Does self-hosting an LLM make my client data automatically compliant with data protection law?

No. Where the model runs matters less than lawful basis, access control, records of processing, and deletion on request. A self-hosted setup can even raise risk if the team lacks the time to patch and monitor it properly. Cedreon keeps every exchange in an append-only, hash-chained audit log, which is the kind of evidence a data protection review usually asks for, regardless of where the model sits.

Can I use cloud AI for information covered by professional secrecy, like a lawyer's or doctor's files?

It depends on your specific duty and your supervisory body, so treat this as a question for your compliance officer rather than a blanket yes or no. Professional secrecy generally means any third party who can see the protected data must be bound and kept under your control, which is hard when raw text goes straight to an outside model. Masking reduces exposure by replacing identifiers with placeholders, so the provider never sees those real values, but it is pseudonymization, not anonymization, and it does not remove the underlying confidential content, which still reaches the provider. For information under professional secrecy, masking is therefore not a substitute for a case-by-case assessment with your supervisory body, and regulators generally expect added safeguards.

Is running an open-source model on a rented cloud GPU the same as self-hosting?

Not really: you control the model weights and the prompts. But the servers, storage, and physical location still belong to the cloud provider, so their security posture and jurisdiction become yours. The running costs and the staffing to keep it patched look a lot like full self-hosting, without the isolation people often assume they are buying. If the goal is keeping identifiers away from any outside party, screening the text with layered best-effort detection before it leaves tends to be the more direct control.

Answers

Self-hosted LLM or masked cloud AI: which protects client data better?

Neither wins on protection alone. A self-hosted model keeps client data inside your walls, but it only protects that data as well as your team patches and monitors everything around it. Masked cloud AI sends text to a frontier model only after detected client identifiers have been replaced with placeholders, and leaves you far less to operate. Which protects better depends on your regulatory constraints and operations capacity, not on a ranking.

The honest case for self-hosting

Run an open-weight model on your own hardware and the data question becomes simple. Prompts never cross your network boundary. There is no provider agreement to trust and no data processing addendum to negotiate. Your inputs cannot reach anyone's training set, because they never leave your network. You control retention, logging and deletion because you run the disks.

For some regulated workloads, that is the requirement and the discussion ends there. If a regulator, a client contract or a professional secrecy obligation flatly forbids sending material to any third party, self-host, and plan the project around that fact.

What it actually costs

The first cost is compute. GPU servers, or rented GPU capacity, sized for a model large enough to do real work. You pay for that capacity whether utilization is 5 percent or 90.

The larger cost is people. Someone has to patch the inference server, the web frontend, the authentication layer and the operating system underneath, and to watch the logs, rotate the keys and test the backups. A self-hosted model behind an unpatched web frontend protects nothing; the client files sit on a machine your own team forgot to update. On premise describes where the risk lives, not who is handling it.

Then there is the capability gap. Open-weight models are good and improving, and for summarization, extraction and routine drafting they may be enough. For complex reasoning, long multi-document analysis, drafting that has to hold nuance, the frontier models are ahead, and your users will notice. Some will notice by pasting the hard questions into a free chatbot on a personal phone, exactly the leak the server was meant to prevent.

When self-hosting is the right call

Self-hosting is the better answer when at least two of these hold:

A hard regulatory or contractual ban on data leaving your infrastructure. No masking scheme satisfies a rule that says the bytes stay home.
Very high volume, where steady per-token cloud pricing eventually crosses the cost of owning the hardware.
An existing ML or platform team that already runs production infrastructure and can absorb one more service.

A firm with the ban but no team should budget for the team, or pay a hosting partner contractually accountable for the stack. The ban does not staff itself.

Strip the identifiers, keep the frontier model

For everyone without a hard egress ban there is a middle path: use the frontier cloud models, but keep detected client identifiers from reaching them. Names, account numbers and addresses are detected and replaced with placeholders before the text leaves; the model works on the masked version; the real values are swapped back in locally. Detection combines pattern matching with machine recognition and is best-effort, so treat it as a strong reduction of exposure, not a guarantee. Doing this by hand is possible but tedious, and it breaks down as soon as more than one person needs to do it consistently. how to anonymize data before using ChatGPT walks through the manual version.

Two things complete the setup. Provider terms that exclude training on your inputs, covered in which AI tools don't train on your data, and an audit log that records what left and what was replaced first. The log matters as much as the masking. When a client asks what the provider saw, a record beats an assurance.

The failure mode to avoid

This is a constraint question. If the egress ban is real, self-host and staff it properly. If it is not, masked cloud usually protects client data better, because the security work is done by people whose whole job it is. The outcome to avoid is the middle: a half-staffed self-hosted deployment that gives weak answers and weak security. That setup loses on both axes while feeling safe.

How Cedreon approaches this

Cedreon, developed in Switzerland, is the masked-cloud path built as a workspace. You chat with AI models from Anthropic and OpenAI and upload Word, Excel and PDF files, and answers point to the source passage in the file.

Before any text leaves for the model provider, Cedreon screens it with pattern masking plus layered machine detection. Identifiers it finds (names, IBANs, addresses) are replaced with placeholders. The originals stay in an encrypted vault on Cedreon's side, and the reply is filled back in for the signed-in user. The provider never sees the vaulted values, though detection stays best-effort, so review remains part of the job.

Every exchange lands in an append-only, hash-chained audit log, so a firm can show exactly what left the house and what was replaced first. Admins and users can also write plain-language guardrails (block, warn or flag) that run on every chat. It will not satisfy a hard egress ban; for firms without one, it keeps the frontier models while masking what it detects, with evidence to show for it. Pricing starts at CHF 29.90 per user per month, and you can Try Cedreon free.

Common questions

Does self-hosting an LLM make my client data automatically compliant with data protection law?: No. Where the model runs matters less than lawful basis, access control, records of processing, and deletion on request. A self-hosted setup can even raise risk if the team lacks the time to patch and monitor it properly. Cedreon keeps every exchange in an append-only, hash-chained audit log, which is the kind of evidence a data protection review usually asks for, regardless of where the model sits.
Can I use cloud AI for information covered by professional secrecy, like a lawyer's or doctor's files?: It depends on your specific duty and your supervisory body, so treat this as a question for your compliance officer rather than a blanket yes or no. Professional secrecy generally means any third party who can see the protected data must be bound and kept under your control, which is hard when raw text goes straight to an outside model. Masking reduces exposure by replacing identifiers with placeholders, so the provider never sees those real values, but it is pseudonymization, not anonymization, and it does not remove the underlying confidential content, which still reaches the provider. For information under professional secrecy, masking is therefore not a substitute for a case-by-case assessment with your supervisory body, and regulators generally expect added safeguards.
Is running an open-source model on a rented cloud GPU the same as self-hosting?: Not really: you control the model weights and the prompts. But the servers, storage, and physical location still belong to the cloud provider, so their security posture and jurisdiction become yours. The running costs and the staffing to keep it patched look a lot like full self-hosting, without the isolation people often assume they are buying. If the goal is keeping identifiers away from any outside party, screening the text with layered best-effort detection before it leaves tends to be the more direct control.