)?
- For proxied models, what exactly does "zero-retention" cover? Is it just between the user and OpenCode, or does it include guarantees about the upstream provider's data handling?
- For Chinese-based models, does hosting data on US/EU/Singapore infrastructure change the compliance obligations under Chinese data residency laws?
Why this matters:
For users in GDPR jurisdictions or with data privacy requirements, the difference between "OpenCode hosts it" and "OpenCode proxies to Alibaba/Moonshot" is significant. The zero-retention promise is reassuring, but if data flows through third-party APIs before OpenCode receives it, that's a different privacy profile than what the docs currently imply.
Happy to discuss this further. Making this explicit in the docs would build a lot of trust with privacy-conscious users.
Activity
github-actions commentedon Apr 27, 2026
This issue might be a duplicate of existing issues. Please check:
These issues share the same underlying symptom (Alibaba/Aliyun errors visible to Go subscribers) and may already contain relevant context or acknowledgment from maintainers.
ahh1539 commentedon May 6, 2026
Wow, yeah this is a breach of trust for me. When reading through the docs there is no indication that my data is going back to moonshot ai or another chinese company. All official info states that there is no data collection being done. Moonshot API mentions that it does collect data.
wickedits commentedon May 19, 2026
Still no response from the team, wow.
russoalberto commentedon May 20, 2026
I’m seeing a similar error on my end:
Error: 429 Error from provider (DeepSeek): Too many requests. Please pace your requests reasonably. Your current concurrency: 500Seeing this, I was wondering how the data flow works in relation to the "zero-retention policy" mentioned in the docs. Since these providers' (DeepSeek, and previously Alibaba) standard terms usually involve data retention and training, it’s not clear how that’s being prevented here.
Could you clarify if there's a specific setup or agreement that ensures our data isn't being stored or used for training by these endpoints? I just want to better understand how the privacy policy is enforced when hitting these providers.
u03c1 commentedon May 21, 2026
Any news ? @R44VC0RP was assigned but may be not involved ?
In any case, it is surprising (and far from reassuring) to have no answers to these questions, which are critical for both the service's credibility and the legality of its use in certain user or corporate contexts.
thdxr commentedon May 21, 2026
from the homepage FAQ
the models are hosted in data centers in US, EU and SG
every single provider we work with we have have custom data retention and hosting agreements
this is not the same as an individual going and directly signing up for these providers. please do not refer to those terms, they are not what OpenCode is subject to
powerpaul17 commentedon May 22, 2026
And how trustworthy are those providers? What happens if the chinese government decides it wants access to all these data? I don't think they would care about the agreement with you. Is this verified somehow?
thdxr commentedon May 22, 2026
i am not trying to convince you one way or another to trust anyone all we can do is document what we have in place
you can decide yourself if it works for you
closing issue for now - please refer to website/docs for our policies everything is kept up to date there
puetsua commentedon Jul 18, 2026
It's easy to find out when you test these APIs with prompts with sensitive political topics. They're mandatory guardrails according to PRC's law.😉
chightow commentedon Jul 19, 2026
It's a real tradeoff,
Like for opensource work it's fine it's all getting posted on the public internet anyways, but can't wholeheartedly recommend for any other use case. Beyond that and model evaluation.
At $10 it's the best value subscription on the market just comes with a big asterisk for any kind of commercial use case which is a trade off that each individual has to make when using any model provider,
like Claude code defaults in to sending all of your telemetry to datadog, if you want true guarantees of any kind of privacy you have to run the weights yourself and control the infrastructure.
Trust the routers to do what they say, but trust the inference providers closer to 0% and you'll have a healthy view of the current market for inference, and be able to make measured decisions about what's appropriate for your use case.
Local gets better and better every week but I'll never have a million dollars to throw at a gpu cluster to run the frontier open weight models so rely on model routers like opencode go to play with them and see if they're worth looking into hosting.
It's a really nice playground not a subscription you should try and build your business or personal life on top of.
ihcbbs commentedon Jul 25, 2026
Besides DeepSeek, all other model providers have publicly disclosed overseas data centers. DeepSeek might also have them, just not publicly disclosed. These data centers do not need to comply with Chinese law. Furthermore, what you mentioned could be entirely due to the model's own data and doesn't prove anything.
Besides DeepSeek, all other model providers have publicly disclosed overseas data centers. DeepSeek might also have them, just not publicly disclosed. These data centers do not need to comply with Chinese law. Furthermore, what you mentioned could be entirely due to the model's own data and doesn't prove anything.
puetsua commentedon Jul 25, 2026
Yes, these data centers doesn't have to comply, but these AI companies do. They have put guardrails to prevent sensitive political topics on their hosted services. They would get f up by their citizens and its government if they get found out "unpatriotic". Having open-weight models would be a good excuse for not having these guardrails.
Afaik DeepSeek was clever enough to clean up their training data and limited it scope to programming when I'm testing it on US-hosted servers.
But anyway, it's either you choose to trust US or China at this point. Having ability to host local model would still be the best. I'm simply not choosing chinese endpoints because of my job, otherwise I'd love to try those well-crafted models in first hand.
ihcbbs commentedon Jul 25, 2026
You're off topic, and I'm off topic too. Ultimately, it's because you went off topic from the beginning: you're talking about safety guardrails, which is a completely different issue and doesn't require data retention. If you use the US's zero retention API, you'd have the same thing. Hugging Face just encountered this.
You're off topic, and I'm off topic too. Ultimately, it's because you went off topic from the beginning: you're talking about safety guardrails, which is a completely different issue and doesn't require data retention. If you use the US's zero retention API, you'd have the same thing. Hugging Face just encountered this.
white-joh commentedon Aug 1, 2026
Setting safety guardrails and guaranteeing zero data retention are not contradictory; however, what’s desired is complete zero data retention, including error or dangerous requests—none of it should be recorded.
YUXUANCHENG commentedon Aug 9, 2026
So we are left with no real answer? Shame. Unsubscribed.
wgomg commentedon Aug 9, 2026
I see no such list in the FAQ, so how is it actually?
ihcbbs commentedon Aug 10, 2026
The so-called true answers you seek are merely promises—nothing more than what you choose to believe.
YUXUANCHENG commentedon Aug 10, 2026
I am not sure what you mean, I would like to audit or hire trusted third party to audit opencode ZDR implementation.
CommanderROR9 commentedon Oct 2, 2026
Honestly, I am not bothered about ZDR. I am however bothered about Model quality. There are always some open questions about Models being subjected to quantisation and performing worse on OpenCode Go.
Deepseek is sometimes being suspected of acting dumber via OpenCode. Personally I have no way of confirming this.
Muse Spark 1.3 Conteibutor has been less than great via OpenCode, but it's hard to say whether that's the Model or OpenCode providers.
I don't use the OpenCode Harness btw.