When you call a hosted model API, the provider runs the serving stack, but you still own your keys, prompts, data sent, output handling, and agent permissions. When you self-host, you also own patching the runtime, network isolation, tenant separation, and model file provenance. Neither choice moves your application security to someone else.
The responsibility table
| Task | Hosted API | Self-hosted |
|---|---|---|
| Patch the serving runtime | Provider | You |
| Secure network ports and cluster traffic | Provider | You |
| Verify model file provenance | Provider | You |
| Protect your API keys | You | You |
| Decide what data goes into prompts | You | You |
| Handle model output safely in your app | You | You |
| Limit what agents and tools can do | You | You |
| Contract terms on retention and training | You, by reading and negotiating | Not applicable |
| Tenant isolation between your customers | You | You |
| Dependencies in your own application | You | You |
What self-hosting adds
Self-hosting hands you the runtime's security posture. The vLLM guide says multi node traffic is unencrypted and unauthenticated by default, that some endpoints sit outside its API key, and that multi tenant isolation is not provided so separate instances or a gateway are the answer. Ray's documentation says isolation must be enforced outside the cluster. Those are tasks a hosted API provider would otherwise handle.
You also take on model supply chain. OWASP's LLM03 guidance says to use models from verifiable sources and check signatures and file hashes.
What hosting keeps with you
Even with a hosted API, OWASP's 2025 list still applies to your app: prompt injection, sensitive information disclosure, improper output handling, excessive agency, and unbounded consumption are all decided in your code and configuration. Provider terms matter too, and OWASP lists unclear vendor data policies as a supply chain risk, so read the retention and training terms and record them in your subprocessor list.
How to decide
Choose by data sensitivity and team capacity, not only by cost. If a buyer needs data to stay in a specific boundary and no hosted option fits, self-hosting may be necessary, and you should plan staffing for patching it. If you have no one to patch a GPU stack, a hosted API with careful data minimisation is often the lower risk path.
A short note on Safeguard
Whichever you choose, Safeguard offers SBOM and dependency scanning for the code you own, and compliance and evidence automation to record who does what. Try a free scan at gold.safeguard.sh/scan.
Quick check
Does a hosted API make us compliant for AI risk?
No. Provider controls cover the provider's part. Your application, data choices, and agent permissions remain yours.
Is self-hosting more secure?
Not by itself. It gives control and adds work. It is safer only if you patch, isolate, and monitor it.
Sources
- vLLM security guide
- Ray security documentation
- OWASP Top 10 for LLM Applications 2025
- OWASP LLM03:2025 Supply Chain
Last reviewed: 19 October 2026.
