17 September 2026 · 6 min
The actual question
Most teams do not have an AI strategy. They have a handful of people pasting text into a browser and hoping the terms of service are kind. For a public blog post that is harmless. For a patient record, a bid, or a staff file, it is a transfer of personal data to a company you do not contract with.
Self-hosting is not a religion. It is a decision about where the tokens go. If the model runs in your tenancy, on hardware you can name, you can write an access log, a retention rule and an incident plan. If it runs in a consumer product, you have a screenshot and a prayer.
What we actually host
A useful self-hosted setup is smaller than the slide decks suggest. One model that does one job: classify documents, draft against a private corpus, extract fields from a form. Retrieval over your own files, not the open web. Identity in front of it. No training on prompts unless you chose that, in writing.
The work is the plumbing: GPU or reserved CPU that finance can see, a private network, evaluation so you know when the answers drift, and a human who owns the runbook. That is the same discipline we use on any production model in Leamington Spa.
When not to self-host
If the data is already public, or the question is generic, a contracted API with a data-processing agreement can be enough. Do not spend six weeks standing up a cluster to rewrite meeting notes. Do spend it before you let a frontier model see casework.
Related service: AI & machine learning