Zero Data Retention LLM API — Verifiable in Source
Zero data retention as a structural property of the open-source code, not just a contract clause. Multi-provider routing with the same posture.
Zero data retention as a verifiable property, not a contract clause.
"ZDR" usually means a clause in your enterprise agreement. The operator promises not to retain. You hope they comply.
TrustedRouter's ordinary synchronous and streaming prompt path does not write request or response bodies to persistent storage. Batch is a separate opt-in encrypted-retention mode. The code that handles your prompts is open-source. The image hash is published. You can verify the real-time path without trusting us.
# Per-request record (token counts, timing, model id)
{
"request_id": "req_...",
"workspace_id": "...",
"model_id": "anthropic/claude-sonnet-4.6",
"input_tokens": 12,
"output_tokens": 84,
"cost_microdollars": 218,
"provider": "anthropic",
"region": "us-central1",
"created_at": "..."
}
# What's NOT in here:
# - prompt body
# - response body
# - user inputs of any kind
# Audit the schema:
# github.com/.../storage_models.pyZero, by construction.
The attested binary doesn't open a write handle to a prompt path. The retention isn't a policy choice; it's a structural property of the code.
Check it yourself.
Grep the source for any code that touches request bodies. There isn't any. The image hash you build is the hash the enclave reports.
Including upstream where possible.
For providers with their own ZDR posture (Anthropic, OpenAI Enterprise, Tinfoil, GCP Confidential), we route under their stronger guarantees and surface that on each model page.
What ZDR doesn't cover.
Upstream providers have their own retention behavior. We can route to providers that match your posture and we publish each one's known stance on the model pages.
Attestation proves the running binary is the published binary. It doesn't prove the binary is bug-free.
If you can't trust the GCP Confidential Space attestation chain at all, hosted attestation doesn't save you. Self-hosting lets you pin and publish your own image digest under your own controls.
Current routes, prices, privacy, and measured performance.
Catalog facts come from the routes currently configured in TrustedRouter. Performance uses the same cached metadata snapshot as the public leaderboard. Prompts and outputs are not part of these measurements.
| Model | Providers | Context | Input | Output | Privacy | Measured route |
|---|---|---|---|---|---|---|
Anthropic: Claude Opus 4.8anthropic/claude-opus-4.8 |
|
1,000,000 | $5.275/1M | $26.375/1M | varies 5 cited scores | 1969 ms TTFT anthropic · 84 tok/s · 100.00% available · n=4 |
OpenAI: GPT-5.5openai/gpt-5.5 |
|
1,050,000 | $5.275/1M | $31.65/1M | ZDR 3 cited scores | 1516 ms TTFT openai · 100.00% available · n=1 |
Google: Gemini 3.5 Flashgoogle/gemini-3.5-flash |
+1
|
1,048,576 | $1.5825/1M | $9.495/1M | ZDR | 1645 ms TTFT google-vertex · 53 tok/s · 100.00% available · n=6 |
MoonshotAI: Kimi K2.7 Codemoonshotai/kimi-k2.7-code |
+10
|
262,144 | $0.692291/1M to $1.00225/1M | $3.4815/1M to $4.22/1M | ZDR 5 cited scores | 2040 ms TTFT kimi · 73 tok/s · 100.00% available · n=24 |
Z.ai: GLM 5.2z-ai/glm-5.2 |
+24
|
1,048,576 | $0.7174/1M to $2.407721/1M | $1.5825/1M to $6.952295/1M | E2EE 4 cited scores | 1562 ms TTFT inceptron · 61 tok/s · 100.00% available · n=66 |
MiniMax: MiniMax M3minimax/minimax-m3 |
+8
|
524,288 | $0.24265/1M to $0.58025/1M | $1.0128/1M to $2.321/1M | ZDR 4 cited scores | 818 ms TTFT together · 100.00% available · n=31 |
Browse every modelReview provider policiesOpen the full leaderboardSnapshot 2026-09-24T23:21:39.835Z