Big Release for Private AI 🔒

TEE E2EE models are live on Routstr!

Access frontier open-source models like GLM-5.2 and DeepSeek V4 Pro inside verified GPU TEEs, encrypted on your device and only decrypted inside a TEE while you pay per prompt in sats with no accounts. The best privacy you'll get apart from running them yourself!

Write code anonymously with Opus-like capabilities via routstrd, or ask private questions on our chat app.

Read more about how it works:

quoting
naddr1qv…7fhl

Another feature long in the making: TEE-based end-to-end encrypted (E2EE) models are now available through Routstr and our SDK, via the new Tinfoil integration. Your prompt is encrypted on your device and only decrypted inside a verified GPU confidential-computing enclave. Nobody in between, not even the Routstr node, can read it.

And you can ask questions for as little as 9 sats.

TEEs and Privacy

Running local models is getting easier and better, but is still very expensive if you want good models, especially for coding and other agentic tasks. And the only way to access such models in a privacy-preserving way is through confidential computing and Trusted Execution Environments (TEEs).

The good news: alongside CPU TEEs, we now have GPU TEEs in the latest GPUs (H100 and later). This lets us verify both the model running inside the GPU and the software running on the CPU, so that nothing can be logged between you and the GPU running the LLM.

A caveat worth noting: TEEs have been broken before, and they are not open source. This is not foolproof by any means but it is the best we have at the moment.

Available Models

• GLM-5.2 (tinfoil-glm-5-2)
• Gemma-4 31B (tinfoil-gemma-4-31b)
• DeepSeek V4 Pro (tinfoil-deepseek-v4-pro)
• Kimi K2.6 (tinfoil-kimi-k2-6)

How It Works

The core idea: your request is encrypted before it leaves your machine, and the key only exists inside the TEE.

1. Attestation — When you connect, the Routstr SDK receives a remote-attestation proof from the TEE enclave. This cryptographically verifies that the code running inside the enclave is the genuine Tinfoil model image, on a real H100+ GPU, and hasn't been tampered with. Your client only proceeds if the proof is valid.
2. Client-side encryption — The routstr-sdk encrypts your request body locally using a key sealed to the attested enclave. The encrypted payload is what travels over the network.
3. In-enclave inference — Only the TEE can decrypt the request. The model runs entirely inside the confidential GPU. No host process, no node operator, no logging layer can see the plaintext prompt or the response.
4. Encrypted response — The TEE encrypts the response back to your key, which only your client holds. You decrypt locally.

So between you and the TEE + GPU, nobody can see any request or response. Routstr nodes only see encrypted ciphertext, even if they were intentionally logging.

Threat Model

This matters, so let's be precise about what TEE E2EE does and doesn't protect against.

What it protects: - The Routstr node operator cannot read your prompts or responses. - The hosting provider / data center cannot read them. - A network observer cannot read them.

What it doesn't fully protect: - A state actor with a backdoor to the TEE hardware/firmware could theoretically extract plaintext inside the enclave. TEEs have been broken before; this could happen again. We've come to trust Tinfoil more and more, but this is a trust assumption you should make consciously.

How Routstr adds anonymity on top of bare TEEs:

A TEE protects the contents of your prompts. But we already said TEEs have been broken before, so what happens if it happens again? Even if a state actor breaks the TEE and reads your plaintext prompts and responses, all they can do is try to build a profile of you. And that's exactly where Routstr makes it harder: with no persistent accounts and unlinkable Cashu payments, there's no stable identity to attach usage to. The anonymity layer is defense-in-depth, it limits the damage even in the worst-case TEE break. - With routstrd: API keys are periodically refunded with a node, so usage doesn't accumulate under one persistent balance. Refunding right after a session makes it even harder to link usage back to you. - With the chat app: Every request is a new XCashu payment — you pay only for that request. No accounts, pay-per-request/session, and Cashu-unlinkable payments.

How does it compare?

Option	Node sees prompt?	Provider sees prompt?	Linkable accounts?
OpenAI / Anthropic API	n/a	Yes	Yes
OpenRouter	Yes	Yes	Yes
Routstr (standard)	Yes	Yes	No (Cashu)
Tinfoil (direct)	n/a	No (inside TEE)	Yes
Others + Tinfoil	No (E2EE)	No (inside TEE)	Yes
Routstr + Tinfoil	No (E2EE)	No (inside TEE)	No (Cashu)
Local	No	No	No — but ~$50k for GLM-5.2

This is why we say Routstr + Tinfoil is the most private way to access frontier open-source models, apart from running them yourself at home.

Why Tinfoil

Tinfoil is the gold standard for TEE E2EE models according to aljaz (npub1alj…g9jp) and Confidential Inference, an independent benchmark that scores TEE providers on verifiability and correctness. Also by semisol (npub1226…grkj) nevent1q…sm8q

As a Routstr node, you can get a Tinfoil account and start offering it to Nostr users. Right now only one node is offering Tinfoil for sats — the more the merrier. You'll need this version to offer Tinfoil: https://github.com/Routstr/routstr-core/tree/v0.4.4.e2ee

If we see strong demand for TEE E2EE models, we'll integrate more providers based on https://confidentialinference.net/

Pricing note: Tinfoil currently doesn't offer prompt caching or cache-read discounts. Because of this, your prompts are charged at full rate and will feel expensive. This is currently in the works, we hear — stay tuned!

Try It Today

Install Routstrd to build software privately, using a model comparable to frontier closed-source models:

bun i -g routstrd
routstrd onboard        # choose your harness
routstrd receive 6900   # pay with lightning
routstrd top            # see usage stats

Or try the chat app directly: https://chat.routstr.com/?model=tinfoil-glm-5-2

If you face any issues or have feature requests, please tag us here on Nostr: redshift (npub1ftt…edsh) Thefux (npub1ygj…lajc) Jeroen Ubbink (npub1wet…j2dp) npub1tf0aa8wwfjn24hshq0z88txh8w2j2q4xvmfu7x0zqn6xvnpshzuqv2gv5p (npub1tf0…gv5p)