Qwen, GLM, Kimi & DeepSeek APIs Hosted on US Infrastructure
Use Qwen, GLM, Kimi, and DeepSeek through US-hosted attested infrastructure. With Confidential privacy, prompts never reach the model vendor, and you can verify the gateway live.
Run GLM, Qwen, Kimi, and DeepSeek on US-hosted, attested infrastructure. With Confidential privacy, no prompt reaches the model vendor.
Your benchmarks already picked these models. GLM-5.2, Qwen 3.5, Kimi K2.7, and DeepSeek V4 Pro all run as routes here, alongside MiniMax M3. Then legal asks where the API traffic goes. A vendor-hosted endpoint sends every prompt to the model vendor's servers, and self-hosting the weights means running your own GPUs.
There is a middle path. TrustedRouter serves the same open weights inside a hardware-attested confidential-compute gateway, with Zero-Data-Retention and TEE tiers per route. With Confidential privacy (provider.min_privacy "confidential"), prompts never reach the model vendor: a Confidential request routes only to third-party confidential-compute hosts, and fails rather than fall back to the vendor's own API. TrustedRouter never logs prompt or output content. Ordinary synchronous and streaming inference does not retain it. The opt-in Batch API temporarily retains enclave-encrypted artifacts for up to 30 days. The API is OpenAI-compatible, and EU-focused routing is available.
from openai import OpenAI
client = OpenAI(
base_url="https://api-azure.trustedrouter.com/v1",
api_key="sk-tr-...", # your TrustedRouter key
)
reply = client.chat.completions.create(
model="glm-5.2", # also: qwen-3.5, kimi-k2.7,
# deepseek-v4-pro
messages=[{"role": "user",
"content": "Refactor this handler."}],
)Confidential skips the vendor
Confidential requests run only on third-party confidential-compute hosts, never on a vendor's own API. Standard routing can include one. On the TEE tier, end-to-end confidential compute means even the hosting provider cannot read your prompt. Kimi users can start at the dedicated Kimi K2 API page.
Check it live, per session
The gateway source is open, the image digest is published, and the attestation endpoint returns a JWT signed by the CPU vendor's root key, bound to your live TLS session. Attestation beats a privacy policy. Details and the curl command are on the security page.
Hosting fixes residency
Routing changes where your data goes. The labs that trained these weights stay the same, so judge the models on quality like any other route. The gateway that handles your prompts is attested, and with Confidential privacy so is the host that runs the model, without renting GPUs to self-host. The full directory of Chinese labs and the operator jurisdiction of every route is on Chinese AI models.
Same weights, different host, different answers.
We ran 60 sensitive questions against the same GLM weights through two doors. The vendor-hosted API answered 30 of 60. TrustedRouter's attested enclave answered 60 of 60. That filtering is host-applied: it lives in the serving stack rather than in the weights you benchmarked.
Where a model is hosted decides what leaves your building and what comes back. Privacy you can check beats privacy you're promised. A document-processing company scaled from zero to over a billion tokens per week through the attested gateway within three weeks of onboarding. Pick a route in the model chooser, or open the playground and test your own prompts against a US-hosted GLM, Qwen, Kimi, or DeepSeek route right now.
Current routes, prices, privacy, and measured performance.
Catalog facts come from the routes currently configured in TrustedRouter. Performance uses the same cached metadata snapshot as the public leaderboard. Prompts and outputs are not part of these measurements.
| Model | Providers | Context | Input | Output | Privacy | Measured route |
|---|---|---|---|---|---|---|
Z.ai: GLM 5.3z-ai/glm-5.3 |
+30
|
1,048,576 | $0.1477/1M to $3.9879/1M | $3.20087/1M to $12.81825/1M | Confidential + ZDR | No measurements yet |
Z.ai: GLM 5.2z-ai/glm-5.2 |
+28
|
1,048,576 | $0.3587/1M to $2.370374/1M | $1.5825/1M to $6.838973/1M | Confidential + ZDR 4 cited scores | No measurements yet |
Z.ai: GLM 5.3 Flashz-ai/glm-5.3-flash |
+29
|
1,048,576 | $0.07385/1M to $0.24869/1M | $0.2532/1M to $0.808243/1M | Confidential + ZDR | No measurements yet |
MoonshotAI: Kimi K3moonshotai/kimi-k3 |
+24
|
1,048,576 | $0.68575/1M to $4.22/1M | $10.0225/1M to $21.1/1M | Confidential + ZDR | No measurements yet |
DeepSeek: DeepSeek V4.1 Flashdeepseek/deepseek-v4.1-flash |
+21
|
1,048,576 | $0.01055/1M to $0.68575/1M | $0.0844/1M to $1.5825/1M | Confidential + ZDR | No measurements yet |
DeepSeek: DeepSeek V4 Flash 0731deepseek/deepseek-v4-flash-0731 |
+23
|
1,048,576 | $0.0422/1M to $0.49738/1M | $0.09495/1M to $1.3926/1M | Confidential + ZDR | No measurements yet |
Browse every modelReview provider policiesOpen the full leaderboardSnapshot 2026-10-22T19:44:43Z
Questions
Do my prompts go to China when I use Qwen, GLM, or Kimi through TrustedRouter?
They can on Standard routing, where the vendors' own APIs are among the routes. With Confidential privacy (provider.min_privacy "confidential"), prompts never reach the model vendor: a Confidential request routes only to third-party confidential-compute hosts, and fails rather than fall back to the vendor's own API. Zero-Data-Retention and TEE tiers are available per route; on the TEE tier, end-to-end confidential compute means even the hosting provider cannot read your prompt. You can verify the gateway live through the attestation endpoint described on the security page.
Is the GLM served through TrustedRouter the same model as the vendor-hosted API?
Same open weights, different serving stack. We measured one difference: the same GLM weights answered 60 of 60 sensitive test questions through TrustedRouter's enclave versus 30 of 60 through the vendor-hosted API. That filtering is host-applied rather than baked into the weights. Try your own prompts against the route in the playground and compare the answers for yourself.
Do I need to change my code to switch from a vendor-hosted endpoint?
The API is OpenAI-compatible. Change the base URL, keep your SDK, model ids, and code, and pick a route from the model catalog. Automatic provider fallback rolls requests over when a provider is down. You can pay with prepaid credits, bring your own provider key, or use x402 pay-per-request with MetaMask wallet sign-in.
Can my compliance team use this for regulated data?
TrustedRouter publishes SOC 2 readiness and HIPAA readiness documentation, plus a DPA, a BAA, and a subprocessor list. These are readiness materials, not audit reports or certifications: verifiable architecture plus documentation your compliance team can assess. The open-source gateway, published image digest, and live attestation give reviewers something to check directly rather than a questionnaire answer to file.