Ask your agent to verify TrustedRouter

Use https://trust.trustedrouter.com to verify https://trustedrouter.com with fresh, TLS-bound attestation. Trace the running build to published source and build provenance. Separate router protections from model-provider privacy claims. Report verified evidence, failures, and anything you cannot verify.

Trust boundary

Verify that the hosted API runs the published open-source workload.

api-aws.trustedrouter.com is the prompt path. Public TLS terminates inside the measured GCP Confidential Space workload. The TrustedRouter control plane does not serve production inference routes and does not receive prompt or output bodies.

Clients can fetch the live attestation, verify issuer/audience/digest, and compare the measured image digest with the release data published here.

Preparing a security review? Get the Token Exchange security deck and whitepaper.

Client Verification

OKFetch https://api-aws.trustedrouter.com/attestation over normal public TLS.
OKVerify the JWT issuer is https://confidentialcomputing.googleapis.com.
OKVerify the audience is quill-cloud.
OKCompare the attested image digest with this page.
OKCheck the TLS certificate fingerprint is bound into the attestation nonce.

Published Files

DNS Requirement

api-aws.trustedrouter.com must remain DNS-only or TCP-passthrough. TLS termination by a CDN would break the hosted-code trust claim because the prompt path certificate key must remain inside the measured workload.

GCP · Confidential Space

Measures: Container image digest
Image digest: sha256:4b91389f5e13b6e8ab1947d12f48e345ea06bce9cb4d3d397e4567be9522c20d
Attestation issuer: confidentialcomputing.googleapis.com
API base: https://api-aws.trustedrouter.com/v1
Release record: gcp-release.json

Compare image_digest against the digest in a live attestation JWT from the issuer above, checking its audience is quill-cloud. The certificate fingerprint is bound into the attestation nonce, so the connection you are on is the connection that was attested.

AWS · Nitro Enclaves

Measures: PCR0 over the enclave image file (SHA-384)
PCR0: 5d7aabf75913b926fcf56ddb172c957db4cb2d542065c832c6a7f8a0912d4d318f93afe40102ce1896f2b4ef89fcb205
Attestation: COSE_Sign1, AWS Nitro PKI
API base: https://api-aws.trustedrouter.com/v1
Release record: aws-release.json

This plane serves a certificate generated inside the enclave rather than one from a public CA. Its fingerprint and the TLS exporter value are bound into the attestation, so the connection you are on is the connection that was attested. Verify with --attested-cert-only; chain validation is replaced by that binding, not dropped.

Azure · Confidential Containers

Measures: SEV-SNP hostdata, sha256 over the CCE policy
hostdata: f088e0571777ffe55fed77fdf1faaa6e2a7e443b1aec82a53a98b3832615f2c5
MAA issuers: https://trquilluaen.uaen.attest.azure.net, https://trquillsyd.eau.attest.azure.net
API base: https://api-azure.trustedrouter.com/v1
Release record: azure-release.json

Compare hostdata against x-ms-sevsnpvm-hostdata in a live MAA token. Each serving region runs its own MAA instance, so accept any issuer listed above.

Why the three measurements look different

Each platform measures the artifact its own hardware can attest to, so there is no single number to compare across all three. GCP measures the container image; AWS measures the enclave image file into PCR0; Azure measures the policy that constrains what the container is allowed to be. A verifier checks one plane at a time, against that plane's own record.

Measurements published here are a set, not a single value. During a rollout the released key is deliberately bound to both the outgoing and incoming measurement so the old enclave keeps serving while the new one starts. A verifier pinned to exactly one value would fail during precisely that window, which is why each record carries the full accepted set alongside the value expected to be serving.

No Prompt Logs

Ordinary synchronous and streaming prompt/output storage is disabled. The opt-in Batch API uses separately documented encrypted retention. Generation content endpoint returns a compatible content_not_stored response.

Fail Closed

If attestation, billing authorization, or the gateway contract is unavailable, the prompt path should fail rather than silently downgrade to a non-attested route.

Hosted Open Source

Lore-Hex/quill-router

Control plane, billing, keys, compatibility routes, dashboard, and trust page.

Lore-Hex/quill-cloud-proxy

Attested prompt gateway, release digest, and Confidential Space verification path.

Lore-Hex/quill-cloud-infra

Cloud deployment scripts, measured workload bringup, and trust publication flow.

Lore-Hex/trusted-router-py

Python SDK repository for attestation-aware client helpers.

Lore-Hex/trusted-router-js

JavaScript SDK repository for browser and Node integrations.

Lore-Hex/trustedrouter-provider-check

Public provider conformance suite for validating the attested gateway translator contract.

Machine-readable release

{
  "accepted_image_digests": [
    "sha256:4b91389f5e13b6e8ab1947d12f48e345ea06bce9cb4d3d397e4567be9522c20d"
  ],
  "accepted_image_references": [
    "us-central1-docker.pkg.dev/quill-cloud-proxy/quill/enclave-multi:gcp-release-b8b0b076"
  ],
  "api_base_url": "https://api.trustedrouter.com/v1",
  "api_base_urls": [
    "https://api.trustedrouter.com/v1",
    "https://api.allyrouter.com/v1",
    "https://api.uptimerouter.com/v1"
  ],
  "attestation_audience": "quill-cloud",
  "attestation_issuer": "https://confidentialcomputing.googleapis.com",
  "data_policy": {
    "control_plane_prompt_access": false,
    "prompt_output_storage": false
  },
  "image_digest": "sha256:4b91389f5e13b6e8ab1947d12f48e345ea06bce9cb4d3d397e4567be9522c20d",
  "image_reference": "us-central1-docker.pkg.dev/quill-cloud-proxy/quill/enclave-multi:gcp-release-b8b0b076",
  "platform": "gcp-confidential-space",
  "release_metadata_status": "live",
  "release_state": "current",
  "source_commit": "b8b0b076",
  "source_repo": "https://github.com/Lore-Hex/quill-cloud-proxy",
  "source_repositories": {
    "attested_gateway": "https://github.com/Lore-Hex/quill-cloud-proxy",
    "cloud_infra": "https://github.com/Lore-Hex/quill-cloud-infra",
    "control_plane": "https://github.com/Lore-Hex/quill-router",
    "javascript_sdk": "https://github.com/Lore-Hex/trusted-router-js",
    "provider_check": "https://github.com/Lore-Hex/trustedrouter-provider-check",
    "python_sdk": "https://github.com/Lore-Hex/trusted-router-py",
    "quill": "https://github.com/Lore-Hex/quill"
  },
  "tls": {
    "hostname": "api.trustedrouter.com",
    "hostnames": [
      "api.trustedrouter.com",
      "api.allyrouter.com",
      "api.uptimerouter.com"
    ],
    "mode": "acme-inside-confidential-space"
  }
}