LLM API for Law Firms and Legal Tech | TrustedRouter
An LLM API for law firms and legal tech: hardware-attested confidential compute, no prompt or output logs, and attestation your team can verify live.
When the gateway operator provably cannot read the prompt, your privilege analysis starts from different facts.
Legaltech products and law-firm AI pilots stall on the same question: can client documents go to a third-party API without breaching confidentiality duties or risking privilege waiver by disclosure? Most vendors answer with a privacy policy. TrustedRouter answers with hardware. The prompt path runs inside a hardware-attested confidential-compute gateway, the gateway source is open, the image digest is published, and the attestation is checkable live, bound to your TLS session so it cannot be replayed.
TrustedRouter never logs prompt or output content. Ordinary synchronous and streaming inference does not retain it. The opt-in Batch API temporarily retains enclave-encrypted artifacts for up to 30 days. Batch must be separately approved for privileged work because it uses encrypted retention. None of this decides the privilege question; that call belongs to your ethics counsel, and nothing on this page is legal advice. What it gives counsel is a better factual record than a promise: an attested gateway with evidence your team can re-check on every request. Privacy you can check beats privacy you're promised.
from openai import OpenAI
client = OpenAI(
base_url="https://api.trustedrouter.com/v1",
api_key=TRUSTEDROUTER_KEY,
)
resp = client.chat.completions.create(
model="trustedrouter/auto",
messages=[{"role": "user",
"content": "Flag unusual indemnification terms in this clause: ..."}],
)
print(resp.choices[0].message.content)Attestation, checkable live
A signed attestation ties the running gateway to the published open-source image and to your live TLS session. Anyone on your team can check it before, during, and after a matter. Attestation beats a privacy policy. The exact verification steps are on the security page.
Open, Zero-Data-Retention, TEE
Every route carries a privacy tier. Zero-Data-Retention routes use providers contractually bound to keep nothing. TEE routes run end-to-end confidential compute, where even the serving provider cannot read the prompt. For privileged legal documents, pin your product to ZDR and TEE routes.
What your GC will ask for
TrustedRouter publishes SOC 2 readiness and HIPAA readiness documentation your compliance team can assess alongside the verifiable architecture. These are readiness documents; they are not audit reports or certifications. A DPA, a BAA, and a subprocessor list are available. European teams working under professional-secrecy rules such as §203 StGB can route through the EU gateway.
Ship document review on an inference layer a firm's ethics counsel can inspect.
The API is OpenAI-compatible: change base_url, keep your SDK, your model ids, and your code. Behind it sit 220+ model routes across 30+ providers, including Claude, GPT, Gemini, and open-weight models, with automatic provider fallback when a route is down. One anonymized proof point: a document-processing company scaled from zero to over a billion tokens per week through the attested gateway within three weeks of onboarding.
Open-weight models from DeepSeek, Kimi, Qwen, GLM, and MiniMax are available too. With Confidential privacy (provider.min_privacy "confidential"), prompts never reach the model vendor: a Confidential request routes only to third-party confidential-compute hosts, and fails rather than fall back to the vendor's own API. Pay with prepaid credits, bring your own provider key, or use x402 pay-per-request. Per-model pricing is listed at /pricing, and you can compare routes in the model chooser.
Current routes, prices, privacy, and measured performance.
Catalog facts come from the routes currently configured in TrustedRouter. Performance uses the same cached metadata snapshot as the public leaderboard. Prompts and outputs are not part of these measurements.
| Model | Providers | Context | Input | Output | Privacy | Measured route |
|---|---|---|---|---|---|---|
Anthropic: Claude Opus 4.8anthropic/claude-opus-4.8 |
|
1,000,000 | $5.275/1M | $26.375/1M | varies 5 cited scores | 1634 ms TTFT anthropic · 85 tok/s · 100.00% available · n=2 |
OpenAI: GPT-5.5openai/gpt-5.5 |
|
1,050,000 | $5.275/1M | $31.65/1M | ZDR 3 cited scores | Warming up |
Google: Gemini 3.5 Flashgoogle/gemini-3.5-flash |
|
1,048,576 | $1.5825/1M | $9.495/1M | ZDR | 1945 ms TTFT google-ai-studio · 100.00% available · n=5 |
MoonshotAI: Kimi K2.7 Codemoonshotai/kimi-k2.7-code |
+11
|
262,144 | $0.692291/1M to $1.31875/1M | $3.4815/1M to $4.90575/1M | ZDR 5 cited scores | 1738 ms TTFT kimi · 71 tok/s · 100.00% available · n=33 |
Z.ai: GLM 5.2z-ai/glm-5.2 |
+27
|
1,048,576 | $0.467682/1M to $2.364044/1M | $1.5825/1M to $6.826178/1M | Confidential + ZDR 4 cited scores | 3475 ms TTFT phala · 7 tok/s · 66.67% available · n=65 |
MiniMax: MiniMax M3minimax/minimax-m3 |
+11
|
524,288 | $0.24265/1M to $0.633/1M | $1.0128/1M to $2.532/1M | ZDR 4 cited scores | 2257 ms TTFT fireworks · 101 tok/s · 100.00% available · n=28 |
Browse every modelReview provider policiesOpen the full leaderboardSnapshot 2026-10-08T13:51:58.976Z
Questions
Does TrustedRouter store our prompts or client documents?
TrustedRouter never logs prompt or output content. Ordinary synchronous and streaming inference does not retain it. The opt-in Batch API temporarily retains enclave-encrypted artifacts for up to 30 days. The prompt path runs inside a hardware-attested confidential-compute gateway whose source is open and whose image digest is published. Your team can verify the running code at any time: the attestation endpoint returns a JWT signed by the CPU vendor's root key, bound to your live TLS session so it cannot be replayed.
Does using an LLM API waive attorney-client privilege?
That is a legal determination only your counsel can make, and TrustedRouter does not give legal advice. What the platform changes is the factual record the analysis rests on: on TEE routes the serving provider cannot read the prompt, and the attestation is checkable rather than promised. TrustedRouter never logs prompt or output content. Ordinary synchronous and streaming inference does not retain it. The opt-in Batch API temporarily retains enclave-encrypted artifacts for up to 30 days. Batch requires separate approval for privileged work. That supports a privilege analysis; it does not decide one.
Is TrustedRouter SOC 2 or HIPAA certified?
No. TrustedRouter publishes SOC 2 readiness and HIPAA readiness documentation, which are readiness documents, not audit reports or certifications. The position is verifiable architecture plus readiness documentation your compliance team can assess. A DPA, a BAA, and a current subprocessor list are available for review, and an EU gateway with EU-focused routing exists for European teams.
Can we use open-weight models like DeepSeek or Qwen without sending data to the model vendor?
Yes. With Confidential privacy (provider.min_privacy "confidential"), prompts never reach the model vendor: a Confidential request routes only to third-party confidential-compute hosts, and fails rather than fall back to the vendor's own API. For legal work that means access to frontier open-weight models without adding the model vendor to your disclosure chain. Standard routing can include a vendor's own API, so set the Confidential tier for matters that require it.