# AI provider

# AI provider

Choose who serves the models Hamming runs on. Phloem picks the model; new
models arrive with a release, never by surprise.

Set it in your Phloem account under **AI**. Only a workspace admin can change
it; members can see it.

## Providers

| Provider | Bills | Plans |
|---|---|---|
| **Phloem managed** | Phloem, counted as [AI credits](https://phloem.ai/docs/workspace/ai-usage/), on a key made for this workspace only | every plan; the only choice on Starter |
| **Google Vertex AI** | your Google Cloud project | Enterprise |
| **Azure AI Foundry** | your Azure subscription | Enterprise |
| **Amazon Bedrock** | your AWS account | Enterprise |
| **Anthropic**, **Google Gemini**, **OpenAI** | that vendor, on your API key | Enterprise |

On a cloud provider, **Model family** picks whose models run there: Gemini,
Claude or OpenAI, as that cloud offers them. A provider you bring does not use
up monthly credits.

## Access

The page groups providers as **Your cloud** (named for the cloud your data
plane runs in), then **Another cloud · federated from your plane** (collapsed
until opened), then **Your API key**. Each cloud provider offers these ways to
let your plane in:

| Access | Means |
|---|---|
| **Your data plane's own identity** | no key — allow your plane's service account to call Vertex AI; nothing to store or rotate. **Recommended**; offered when the data plane is your own |
| **Federated from your plane — no keys** | AWS or Azure trusts your plane's Google identity; the page shows the exact trust policy or federated credential to create |
| **Service account key** · **Access keys** · **API key** | stored encrypted in your workspace, for accounts that don't allow federation |

A saved key is never shown again, only its last characters or a service
account key's email. **Where requests go** confirms that requests go straight
from your data plane; nothing passes through Phloem.

> **Note:** Keyless Vertex AI needs a data plane of your own. On one Phloem runs
> for you, use a service account key: a project that trusted the shared plane
> would trust every workspace on it.