By KYN AI Advisory Team — AI implementation specialists, Singapore
For most SMEs, a cloud model API under a business contract is the better choice: lower cost at low volume, stronger models, no hardware to run. Self-hosting an open-weight model earns its place in three cases: a rule or contract that forbids data leaving your environment, very high and steady volume, or a narrow task a small model handles well. A third path, a managed model service inside your own cloud account, covers many of the concerns that push teams toward self-hosting.
What are the three options?
- Public cloud API. You send text to a provider's endpoint (Anthropic, OpenAI, Google and others) and receive the result. The provider runs the model.
- Managed model in your cloud account. A service such as Amazon Bedrock or Google's Vertex AI serves models inside your own cloud tenancy, with your identity controls, network rules and logging. The cloud provider hosts the model; your account governs access.
- Self-hosted open-weight model. You rent or buy GPU servers, download a model such as Llama or Mistral, and run it yourself.
Options 2 and 3 are often confused. Option 2 keeps the operational work with the cloud provider and the access control with you. Option 3 puts both on you.
How do they compare?
| Factor | Public API | Managed in your account | Self-hosted | |---|---|---|---| | Setup time | Hours | Days | Weeks | | Model quality | Strongest available | Strong, provider-dependent catalogue | Good; often below frontier models | | Data path | Leaves your environment to the provider | Stays under your cloud account's controls | Stays on your servers | | Cost at low volume | Pay per use, low | Pay per use, low | High fixed (GPU rental) | | Cost at high steady volume | Grows linearly | Grows linearly | Flat per server, can be lower | | Operations burden | None | Low | High: patches, scaling, monitoring | | Exit | Change endpoint | Change model in the catalogue | Change hardware or model |
Pricing for each provider changes often. Read the current page before you decide: Anthropic, OpenAI and Amazon Bedrock publish theirs.
Is self-hosting more private?
It is more controlled, not automatically more private. Ask what privacy risk you are removing.
- Provider reads or trains on your data. Business API terms from the major providers address training and retention. Read the contract and confirm the settings. If the terms meet your policy, this risk is contractual and manageable.
- Data crosses a border. A managed service lets you pick a region. A self-hosted server sits wherever you put it.
- A regulator or client forbids third-party processing. Then self-hosting, or a managed model inside your own account, may be the only compliant option. Check the actual text of the clause.
- A breach at the provider. Real, and shared across their customers. Your own server has a smaller attacker pool but a smaller security team, too.
Self-hosting also moves risk onto you. An unpatched inference server on the open internet is a worse outcome than a business API with a signed data agreement. If nobody on your team will patch it monthly, do not host it.
What does self-hosting really cost?
Count four lines.
- Compute. A GPU instance big enough for a useful model runs continuously, or you pay to start and stop it. At low volume, the idle time dominates the bill.
- Engineering. Someone builds and maintains the serving layer, the queue, the monitoring, the upgrades.
- Quality gap. If a smaller open model gets 85 out of 100 cases right and the cloud model gets 95, the missing 10 cost review time. Measure on your own cases, not on benchmarks.
- Opportunity. New models arrive every few months. A cloud API gives you the upgrade by changing a name. A self-hosted stack needs a migration.
A rough rule: self-hosting starts to pay when your monthly API spend is large and steady enough to fund a dedicated server and a part of an engineer's time. Most SMEs are far below that line. Our own live systems run narrow tasks at a few cents each: a morning report to a department on WhatsApp costs about S$0.05, an outreach email with one checkable first line about S$0.02 and a sorted reply about S$0.01. At that scale an API bill is small. These are KYN figures from live systems, and they depend on model and text length.
When does self-hosting make sense?
Choose it when at least one of these is true.
- A hard rule bars external processing. A client contract, a sector rule or a government requirement says data stays in your environment, and a managed service in your own account does not satisfy the clause.
- Volume is high, steady and predictable. Millions of calls a month on a narrow task that a small model handles well.
- Latency or offline use matters. An on-site system with no reliable connection.
- The task is narrow and measurable. Classification into six labels, extraction from one document type. Small models do well here, and you can prove it with a test set.
Choose cloud when volume is modest, the tasks need strong reasoning or writing, and the contract terms meet your policy.
How do you reduce exposure regardless of choice?
Model hosting is one control among several. These apply to all three options:
- Send less. Strip fields the task does not need. A reply sorter does not need the customer's phone number.
- Mask where possible. Replace names and identifiers with tokens before the call, and swap them back after.
- Log with care. Do not write full prompts to logs that more people can read than the source data.
- Keep the agent's permissions small. See API keys and agent credentials.
- Gate outbound actions. A person approves messages and money moves.
The guide on using AI with internal documents and limiting data exposure covers the first three in more detail.
How do you decide in an afternoon?
- List the data the agent will send to a model. Mark each field personal, commercial-sensitive or public.
- List any contract or rule that restricts where it goes. Quote the clause.
- Check whether a managed model in your own account satisfies the clause. It often does.
- Estimate the monthly call volume and multiply by the provider's current price.
- If the clause is satisfied and the bill is small, choose cloud or managed. If neither satisfies the clause, price a self-hosted server and a maintenance owner, and compare.
Write the result down. A future audit or a client questionnaire will ask for the reasoning.
Where KYN fits
KYN builds systems in a cloud account in the client's name, so a managed model service can sit inside the same account as the database and logs. The choice of model is a configuration decision, not a rebuild, which keeps the decision reversible. Agents have their own restricted accounts, every action is logged with the actor, and outbound messages, money, filings and deletions wait for a named person.
The first 14 days are a review of your stack and interviews with your team, including a data inventory that feeds this decision. A full build ships in under 90 days. See infrastructure and security.
Frequently asked questions
Is a cloud model API safe for customer data?
It can be, under a business contract that restricts training and sets retention, with the right region and access controls. Safe is a property of the contract, the configuration and your own controls, not of the hosting type. Read the terms and test the settings.
Can a small business run a model on its own laptop or server?
Yes, for narrow tasks and low volume, and it suits experiments. For production work that must be available and patched, the support burden usually outweighs the saving. Move to a managed service when the task matters to revenue.
Can I switch later?
Yes, if you design for it. Keep the model name and endpoint in configuration, keep prompts in version control and keep a test set of real cases. Then a change of model is a test run, not a rewrite.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
