StepFun Step 3.7 Flash

Data governanceweak

What happens to your data: training-on-customer-data defaults, retention windows, residency options, and the enterprise-versus-consumer terms gap. A legal property, not a capability — it survives every model generation.

The global platform's privacy policy states US-located servers (a genuine plus) and 3-year IP retention — but is entirely silent on whether API inputs and outputs are used for training, with no opt-out documented and the terms-of-use page returning 404. Silence on training is a fail for a buyer. Self-hosting the Apache 2.0 weights is deployer-controlled.

Operational stabilityweak

Whether it changes without warning: versioning discipline, changelog quality, deprecation policy, and observed silent changes. The signal no one else tracks.

Undated alias on the first-party API with no snapshot scheme (OpenRouter's date suffix is OpenRouter's, not StepFun's), no changelog, and no deprecation policy.

Adversarial resistanceunder review

Whether an attacker can make it misbehave — direct jailbreaks against the model's own policies and indirect prompt injection in agentic tool use. Graded to the weaker of the two, because an attacker takes the easier path.

Transparencyweak

Whether you can see how it was built and tested: model cards, published safety evals, external pre-deployment testing, and disclosure of changes. The mechanism behind the tier ladder.

Open weights, but the thinnest documentation of any tracked model: a capability-only model card, a blog post standing in for a technical report, no safety content of any kind, and no external testing.

Compliance postureweak

Whether it is certified and compliant: SOC 2, ISO/IEC 42001, HIPAA eligibility, EU AI Act readiness, and audit availability.

No certifications mentioned anywhere in platform documentation.