Rent the brain or own it: the safest AI setup is the one with nobody left to trust.

Illustration: AI-generated, art-directed by the author.

In bringing the AI to your data I made the case for exactly that: retrieval inside your walls, a rented model answering from passages it is handed and contractually forbidden from learning. For most companies, most workloads, that is the right floor.

This one is about the rung above it, the one people mean when they say self-hosting: open-weight models running on hardware you control. It is the right answer less often than its advocates claim and more often than its dismissers admit, and the way to tell the difference is to be honest about two things: the economics and the trust math.

The trust math first, because it is the cleaner argument

Walk up the ladder and count who you have to trust at each rung.

Public chatbot: you trust the provider's consumer terms, its retention, its training defaults, and every employee pasting into it. That rung is how you get the shadow AI problem.

Enterprise API or private cloud deployment: much better. Your data is vectorized in your own store, the model is stateless, and the contracts say your content is never trained on. But notice what the safety rests on: promises, made by a third party, enforced by audits and lawyers. A processor still exists. Their logs, their abuse monitoring, their subpoena surface.

Self-hosted: the model's weights sit on your hardware. Your documents are vectorized in your store, retrieved by your code, read by a model that runs where they live. Nothing crosses your perimeter at inference time. And here the safety argument changes kind: it stops being a promise and becomes an architecture. There is no third-party processor to trust, audit, or compel, because for that workload no third party ever touches the data. In data-protection terms, the entire apparatus that exists to manage outside processors collapses for the simple reason that there is no outside.

That is the cleanest version of the point: vectorized, never trained on, and never leaving your hardware is not a stronger promise. It is the absence of the need for one.

One honesty clause, before the security team celebrates: you did not delete the risk, you repatriated it. Patching, access control, key management, and model updates are now your job. Self-hosting removes the vendor you must trust and replaces it with a discipline you must maintain.

I run a split stack for exactly this reason, and the split is smaller than people expect. The workloads reading anything I would not want quoted back to me run on hardware I control. Everything else, the drafting, the classifying, the summarizing, rents a frontier model, because for that work the quality gap is real and the leak cost is close to zero. Deciding which pile a workload belongs in took an afternoon. Maintaining the owned pile is the part that never ends, and it is the cost nobody quotes you.

The safety argument stops being a promise and becomes an architecture.

Now the economics, without the ideology

The market data cuts against the romantic version of self-hosting. Menlo Ventures' enterprise research puts open-weight models at 11% of enterprise LLM workloads in 2025, down from 19% the year before, while enterprise API spend exploded. Frontier rented models got better faster than local ones got cheaper, and most companies followed quality.

The break-even math is workload-shaped, and the practitioner estimates disagree wildly: anywhere from a few million tokens per month (against premium API pricing) to hundreds of millions (against budget models), before counting the real costs: GPUs, and the engineering time that can run into hundreds of thousands a year. Anyone who gives you a single break-even number is selling something.

But the disagreement itself points at the sane strategy, because both camps agree on the shape: self-hosting pays when volume is high and steady, when the tasks are routine enough for open-weight quality, or when the data is sensitive enough that the trust math outranks the spreadsheet. Which describes a specific slice of most companies: the sensitive core. Contracts, health records, deal flow, source code: the documents whose leak cost is unbounded.

So the pattern that actually works is not "self-host everything." It is a split stack: own the brain that reads the crown jewels, rent the brains for everything else, and route between them (the token bill covers why routing is a 5-to-10x lever anyway). The 11% market share is not evidence self-hosting failed. It is roughly the size of the slice that deserves it.

Notice that this decision cannot be made once, for the whole company, by the people who sign the licence. It is made per tool, by someone who knows what that tool reads. The assistant answering HR questions and the one answering finance questions do not deserve the same answer here, which is the practical reason one tool per job beats one assistant for everybody.

Self-hosting does not remove the risk. It makes the risk your job.

The playbook, one rung at a time

1. 01Classify first. Which documents have unbounded leak cost? That list, usually far shorter than people expect, defines the self-hosted workload. Everything else stays on rented, contracted, private-cloud rails.
2. 02Pilot on one workflow, small model, real hardware. A single GPU box or reserved cloud instance running an open-weight model against your sensitive corpus. Modern open models are past the "toy" era for retrieval-and-summarize work.
3. 03Do the honest ledger. Hardware, engineering hours, and the quality delta versus the rented flagship, measured on your tasks, not benchmarks. If the delta is big, the crown-jewel workload may need to stay rented-but-private, and that is a finding, not a failure.
4. 04Reuse everything from [bringing the AI to your data](/blog/bring-ai-to-your-data). Permissions mirrored into retrieval, every query logged, retention deliberate. Self-hosting changes where the model runs, not the discipline around it.
5. 05Revisit yearly. Open-weight quality moves fast. The slice that deserves self-hosting will grow or shrink; let the ledger decide, not the ideology.

The close your security team should staple to the budget request

Every other AI safety measure your company will discuss this year is a promise: a contract clause, a policy, a vendor certification. Promises are good. Architecture is better.

For the documents that could end you, the question is not "which vendor do we trust most." It is "why is trust still in the sentence." The safest AI setup is the one with nobody left to trust, and for your most sensitive ten percent, it is finally cheap enough to build.