GDPR-Compliant LLM API: Attested EU Inference | TrustedRouter
An OpenAI-compatible LLM API built for GDPR workflows: attested confidential compute, no prompt storage by default, a signable DPA, and an EU gateway.
An LLM API built for GDPR workflows: attested inference, a signable DPA, and no prompt storage by default.
Send personal data through an LLM API and your DPO will ask three questions: who can read the prompt, where does it run, and what is retained. Most providers answer with a policy PDF. TrustedRouter answers with hardware: the prompt path runs inside an open-source, hardware-attested confidential-compute gateway, and TrustedRouter does not store prompt or output content by default. Attestation beats a privacy policy.
The Article 28 paperwork is ready too: a signable DPA, a published subprocessor list, and SOC 2 and HIPAA readiness documentation your compliance team can assess. An EU gateway with EU-focused routing is live. Migration is one line: the API is OpenAI-compatible, so you change the base_url and keep your SDK, model ids, and code.
# Verify the gateway before you send a single prompt
NONCE=$(openssl rand -hex 16)
curl "https://api.trustedrouter.com/attestation?nonce=$NONCE"
# Returns a JWT signed by the CPU vendor's root key.
# image_digest matches the published open-source build.Nothing stored by default
TrustedRouter does not store prompt or output content by default. The gateway source is open and the running image digest is published, so your team can check the code that handles the prompt instead of filing another vendor policy. Data minimization becomes a property you verify rather than a paragraph you quote.
Open, ZDR, or TEE per route
Every route carries a privacy tier. Open runs on any attested provider. Zero-Data-Retention routes use providers contractually bound to keep nothing. TEE routes run end-to-end confidential compute, where even the serving provider cannot read the prompt. Match the tier to the data in the request.
DPA, subprocessors, readiness docs
A signable DPA, a BAA, a current subprocessor list, and SOC 2 plus HIPAA readiness pages. These are readiness documents rather than audit reports, and we label them that way: verifiable architecture plus documentation your compliance team can assess.
An EU region answers where your data sits. Attestation answers who can read it.
The recurring objection in GDPR provider reviews: pinning inference to an EU region does not, by itself, settle who can access the data. TrustedRouter states its EU position plainly. The EU gateway gives you EU-focused routing, with no residency guarantees beyond that. The stronger control sits underneath: on TEE routes the prompt is processed inside end-to-end confidential compute, and the attestation proving it binds to your live TLS session, so it cannot be replayed.
A document-processing company scaled from zero to over a billion tokens per week through the attested gateway within three weeks of onboarding. You get 220+ model routes across 30+ providers, automatic fallback when a provider goes down, and transparent per-model pricing at a thin markup over provider list prices. Nothing on this page is legal advice; your DPO makes the call. What TrustedRouter gives them is a data flow they can check. Verify, don't trust.
Questions
Is TrustedRouter certified GDPR compliant?
TrustedRouter does not claim a GDPR certification. What it provides is verifiable architecture plus readiness documentation your compliance team can assess: a signable DPA, a published subprocessor list, SOC 2 and HIPAA readiness pages, an EU gateway, and a live attestation endpoint proving the prompt path runs inside the published open-source confidential-compute image. Your DPO makes the compliance determination; TrustedRouter gives them evidence they can check rather than promises to take on trust.
Does TrustedRouter store my prompts or outputs?
TrustedRouter does not store prompt or output content by default. The prompt path runs inside a hardware-attested confidential-compute gateway whose source code is open and whose image digest is published. You can verify this live: call the attestation endpoint with a fresh nonce and you get back a JWT signed by the CPU vendor's root key, bound to your live TLS session so it cannot be replayed. Details are on the security page.
Can I keep inference in the EU?
TrustedRouter operates an EU gateway with EU-focused routing, and makes no data-residency guarantees beyond that. For personal data, the stronger control is the privacy tier: Zero-Data-Retention routes use providers contractually bound to keep nothing, and TEE routes run end-to-end confidential compute where even the serving provider cannot read the prompt.
How hard is it to migrate from OpenAI?
Change the base_url to TrustedRouter's endpoint and keep your existing SDK, model ids, and code. The API is OpenAI-compatible, with 220+ model routes across 30+ providers including Claude, GPT, Gemini, DeepSeek, and Mistral, plus automatic provider fallback when a provider is down. Pricing is a thin markup over provider list prices, published per model on the pricing page.