OpenAI compatible API · Attested · Public status

TrustedRouter vs OpenRouter

Compare TrustedRouter and OpenRouter across APIs, deployment, routing, billing, observability, content handling, and verifiable privacy.

Verify gateway

Onebase URL to migrate

100sof models and routes

0prompt or output logs. Always.

Switch in 1 line

OpenRouter, but you can verify the prompt path.

Change base_url. Keep your OpenAI SDK, your messages shape, and your streaming loop. Canonical vendor-prefixed model ids mostly resolve unchanged.

What you add: a hardware-attested gateway, a public source-to-binary trail, no durable prompt or output logs on realtime inference, and a public status page with live burn rates.

Try the playground Verify gateway

Before / after — PythonOpenAI SDK

from openai import OpenAI

# Before
client = OpenAI(
    base_url="https://openrouter.ai/api/v1",
    api_key="sk-or-..."
)

# After
client = OpenAI(
    base_url="https://api.trustedrouter.com/v1",
    api_key="sk-tr-v1-..."
)

# Everything else stays the same:
resp = client.chat.completions.create(
    model="anthropic/claude-sonnet-4.6",
    messages=[{"role": "user", "content": "hi"}],
)

Same API

OpenAI-compatible.

Streaming, tool calls, vision, structured output — supported. Every OpenRouter API path carries an explicit compatibility classification (real, compatible-real, or stub), enforced in CI against their published OpenAPI spec.

Verifiable

Attested gateway.

Cross-cloud confidential VMs sign their boot measurement. You check the image hash against the published artifact.

No logging

Zero by construction.

Ordinary synchronous and streaming prompt paths do not touch persistent storage. Batch is a separate opt-in encrypted-retention mode. The binary you can verify is the binary that handles your traffic.

OpenRouterTrustedRouter

API shapeOpenAI compatibleOpenAI compatible

Prompt loggingOff by default; opt-in for a 1% discountNone on realtime — verifiable in source

Trust modelPolicy + SOC 2 Type 2Hardware attestation + public source

SourceClosed (SDKs Apache-2.0)Public — every line that touches your prompt

Catalog breadth400+ model ids across 100+ providers600+ model ids across 80+ providers

Provider fallbackYesYes — across more than 80 providers

Platform charge5.5% ($0.80 min) buying credits; inference at list price5.5% on prepaid model cost ($0.01/M floor)

Status SLOsPublic status page99.99% availability target + live 5m-24h burn rates

Best fitBroad model marketplacePrivacy-sensitive workloads that need a verifiable prompt path

Verify the gatewaycurl + jq

# 1. Get a nonce-bound attestation
NONCE=$(openssl rand -hex 16)
curl -s "https://api.trustedrouter.com/attestation?nonce=$NONCE" \
  | jq .

# Response includes:
#   eat_nonce     — your nonce, replay-protected
#   image_digest  — SHA-256 of the running container
#   pcrs          — platform measurements at boot

# 2. Compare image_digest against the published artifact:
#    https://trustedrouter.com/security
#
# If they match, the code processing your prompts is
# the code on GitHub.

60-second proof

Don't trust. Check.

The gateway exposes a live attestation endpoint that returns a JWT signed by the CPU's hardware root key. You match the image digest to the source-built binary, and you know — not assume — what code is running.

A privacy policy is a promise. A hash is something you can check.

How attestation works Migration guide

Common questions

The boring details that make this real.

Do my existing keys work? No — TR keys are a different prefix (sk-tr-v1-…). Issuance is self-serve after sign-up.

Same model catalog? No two router catalogs are identical. As of August 26, 2026, TrustedRouter's public API lists 600+ model ids, compared with 400+ on OpenRouter's public feed. TrustedRouter spans more than 80 providers; OpenRouter lists more than 100. An unknown id returns MODEL_NOT_SUPPORTED instead of a guess, so check your ids on /models first.

Pricing? Provider cost + 5.5% markup, with a $0.01/M floor. Same percentage as OpenRouter's published 5.5% fee on credit purchases — but on a different base: ours applies to model cost, theirs at credit top-up with inference passed through at list price. Exact customer prices are published on every model page.

BYOK? Yes — bring your own provider keys for billing isolation. Routing code stays attested.

Self-host? The full control plane and gateway are source-available (BUSL-1.1) — read, build, and verify every line; the attestation story works because the image hash you build is the hash the enclave reports. Production self-hosting runs under a commercial license.

Why build this? The full argument is in the essay “Attestation is All You Need”.

Official evidence

Sources checked August 16, 2026

Report a change

OpenRouter FAQ (fees, zero-logging default)https://openrouter.ai/docs/faq
OpenRouter BYOK pricing and allowancehttps://openrouter.ai/docs/use-cases/byok
OpenRouter pricing (5.5% platform fee)https://openrouter.ai/pricing
OpenRouter ZDR guide (zdr parameter, caching stance)https://openrouter.ai/docs/guides/features/zdr
OpenRouter provider routing (default load balancing)https://openrouter.ai/docs/features/provider-routing
OpenRouter trust center (SOC 2 Type 2)https://trust.openrouter.ai/
OpenRouter live model feed (413 ids, 2026-08-16)https://openrouter.ai/api/v1/models
TechCrunch on OpenRouter's $113M Series Bhttps://techcrunch.com/2026/05/26/openrouter-more-than-doubles-valuation-to-1-3b-in-a-year/
TrustedRouter monthly benchmark reportsStable first-party route evidence
TrustedRouter live trust recordRelease and attestation evidence

All gateways

TrustedRouter vs Vercel AI GatewayHosted AI gateway
TrustedRouter vs LiteLLMSelf-hosted AI gateway
TrustedRouter vs Cloudflare AI GatewayHosted edge AI gateway
TrustedRouter vs PortkeyAI gateway and observability

Questions

Will my OpenRouter model ids work on TrustedRouter?

Some need mapping. As of August 2026, 168 of the 413 ids on OpenRouter's live feed resolve on TrustedRouter unchanged; canonical vendor-prefixed ids mostly match, and an unknown id returns MODEL_NOT_SUPPORTED rather than a guess. Every OpenRouter API path also carries an explicit compatibility classification (real, compatible-real, or stub) enforced in CI. Check your model list against /models before switching.

Is OpenRouter cheaper?

Often, yes. OpenRouter adds no markup to inference and charges 5.5% ($0.80 minimum) only when you buy credits; BYOK is free below $25,000/month of list-price usage. TrustedRouter charges provider cost + 5.5% with a $0.01/M floor on prepaid usage. If lowest total cost decides and policy-based privacy is acceptable, OpenRouter wins on price for most workloads. Our margin pays for the attested gateway and the no-durable-log realtime path.

Both say they don't log prompts. What is actually different?

The enforcement mechanism. OpenRouter's default is zero prompt/completion logging, and its ZDR routing follows providers' declared policies: a policy commitment from a closed-source service, backed by SOC 2 Type 2. TrustedRouter's realtime path keeps no durable prompt or output logs, and the claim is checkable: the gateway source is public, and live attestation endpoints on GCP, AWS, and Azure prove the running build matches the published code. Our attestation covers the gateway, not downstream model providers; those remain policy-tier claims except on e2e routes to confidential-compute providers.