When Self-hosted / on-premise AI models fits
- Your primary concern is model-provider access. Self-hosting closes that gap completely.
- Your compliance environment requires model weights to be stored on-premises (certain FISMA, CMMC, or air-gapped scenarios).
- You need to run inference offline or within a private network perimeter.
When Locke fits
- Your team uses browser-based AI tools (ChatGPT, Claude, Gemini) in addition to any self-hosted deployment, which covers only the on-prem endpoint.
- Sensitive data still flows into your self-hosted model in plaintext and may be logged on your own servers.
- You want to prevent specific data categories from entering the model context at all, regardless of where the model runs.
Side-by-side
| Dimension | Locke | Self-hosted AI |
|---|---|---|
| What it protects against | Data entering any model context, through on-device masking before transmission. | Model-provider access to your prompts: the provider never sees them. |
| Does sensitive data leave the device? | No. Masked before any network call is made. | Yes. The full prompt goes to your self-hosted server in the clear. |
| Coverage of browser AI tools | Same controls on ChatGPT, Claude, Gemini, and other browser-based interfaces. | None. Only covers the self-hosted endpoint. |
| Prompt log risk | Logs contain only the masked version. | Your own server logs may contain raw sensitive data. |
| Best for | Controlling what enters any model context, from any interface. | Eliminating model-provider visibility and third-party data retention. |
Bottom line
Self-hosting and Locke cover different parts of the threat model and work well together. Self-hosting removes provider-side risk. Locke removes device-to-model risk by masking sensitive fields before they enter any model's context, wherever that model runs.
