Private LLM API — Verifiable, Attested, Open Source
A private LLM API where privacy is cryptographically verifiable. Route to Claude, GPT, Gemini, DeepSeek through an attested gateway.
A private LLM API where "private" means cryptographically verified.
Every hosted LLM provider claims privacy. Almost none of them give you a way to verify it.
TrustedRouter routes to every major model — Claude, GPT, Gemini, DeepSeek, Kimi, Llama, Mistral — through a hardware-attested gateway. The code is open source. The image is hashed. You can check what runs.
Try the playground Trust surface
New email signups receive starter credit. No card required.
client = OpenAI(
base_url="https://api-azure.trustedrouter.com/v1",
api_key="sk-tr-v1-..."
)
resp = client.chat.completions.create(
model="anthropic/claude-sonnet-4.6",
messages=[
{"role": "user", "content": "your prompt"}
],
)
# No logs. Source verified. Attestation on demand.Read the source.
Every line that handles your prompt is on GitHub. Search it. Audit it. Run it locally if you want.
Hardware-rooted trust.
The gateway runs inside GCP Confidential Space. The hardware-backed attestation signs the running image. You verify the signature.
No request without attestation.
If the gateway can't prove its own integrity, traffic stops. The synthetic monitor probes this every minute and pages on the first miss.
Things that are zero, with proof.
Prompt body. Never written to disk. Never shipped to a logging service. The binary doesn't open a write handle to a prompt path. You can grep for this.
Output body. Same for synchronous and streaming requests. The response goes from the upstream provider straight back to you and is not persisted. Batch is a separate opt-in encrypted-retention mode.
Per-request audit trail. What TR does log: token counts, timestamps, model id, region, billing. No content. The schema is in the open-source code.
Upstream provider behavior. Out of TR's control. We publish each provider's known retention and ZDR posture on every model page so you can route deliberately.
Build a private routing policy
All resources- Provider privacy directoryZDR, confidential compute, E2EE, and policy sources
- DeepSeek API privacyHosting boundaries and fail-closed ZDR filters
- Claude API privacyRoute-specific retention and provider controls
- Confidential computing for LLMsHardware attestation and trust boundaries
- Legal and procurement packetDPA, BAA, subprocessors, and readiness evidence
Current routes, prices, privacy, and measured performance.
Catalog facts come from the routes currently configured in TrustedRouter. Performance uses the same cached metadata snapshot as the public leaderboard. Prompts and outputs are not part of these measurements.
| Model | Providers | Context | Input | Output | Privacy | Measured route |
|---|---|---|---|---|---|---|
Anthropic: Claude Opus 4.8anthropic/claude-opus-4.8 |
|
1,000,000 | $5.275/1M | $26.375/1M | varies 5 cited scores | No measurements yet |
OpenAI: GPT-5.5openai/gpt-5.5 |
|
1,050,000 | $5.275/1M | $31.65/1M | ZDR 3 cited scores | No measurements yet |
Google: Gemini 3.5 Flashgoogle/gemini-3.5-flash |
|
1,048,576 | $1.5825/1M | $9.495/1M | ZDR | No measurements yet |
MoonshotAI: Kimi K2.7 Codemoonshotai/kimi-k2.7-code |
+11
|
262,144 | $0.692291/1M to $1.31875/1M | $3.4815/1M to $4.82135/1M | ZDR 5 cited scores | No measurements yet |
Z.ai: GLM 5.2z-ai/glm-5.2 |
+28
|
1,048,576 | $0.3587/1M to $2.370374/1M | $1.5825/1M to $6.838973/1M | Confidential + ZDR 4 cited scores | No measurements yet |
MiniMax: MiniMax M3minimax/minimax-m3 |
+13
|
1,048,576 | $0.24265/1M to $0.633/1M | $1.0128/1M to $2.532/1M | ZDR 4 cited scores | No measurements yet |
Browse every modelReview provider policiesOpen the full leaderboardSnapshot 2026-10-22T15:26:24Z