We've been running a 70B-class open model for internal copilots and the cost story is great, but I'm uneasy about data leakage through fine-tuning and the lack of a real red-team story. Curious how others decide what workloads are safe for self-hosted models versus API-only. What's your policy — and what made you set it there?