Private LLM API — Verifiable, Attested, Open Source
A private LLM API where privacy is cryptographically verifiable. Route to Claude, GPT, Gemini, DeepSeek through an attested gateway.
A private LLM API where "private" means cryptographically verified.
Every hosted LLM provider claims privacy. Almost none of them give you a way to verify it.
TrustedRouter routes to every major model — Claude, GPT, Gemini, DeepSeek, Kimi, Llama, Mistral — through a hardware-attested gateway. The code is open source. The image is hashed. You can check what runs.
Try the playground Trust surface
New email signups receive starter credit. No card required.
client = OpenAI(
base_url="https://api.trustedrouter.com/v1",
api_key="sk-tr-v1-..."
)
resp = client.chat.completions.create(
model="anthropic/claude-sonnet-4.6",
messages=[
{"role": "user", "content": "your prompt"}
],
)
# No logs. Source verified. Attestation on demand.Read the source.
Every line that handles your prompt is on GitHub. Search it. Audit it. Run it locally if you want.
Hardware-rooted trust.
The gateway runs inside GCP Confidential Space. The hardware-backed attestation signs the running image. You verify the signature.
No request without attestation.
If the gateway can't prove its own integrity, traffic stops. The synthetic monitor probes this every minute and pages on the first miss.
Things that are zero, with proof.
Prompt body. Never written to disk. Never shipped to a logging service. The binary doesn't open a write handle to a prompt path. You can grep for this.
Output body. Same for synchronous and streaming requests. The response goes from the upstream provider straight back to you and is not persisted. Batch is a separate opt-in encrypted-retention mode.
Per-request audit trail. What TR does log: token counts, timestamps, model id, region, billing. No content. The schema is in the open-source code.
Upstream provider behavior. Out of TR's control. We publish each provider's known retention and ZDR posture on every model page so you can route deliberately.
Build a private routing policy
All resources- Provider privacy directoryZDR, confidential compute, E2EE, and policy sources
- DeepSeek API privacyHosting boundaries and fail-closed ZDR filters
- Claude API privacyRoute-specific retention and provider controls
- Confidential computing for LLMsHardware attestation and trust boundaries
- Legal and procurement packetDPA, BAA, subprocessors, and readiness evidence
Current routes, prices, privacy, and measured performance.
Catalog facts come from the routes currently configured in TrustedRouter. Performance uses the same cached metadata snapshot as the public leaderboard. Prompts and outputs are not part of these measurements.
| Model | Providers | Context | Input | Output | Privacy | Measured route |
|---|---|---|---|---|---|---|
Anthropic: Claude Opus 4.8anthropic/claude-opus-4.8 |
|
1,000,000 | $5.275/1M | $26.375/1M | varies 5 cited scores | 1735 ms TTFT anthropic · 53 tok/s · 100.00% available · n=2 |
OpenAI: GPT-5.5openai/gpt-5.5 |
|
1,050,000 | $5.275/1M | $31.65/1M | ZDR 3 cited scores | 2031 ms TTFT openai · 100.00% available · n=2 |
Google: Gemini 3.5 Flashgoogle/gemini-3.5-flash |
+1
|
1,048,576 | $1.5825/1M | $9.495/1M | ZDR | 1993 ms TTFT google-vertex · 62 tok/s · 100.00% available · n=4 |
MoonshotAI: Kimi K2.7 Codemoonshotai/kimi-k2.7-code |
+10
|
262,144 | $0.70685/1M to $1.00225/1M | $3.587/1M to $4.22/1M | ZDR 5 cited scores | 3564 ms TTFT kimi · 100.00% available · n=17 |
Z.ai: GLM 5.2z-ai/glm-5.2 |
+24
|
1,048,576 | $0.7174/1M to $2.437261/1M | $1.5825/1M to $7.037592/1M | E2EE 4 cited scores | measured baseten · 100.00% available · n=69 |
MiniMax: MiniMax M3minimax/minimax-m3 |
+9
|
524,288 | $0.24265/1M to $0.633/1M | $1.0128/1M to $2.532/1M | ZDR 4 cited scores | 1434 ms TTFT together · 40 tok/s · 100.00% available · n=74 |
Browse every modelReview provider policiesOpen the full leaderboardSnapshot 2026-09-15T18:14:40.716Z