Comparisons
COMPARISON
Locke vs Self-Hosted and On-Premise AI
Running your own model — Ollama, LM Studio, a private API deployment, a VPC-hosted endpoint — removes one risk: the provider can no longer read your prompts. That's a real improvement. It doesn't remove the risk of sensitive data flowing through the model context, sitting in your own request logs, or escaping through the browser-based AI tools your team still uses. Self-hosting changes who can see the data, not whether it can be seen.
When Self-hosted / on-premise AI models fits
- Your primary concern is model-provider access — self-hosting closes that gap completely.
- Your compliance environment requires model weights to be stored on-premises (certain FISMA, CMMC, or air-gapped scenarios).
- You need to run inference offline or within a private network perimeter.
When Locke fits
- Your team uses browser-based AI tools (ChatGPT, Claude, Gemini) in addition to any self-hosted deployment — self-hosting covers only the on-prem endpoint.
- Sensitive data still flows into your self-hosted model in plaintext and may be logged on your own servers.
- You want to prevent specific data categories from entering the model context at all, regardless of where the model runs.
Side-by-side
| Dimension | Locke | Self-hosted AI |
|---|---|---|
| What it protects against | Data entering any model context — on-device masking before transmission. | Model-provider access to your prompts — the provider never sees them. |
| Does sensitive data leave the device? | No — masked before any network call is made. | Yes — full prompt sent to your self-hosted server in the clear. |
| Coverage of browser AI tools | Same controls on ChatGPT, Claude, Gemini, and other browser-based interfaces. | None — only covers the self-hosted endpoint. |
| Prompt log risk | Logs contain only the masked version. | Your own server logs may contain raw sensitive data. |
| Best for | Controlling what enters any model context, from any interface. | Eliminating model-provider visibility and third-party data retention. |
Bottom line
Self-hosting and Locke cover different parts of the threat model, and work well together. Self-hosting removes provider-side risk. Locke removes device-to-model risk — masking sensitive fields before they enter any model's context, wherever that model runs.
