Recommended Free Tools
Neither hosted AI services nor self-hosted models are inherently safer. Hosting changes who operates the model-serving infrastructure and where data is processed; it does not remove the customer’s responsibility for the application, identities, permissions, prompts, retrieved data, and use of outputs. Choose by mapping the actual system and checking which security controls you or your supplier can verify.
How hosted and self-hosted deployments change the risk
An AI system is more than its model. It may include prompts, documents retrieved at runtime, tools, identities, APIs, memory, and conventional software and infrastructure. A model’s security does not secure those surrounding components.
The comparison below describes general tendencies, not guarantees. NIST’s cloud guidance says a deployment model alone does not determine an offering’s security or privacy; controls, policies, and visibility matter. Its SP 800-144 guidance dates to 2011, so use it for these general responsibility concepts rather than as evidence of any provider’s current practices.
| Decision area | Hosted AI service | Self-hosted model |
|---|---|---|
| Infrastructure | The provider operates the model-serving infrastructure; the exact division of work depends on the service and contract. | The organization operates the deployment and model-serving stack unless it outsources that hosting layer. |
| Data boundary | Submitted data is processed in readable form in the provider’s environment. Retention, logging, monitoring, and training use depend on the actual product and terms. | Data can remain within the organization’s boundary if the deployment is there, but architecture, telemetry, integrations, and administrator access affect that boundary. |
| Control and responsibility | There is less direct control over underlying infrastructure. Supplier assurances and service-level controls matter, while the customer still secures its application and data use. | There is more direct control over infrastructure and deployment, alongside responsibility for implementing and operating those controls correctly. |
| Operational work | The provider takes on much of the platform operation. The customer remains responsible for its prompts, retrieved data, identities, permissions, output handling, and monitoring. | The customer also takes on work such as verifying model artifacts, hardening and isolating the deployment, patching, and managing capacity. |
| Model options | Provider-hosted closed models can include the largest models. | Open-weight models can run locally or in a private cloud, but capabilities and operating constraints vary; self-hosting typically does not provide access to the largest models. |
NIST and Microsoft describe responsibility as shifting with the service model: SaaS puts more infrastructure and application operation with the provider, while PaaS splits work and IaaS leaves more security implementation to the customer. Regardless of model, customers retain responsibility for their own data and how it is used.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Security risks shared by both choices
Confidentiality, integrity, and availability
NIST identifies confidentiality, integrity, and availability risks in AI systems, their training and output data, and underlying software and hardware. AI-specific threats include evasion, model extraction, membership inference, and availability attacks. NIST also cautions that current frameworks do not comprehensively address every AI threat or the full attack surface.
Prompt injection and excessive tool access
Retrieved documents and tool outputs can contain untrusted instructions. If an AI agent can use tools with real permissions, a prompt injection may steer it toward consequential actions. Microsoft’s agent guidance also identifies excessive agency, confused-deputy behavior, memory poisoning, and runaway loops as risks to design against.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Limit each tool to the permissions it needs, constrain what it can affect, authorize consequential actions, and require human review for high-impact operations. These controls apply whether inference is hosted or self-hosted.
Changes can undermine earlier evaluations
OWASP AI Exchange recommends versioning and retesting when models, prompts, retrieval sources, tools, policies, or thresholds change. An evaluation only characterizes behavior for the data, threat scenarios, model version, configuration, and context used in that evaluation; it does not prove the system is correct or secure in every situation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #3
How to choose a deployment model
- Map the data and trust boundaries. Record what the system receives, retrieves, stores in memory, and sends to tools. Identify where the model actually runs and who can access each component.
- Set requirements for the real data. Decide what data may be processed, what controls are required, and which data must not leave a particular boundary. Do not assume that a label such as “private instance” means the model itself is isolated.
- Assign every control to an owner. For a hosted service, separate supplier-operated controls from customer controls and check the relevant product terms. For self-hosting, name who validates model provenance, protects artifacts and configuration, hardens and patches the stack, monitors it, and responds to incidents.
- Constrain identities and actions. Determine what the AI application or agent can do through each tool. Use least privilege, check authorization for each consequential action, and decide where human approval is required.
- Define change triggers. Treat a model version, prompt, retrieval corpus, integration, tool, identity, or policy change as a reason to assess whether security testing needs to be repeated.
What evidence to request or verify
Ask for evidence that corresponds to the controls you cannot inspect directly. For a hosted service, establish the data location, retention and deletion rules, logging and monitoring practices, operator access, whether inputs may be used for training, independent assurance, incident handling, and applicable contract terms. For a self-hosted deployment, verify model provenance and artifact checks, host isolation, access controls, network egress, telemetry, patching, monitoring, and incident response.
For either option, ask which controls you can verify yourself and which depend on a supplier’s evidence or contractual commitments. Hosting and privacy terms vary by service, account tier, geography, and time; check current product documentation and the contract before sending sensitive data.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Use a framework as a checklist, not a safety guarantee
OWASP AISVS 1.0, released in June 2026, is a vendor-neutral catalogue of testable security requirements across the AI lifecycle. It contains 191 requirements across 12 chapters and three appendices, covering areas such as training data, model development, deployment, agent orchestration, monitoring, and retirement. Use its requirements to identify who—the supplier, platform operator, or customer—can implement and demonstrate each control.
NIST’s AI RMF materials likewise provide structured risk-management guidance, but NIST notes that existing guidance does not fully address generative AI and some machine-learning attacks. A framework can make review more systematic; it is not proof that a particular system is safe.
What the evidence does—and does not—establish
The cited guidance supports comparing responsibilities, data boundaries, controls, and operational evidence. It does not establish that hosted or self-hosted deployments have lower breach rates overall, nor does it assess any named provider, contract, regulatory regime, or model. A defensible choice comes from the architecture and safeguards of the specific system, not from the deployment label alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
