The confidential AI router. Route to frontier models through one attested endpoint, at the same price as going direct.
Your OpenAI SDK works as-is. Ours verifies the enclave before a single byte leaves your machine.
import os
from openai import OpenAI
client = OpenAI(
base_url="https://api.tresor.co/v1",
api_key=os.environ["TRESOR_API_KEY"],
)
resp = client.chat.completions.create(
model="gpt-oss-120b",
messages=[{"role": "user", "content": "Hello!"}],
)
print(resp.choices[0].message.content)import os
import httpx
from openai import OpenAI
from attest import AttestedTransport
client = OpenAI(
base_url="https://api.tresor.co/v1",
api_key=os.environ["TRESOR_API_KEY"],
http_client=httpx.Client(transport=AttestedTransport()),
)
resp = client.chat.completions.create(
model="gpt-oss-120b",
messages=[{"role": "user", "content": "Hello!"}],
)
print(resp.choices[0].message.content)Every call goes through the same path: into an attested enclave, back with a receipt you can check.
Change two lines. Keep the rest.
Set base_url to api.tresor.co/v1 and use a Tresor API key; chat completions, streaming, and transcription work exactly as your existing SDK expects. Compatible with Python, Node, Go, and any OpenAI client lib.
See the enclave. Pin the runtime. Then send.
Fetch live attestation evidence, match it against the signed trust bundle, and pin TLS to the expected enclave so no request goes out until the destination checks out. GET /attestation. Trust bundle at /.well-known/trust.json.
A cryptographic audit trail, not a policy promise.
Every successful call returns a receipt_id for a JWS (ES256) that binds the request and response to live attestation evidence. It is the kind of proof GDPR Art. 32, DORA, and NIS2 reviews ask for. Verify with any JWT library or the tresorhq-attest SDK.
Route on purpose. Or let auto handle it.
Address compound IDs like lux/tresor/kimi-k2.5 to pin every detail, or pass auto to let the router pick from a set you've approved. Region/provider/model selection per request or per key.
Higher availability without silent rerouting.
Every model is served by multiple attested providers, so an upstream outage doesn't become yours. Declare ordered fallback routes per key or per request, and the router only switches within the alternatives you explicitly named. Every failover event is recorded in the receipt and usage log.
Separate environments without sharing secrets.
Create, name, and revoke keys per service or environment, and every call carries a key_prefix so usage stays attributable. Per-key attribution in the dashboard and usage API.
The Inference API is a router: one attested endpoint in front of frontier models from multiple providers. Public route IDs stay as short as possible: model-only by default, then provider or region when you pin them, and all three segments only when you need the fully concrete route.
The route ID is the contract
gpt-oss-120b
Default logical route
Model only. The router picks an attested provider and region from the set you approve.
eu/gpt-oss-120b
Region pinned
Add a region when data location matters. Provider stays automatic inside that region.
privatemode/gpt-oss-120b
Provider pinned
Add a provider when you want one operator. If that provider only runs in one region, the ID stays short.
global/tinfoil/gpt-oss-120b
Fully concrete route
Use all three segments only when both provider and region need to stay explicit.
Bare model IDs are the default contract. Region and provider only appear when you pin them. The old three-segment form still exists, but only for routes that need both constraints to remain explicit.
Every model is served by multiple attested providers. Declare ordered fallback routes and the router only switches within them. Each failover is recorded in the receipt.
Every route costs the same per token as the upstream provider charges directly. Confidentiality is not a premium tier. You never pay extra for it.
Every request returns a signed receipt bound to attestation evidence. It is the kind of proof GDPR Art. 32, DORA, and NIS2 reviews ask for.
Self-serve API access that scales with your usage.
Pay as you go
prepaid credits, no subscription
Custom contracts with negotiated rates, SLA, and compliance.
Custom
monthly commitment + overage
Parity pricing: every route costs the same per token as the upstream provider. Confidentiality costs nothing extra.
| Model | Regions | Providers | Context | Input | Cache | Output |
|---|---|---|---|---|---|---|
Text -> Text | EU · Global | 3 providers | 128k | €0.13/M | €0.03/M | €0.48/M |
Text -> Text | Global | 1 provider | 128k | €0.04/M | — | €0.13/M |
Text, Image -> Text | EU · Global | 2 providers | 256k | €0.58/M | €0.15/M | €3.08/M |
Text, Image -> Text | Global | 2 providers | 256k-1M | €2.64/M | €0.70/M | €13.21/M |
 Text, Image -> Text | Global | 2 providers | 256k | €0.11/M | €0.02/M | €0.35/M |
 Text -> Text | Global | 4 providers | 384k-1M | €1.23/M | €0.26/M | €3.88/M |
G Text -> Text | EU | 1 provider | 256k | €1.55/M | €0.15/M | €7.74/M |
G Text -> Text | Global | 2 providers | 1M | €0.07/M | €0.01/M | €0.22/M |
Text -> Text | Global | 3 providers | 1M | €0.12/M | €0.01/M | €0.25/M |
Text, Image -> Text | Global | 2 providers | 256k | €0.26/M | €0.13/M | €1.76/M |
Text -> Text | Global | 2 providers | 128k-256k | €0.15/M | €0.05/M | €0.97/M |
Text -> Text | Global | 1 provider | 128k | €1.54/M | — | €2.42/M |
Audio -> Text | EU | 1 provider | — | — | — | €0.014/min |
Audio -> Text | Global | 1 provider | — | — | — | €0.0088/req |
Audio -> Text | Global | 1 provider | 32k | €0.18/M | — | €0.53/M |
Audio -> Text | EU | 1 provider | — | — | — | €0.0040/min |
Text -> Text | Global | 1 provider | 32k | €0.04/M | — | €0.09/M |
Public AI tools read everything you send. On-prem is private but impractical. Tresor gives you both: cloud convenience, infrastructure-grade privacy.
I can only use AI in coaching when it fully protects the sacred trust between practitioner and client; confidentiality is non-negotiable.
Tove Thyes
Transformational Coach and Energy Medicine Practitioner
As a software strategist, I treat privacy as the blueprint that lets my team turn client visions into AI people can trust.
Igor Miazek
CEO & Founder, Techs
At Dance, we build experiences people trust. Tresor’s approach to privacy-first AI is a simply a great match.
Christian Springub
CEO & Co-Founder, Dance
As a therapist, I can only use AI that protects client privacy. Tresor delivers exactly that.
Magali Cahen
Psychologist and Therapist, Independent
The only way to earn trust in AI is to make privacy a design principle, not a feature. Tresor’s system does exactly that.
Ingmar Schuster
CEO & Co-Founder, Provolut
In the AI era, rigorous risk-based security and GDPR-aligned privacy are non-negotiable foundations for any trustworthy system.
Davy Cox
Founder, Brainframe
Executive Summary
Tresor is built on a simple promise: your conversations belong to you, not us. Every message you type is protected by end-to-end encryption and processed only inside secure computing environments that even Tresor cannot inspect. Teams can now collaborate inside shared workspaces without ever handing Tresor access to their plaintext. This whitepaper explains the principles and safeguards behind Tresor’s zero-access design, showing how we deliver practical confidentiality without trade-offs in usability.