The hybrid that actually works.

Four lessons in, you know where your data goes, what your obligations require, what open models can genuinely do, and what the hardware costs. Now the recommendation, which is the same one almost every Australian business should land on: a hybrid. Sensitive material stays in the building, everything else goes to a good cloud tool set up properly, and a small piece of plumbing in the middle makes the line between them real rather than aspirational.

Sort your information before you sort your tools

Every serious version of this starts the same way, and it isn't with a model. Take your business's information and put it in three buckets.

• Red. Health records, anything privileged, unredacted personal information, credentials. This never leaves the network. Not after a de-identification step, not for a special case, not for the partner who's in a hurry. Red is a hard stop.
• Amber. Internal documents, customer names, commercial terms. Handled locally by default. It can go to a cloud model after identifying details are stripped out, and the fact that it went is logged.
• Green. Public marketing copy, published documents, generic drafting. Cloud permitted, and routed to whichever model is cheapest for the job.

Do this with the people who actually handle the documents, using examples pulled from their own files, in their own words. A classification written by someone who has never opened the filing system produces a document that lives in a shared drive and changes nobody's behaviour. Half an hour with the practice manager and a stack of real examples produces something people can apply on a Tuesday afternoon without ringing anyone.

De-identification is what makes safe cloud use possible

The amber tier is where the value sits, because most business information is amber. The step that unlocks it is de-identification: strip the identifying details before the text leaves your network, keep the originals in your own audit log, and put them back locally when the answer comes home. Done properly, the cloud model sees a useful document with no way of knowing whose it is.

Be careful how this is sold to you. The common open tooling here is a library meant to be customised rather than a turnkey guarantee, and Australian identifiers such as Medicare numbers, ABNs, tax file numbers and matter references generally need recognisers built for them. Anyone who tells you their tool "catches PII" and stops there has not done the work.

So the deliverable is a measurement rather than a claim. Build a labelled test set from the business's own documents, report how much of each identifier type is actually caught, name the residual gaps out loud, and put a human review gate on whatever the tooling misses. The measurement is the product. It's also the thing you can hand to a client, a board or an insurer when they ask how you know.

A gateway, so the red line is a control rather than a hope

Here is the piece that separates a policy from a system. Route every AI request through a single point on its way out, and enforce the rules there. One egress path, one place the decision gets made, one log.

Without it, the red-tier rule is a sentence in a document that depends on every person remembering it while under time pressure. With it, red-tier material physically cannot reach an external model, because the only road out has a gate on it. That's the difference between a policy you can describe and one you can demonstrate.

Log enough at that gate to answer questions later: the query, what was retrieved, the routing decision, which identifiers were masked, and the version of the permission policy that served the request. That last field looks like an afterthought and it is the one that matters most. Months afterwards, someone will ask whether a particular person was allowed to see a particular document on a particular date. Nothing else in a typical log answers that question, and regulators and insurers do ask it.

Why hybrid rather than picking a side

The two pure positions both fail, for opposite reasons, and it's worth being blunt about each.

Pure local disappoints. Long-context reasoning, agentic work and nuanced drafting are exactly where the gap from lesson three shows up, and a team that has been promised a ChatGPT replacement will find the edges within a fortnight. Once people decide a system can't be trusted, they stop checking whether it has improved, and in a small firm three loud early failures can end a project permanently.

Pure cloud fails the confidentiality test on precisely the material where confidentiality is the point. Stripping the names out of a privileged file does not make the underlying material any less sensitive, and the whole reason the red tier exists is that some things stay put.

The hybrid puts each job where it belongs. It's less satisfying than a slogan, and it survives contact with a real week of work, which the slogans do not.

The fact that de-risks the whole decision

If you remember one practical thing from this course, make it this. Every serious local AI stack exposes an OpenAI-compatible endpoint. Anything built against the OpenAI SDK, or n8n, or LangChain, or any tool with a custom endpoint field, works against a local model unchanged.

Moving from cloud to local is a base URL change, not a rewrite. Which means the decision you've been reading about for four lessons does not have to be made today. Pilot in the cloud on green and de-identified amber material, measure your real volumes for a month or two, and move the parts that warrant moving when the evidence is in. You do not need to buy hardware to start, and starting is what produces the numbers that make the hardware question answerable.

Choosing a first project

When a business asks where to begin, the answer is usually the same one.

• Meeting or consult transcription is the best first project. It's the fastest visible win, and it carries the strongest privacy story you'll ever get to tell: the audio never leaves the building, the model is a named file with a checksum, and there is no third party in the chain. For a clinic or a law firm, that is a materially better consent conversation than any cloud vendor can offer.
• Classification and routing has the best economics of anything on the list. A small model, tuned to your categories, sorts a high volume of documents or messages accurately and cheaply, and it's the use case where local hardware most obviously beats paying per token.
• Where a human decides about a person, keep the human deciding. Draft, suggest, summarise, sort. Sign-off stays with someone accountable, and if you are in health or advice that sign-off should be a blocking step in the software rather than a checkbox people tick at the end of the day.

And the warning that will save you the most money. Permissions, not the model, are what sink these projects. The classic failure is a system where the interface looks properly locked down while the retrieval layer knows nothing about who is asking, so someone junior receives a document they should never have seen. Filter before retrieval, never after generation, because once unauthorised content is in the prompt the boundary has already failed. Redacting afterwards is not access control. Budget real time for permissions and treat any plan that skips them as unfinished. If you'd like the sanity check, our free business assessment is a quick way to see where your own gaps sit.

When the answer is to change nothing

The honest ending. If your work is mostly green, your team is ten people, and your tools are on business plans with training switched off and retention understood, then the right answer is the tool you already have. Buying a box in that situation converts a working arrangement into a project, a maintenance obligation and a depreciating asset, and it does not make anything safer.

What that business should do instead is the cheap half of this course: know which plan each tool is on, sort the information into three buckets, write the December 2026 disclosure list, and keep a human on anything that decides about a person. That's a week of attention rather than a capital purchase. The businesses that genuinely need something private know it already, usually because a contract clause, a professional obligation or a regulator put it in writing, and for those the rest of this course is the map. Grab the one-page summary to keep the whole thing in arm's reach, and if you want a written answer for your own firm, that's what we do.