The European alternative to LiteLLM

Why do teams in the EU look for an alternative to LiteLLM?

Because LiteLLM hands the work to you and still leaves open where your prompts go. LiteLLM is an open-source gateway that runs on your own servers, and in LiteLLM's own words it operates "on your servers with your provider keys and contracts" (About LiteLLM). The gateway can sit in Frankfurt or Amsterdam, but every prompt still travels to the provider you configured, under that provider's contract and that provider's law.

LiteLLM's own pages, checked on 27 October 2026, show what self-hosting asks of a team:

• You keep it running. LiteLLM's shared responsibility model makes you the owner of "uptime of your instance and the infrastructure under it" and of "your provider accounts, quotas, and provider-side outages" (shared responsibility).
• You keep it patched. LiteLLM ships fixes only for the four most recent stable minor lines and releases a new line about every week; older lines get no updates (version support). Staying supported means upgrading roughly every month.
• You sign every provider yourself. Self-hosted LiteLLM sends no personal data to LiteLLM's servers (data security). That keeps the vendor out of your data flow, and it leaves the paperwork with you: each provider behind the gateway is its own contract and DPA, and a US provider is also its own transfer assessment.
• The gateway holds your keys. "LiteLLM sits in the path of your model traffic and holds your provider keys," as LiteLLM's security page puts it. Whoever controls the gateway controls every provider account behind it.

EUrouter takes that work off your team. EUrouter B.V. is an Amsterdam company under Dutch law that runs the router on Scaleway in Amsterdam. One DPA covers the router and every provider behind it: the AI providers are EUrouter's sub-processors, bound to the same obligations, and EUrouter stays fully liable for them (EUrouter DPA, section 7). Prompts, completions and API metadata are processed only in the EEA (section 5).

Does a self-hosted gateway keep your AI traffic in the EU?

Only when every provider behind it is in the EU. Hosting a gateway in an EU region decides where the gateway runs, not where the prompt is processed. LiteLLM forwards each request to the provider you configured, out of 140+ providers and 1,892 models (About LiteLLM). Point it at a US company's API and the prompt goes to that company, wherever your gateway sits.

That matters because US law follows US companies, not servers. The CLOUD Act obliges a US provider to hand over data in its possession, custody or control, wherever that data is stored (18 U.S.C. § 2713). An EU region of a US cloud doesn't change who the company answers to.

EUrouter builds the EU rule into the router. By default every request goes only to providers with EU-hosted endpoints, fallbacks stay inside that set, and eu_owned: true limits a request to providers headquartered in the EEA (routing docs). You don't have to audit a config file to know where a prompt went.

What happened in the LiteLLM supply chain attacks?

LiteLLM disclosed two supply chain incidents in 2026, in which attackers published malicious LiteLLM releases built to steal credentials. Both were found and pulled within hours, and LiteLLM published what happened:

• 24 March 2026. The PyPI releases litellm 1.82.7 and 1.82.8 contained a credential stealer that harvested environment variables, SSH keys, cloud credentials and Kubernetes tokens. They were live for about 40 minutes before PyPI quarantined them, and the official proxy Docker image was not affected. LiteLLM traced the compromise to the Trivy scanner in its CI pipeline (LiteLLM incident post). Datadog Security Labs links it to a wider campaign that also hit Trivy, Checkmarx and the telnyx package (Datadog).
• 21 October 2026. A malicious litellm 1.107.0 was published to PyPI for about two hours, and to Docker Hub and GHCR under tags including latest and main-stable for up to two hours and 35 minutes. LiteLLM says it "contained compiled malware which steals credentials and loads remote-code execution tools", and its advice to affected users includes rotating every provider key stored in the proxy database (incident post, root cause analysis). Enterprise customers on LiteLLM's private registry were not affected.

LiteLLM has since rebuilt its release pipeline and signs its images (LiteLLM security). For an EU team the lesson is about who carries the risk. With a self-hosted gateway, pinning versions, following advisories and rotating every provider key is your job. With EUrouter there is no gateway package on your servers and no provider keys in your environment: your apps hold EUrouter keys, and each one can be capped, disabled or revoked on its own (budgets and limits).

What do you get with EUrouter instead?

EUrouter gives you what teams use LiteLLM for, one OpenAI-compatible API in front of many models, as a European service: a European company, European infrastructure and European providers, without a gateway to run.

One company and one DPA for the whole path

Your legal team reviews one agreement instead of one per provider. EUrouter's DPA is governed by Dutch law, promises breach notice within 48 hours (section 9), and keeps a public provider and sub-processor list with 10 business days' notice before a new sub-processor is added (section 7). The current list, dated 9 October 2026, is on the DPA page.

Nothing to host, patch or upgrade

EUrouter runs and patches the router itself. When a provider fails, EUrouter retries another EU-hosted provider of the same model, so availability doesn't depend on your on-call rotation (routing docs).

European providers, with the controls in the request

On 27 October 2026 the EUrouter catalog listed 17 providers, 15 of them headquartered in the EU, among them Mistral AI, Scaleway, OVHcloud, IONOS and Nebul (providers). 101 of its 154 models are served by at least one EU-headquartered provider. GPT models come from Microsoft Foundry and Claude models from AWS Bedrock, both in EU regions; both are US companies, so eu_owned: true excludes them when your policy asks for European companies only. data_residency pins a region or a country, such as de, and max_retention_days: 0 keeps a request on zero-retention providers.

Mistral models on European providers:

Open models from DeepSeek, Qwen and GLM, served by European providers:

Every model, with its providers and prices in euros, is in the EUrouter model catalog.

The gateway features you rely on

Per-key spend caps in euros with daily, weekly or monthly resets replace virtual-key budgets (budgets and limits). Request logs show the model, provider, tokens, cost and fallbacks of every call, and Broadcast (beta) forwards traces to Langfuse, Datadog, PostHog or an OpenTelemetry Collector (monitoring).

How do you switch from LiteLLM to EUrouter?

Switching from LiteLLM to EUrouter means pointing your clients at https://api.eurouter.ai/api/v1 with an EUrouter key and using EUrouter model IDs. What lived in LiteLLM's config.yaml moves into the request or the dashboard.

1. Create a free account at EUrouter sign-up and create a key under API Keys. EUrouter keys start with eur_ (quickstart).
2. For apps that call your LiteLLM proxy through the OpenAI SDK, replace the proxy URL with https://api.eurouter.ai/api/v1 and the virtual key with your EUrouter key.
3. For code that calls litellm.completion, prefix the EUrouter model ID with openai/ and set api_base to the EUrouter URL, as LiteLLM documents for OpenAI-compatible endpoints.
4. Map each alias in your model_list to a catalog ID from the model catalog or GET https://api.eurouter.ai/api/v1/models.
5. Recreate team budgets as per-key spend caps, and set eu_owned or max_retention_days per request or once as a routing rule for the whole account.

With the OpenAI SDK:

import os

from openai import OpenAI

client = OpenAI(
    base_url="https://api.eurouter.ai/api/v1",
    api_key=os.environ["EUROUTER_API_KEY"],
)

response = client.chat.completions.create(
    model="mistral-large-3",
    messages=[{"role": "user", "content": "Explain a data processing agreement in one sentence."}],
    extra_body={"provider": {"eu_owned": True, "max_retention_days": 0}},
)

print(response.choices[0].message.content)

With the LiteLLM Python SDK, if you'd rather keep it in your code:

import os

import litellm

response = litellm.completion(
    model="openai/mistral-large-3",
    api_base="https://api.eurouter.ai/api/v1",
    api_key=os.environ["EUROUTER_API_KEY"],
    messages=[{"role": "user", "content": "Explain a data processing agreement in one sentence."}],
)

print(response.choices[0].message.content)

Can you keep LiteLLM and put EUrouter behind it?

Yes. If your platform team relies on LiteLLM's virtual keys, team budgets or MCP gateway, keep LiteLLM and make EUrouter its upstream. LiteLLM keeps handing out internal keys; EUrouter makes sure every request lands on an EU-hosted provider, under one DPA.

model_list:
  - model_name: mistral-large
    litellm_params:
      model: openai/mistral-large-3
      api_base: https://api.eurouter.ai/api/v1
      api_key: os.environ/EUROUTER_API_KEY
  - model_name: mistral-small
    litellm_params:
      model: openai/mistral-small-3.2-24b
      api_base: https://api.eurouter.ai/api/v1
      api_key: os.environ/EUROUTER_API_KEY

The provider keys leave your LiteLLM database: the only upstream secret is the EUrouter key. LiteLLM itself still runs on your servers, so keep it pinned and patched. The full setup is on the LiteLLM integration page.

What other European options are there?

Besides EUrouter, three hosted services keep AI traffic in Europe:

• Cortecs (Vienna, Austria): an LLM router whose Sovereign Cloud option uses only providers established in the EU (cortecs.ai).
• Eden AI (Lyon, France): a unified AI API whose EU endpoint processes prompts, files and outputs only in the EU (Eden AI EU endpoint).
• Opper (Sweden): a hosted AI gateway with 700+ models, whose shared platform runs on AWS in Stockholm (Opper).

Other self-hosted gateways, such as Portkey's Gateway, Bifrost and Helicone, change the software, not the work: like LiteLLM, they run in your account and you contract every provider behind them. If your team wants to operate its own gateway and has no rule about where providers process prompts, LiteLLM is built for that.

Start in Europe today

Create a free account, point your client or your LiteLLM config at https://api.eurouter.ai/api/v1, and your next request runs in Europe. Create a free account, read the routing docs, or talk to us about your DPA review.