Local when it must be, cloud when it can be

Self-hosting everything is expensive and hard to keep at frontier capability; sending everything to a cloud API is often not permissible and, as EchoLeak showed, not risk-free. The practical answer is hybrid: route by classification and need, local for sensitive work, cloud when the data and the task allow.

1. The two bad extremes. All-local (costly, capped) versus all-cloud (often not allowed).
2. Routing by classification. A decision layer that decides local versus cloud per request.
3. The economics. GPU cost and latency of local inference versus per-token cloud pricing.
4. Failing safe. What happens when the cloud path is unavailable or disallowed.
5. Keeping it swappable. Avoiding lock-in at the routing layer.

An architecture and cost piece. It shows we design for the real constraint set (budget, latency, classification) rather than selling a single fashionable answer, reinforcing the vendor-agnostic, sovereign-first, fixed-price stance.

• Frame around cost and latency trade-offs, not a threat.
• Make the routing decision layer the centrepiece.
• Reference EchoLeak as the why-not-everything-to-cloud point.
• Stress swappability and no lock-in.