Last updated May 24, 2026

Trust is part of the API surface.

Waterfall is an independently operated LLM router. If you point an agent at it, Waterfall sits in the request path. This page explains what is running, what is logged, what is not ready yet, and what you should not send.

Current trust status

Plain status, no trust theater.

Available now

OpenAI-compatible API, free_smart routing, prepaid credits, x402 support, model catalog, strategy docs, API-key file scoping.

Documented now

Logging policy, privacy cautions, architecture overview, security controls, current limitations.

Planned next

Bring-your-own provider keys, public routing test cases, named community testimonials with permission, dedicated security contact.

Architecture

What happens to a request

Waterfall is a routing layer, not a model lab. The service normalizes requests, chooses a provider/model path, records usage, and returns the provider response.

API edge

Requests enter through the OpenAI-compatible Waterfall API at https://api.getwaterfall.org/v1. API-key traffic and verified x402 payment traffic are checked before model requests are accepted.

Routing layer

The router evaluates the requested model, routing strategy, tool needs, context size, and cost constraints, then selects a capable provider/model path.

Provider call

Waterfall forwards the normalized request to the chosen upstream model provider and returns an OpenAI-style response to your client.

Logging

Explicit logging and retention policy

These are the practical data categories that matter when you put an API router between an agent and a model provider.

API keys
Raw keys are used for authorization. Operational code should treat keys as secrets; auth and ownership checks use API-key identity, and public surfaces should never expose raw keys.
Request metadata
Timestamps, selected model, routing strategy, token counts, cache-hit status, credit/budget effects, and provider errors may be logged for billing, debugging, and reliability.
Prompt content
Prompt text is forwarded to the selected provider. Waterfall does not need prompt text for normal analytics, but deterministic requests can be keyed by a prompt hash for cache lookup.
Responses
Low-temperature deterministic responses may be cached for cost and reliability. The current cache TTL is 24 hours by default.
Uploaded files
Files require an API key, are scoped to the uploading key, and can be deleted through the file API. File listings do not expose local server paths.
Security events
Upload rejects, upload successes, rate-limit events, and operational errors may be logged with filenames, content type, size, and reason codes.

The safe default is to assume prompts and outputs can pass through both Waterfall and the selected upstream provider. Do not put secrets into prompts unless you have verified the whole route.

Privacy

What not to send

Free access should not require pretending every workload is safe for every route. Some data needs a direct provider contract and compliance review.

Read privacy notes in docs

Do not send private keys, wallet seed phrases, production credentials, Discord tokens, or customer secrets through any router.

Do not send PHI, legal work product, or regulated data unless you have verified the full provider path and have the agreements you need.

Use privacy-oriented strategies only as routing help. They are not a substitute for a BAA, DPA, SOC 2 report, or enterprise compliance review.

Assume the selected upstream model provider processes your request according to that provider path and its terms.

Security

Security controls

The current focus is basic but important: do not let unauthenticated callers use paid paths, read files, trigger admin tools, or reach internal proxy credentials.

Model, billing, file, performance, and monitoring endpoints are gated by API key, verified x402 payment, or admin token as appropriate.

Uploaded files are owned by the API key that uploaded them; other keys cannot list, read, process, or delete those files.

The LiteLLM proxy is intended to sit behind the Waterfall API and uses a non-default internal token.

The public API is designed for HTTPS access through api.getwaterfall.org, not direct access to internal services.

Security-sensitive admin endpoints are not public product surfaces.

Dependency audits are tracked, with high/critical production issues prioritized over risky framework downgrades.

Routing transparency

The catalog stays broad, but strategies stay curated. New models can be listed before they are trusted for a strategy.

free_smart prioritizes free, tool-capable models for agents and high-volume work. Other strategies optimize for context, privacy, voice, embeddings, reranking, safety, or quality.

View model catalog
Bring your own keys
Planned

Waterfall is designed to move toward user-controlled provider credentials for people who want Waterfall routing without handing over provider trust.

Until BYOK is shipped, use Waterfall keys and credits only for workloads that fit this trust model.

Community proof
Permission required

Named testimonials will only be published with explicit permission from known community members.

Anonymous reactions are not a substitute for trust. This section will stay empty until there are quotes people are comfortable standing behind.

Business identity

Who operates Waterfall

Waterfall is a bootstrapped commercial service operated by Julie Bush. The free smart-routing option exists because cheap model access matters, especially for builders who cannot casually burn money on agent experiments.

The business goal is straightforward: offer a useful public router, keep pricing transparent, and make money through efficient routing, caching, and a small markup on paid usage rather than through hidden credit fees.

Commercial service

Waterfall is not a neutral public utility. It is a real commercial API service with a free routing option for public use.

Transparent constraints

No SOC 2, HIPAA, enterprise SLA, or third-party audit is claimed here. Those will be listed only when they exist.

Security contact

A dedicated security contact is being set up. Until then, do not post exploit details publicly; use a private channel with Julie or a non-sensitive GitHub issue for coordination.

Use safely

A good router still needs a good threat model.

If you are using Waterfall for public prompts, coding help, agent experiments, free-model fallback, or cost-aware routing, this trust model may be a reasonable fit. If you are handling secrets, regulated records, unreleased customer data, or production credentials, use a direct provider path until the required controls are in place.