Before You Cancel That API Plan for Ollama, Run This Checklist
Why Everyone's Suddenly Talking About Local Models
Are you paying for an API plan you could replace with a model running on your own machine? Are you doing that math right now because of something you read about Microsoft Copilot?
Good instinct on the timing. 2026 has been a rough year for hosted AI platforms. Multiple Copilot vulnerabilities this year involved data exfiltration through single-click links, the kind of thing that gets forwarded around security teams with a lot of exclamation points. When a hosted platform you don't control has a bad month, self-hosting starts looking like the responsible choice instead of the paranoid one.
Ollama is the obvious answer people land on. It runs OpenAI-compatible endpoints, so swapping it in for a paid API plan is mostly a matter of changing a base URL. For high-volume inference, the cost case is real too. Self-hosting open-weight models becomes cheaper than API billing somewhere around $20,000 a month in spend, according to analyses from earlier this year. Below that line, you are probably paying for convenience, and that is a fine trade to make with your eyes open.
But swapping hosted risk for local risk is not the same as eliminating risk. It just moves where the exposure lives, and most people setting up Ollama for the first time have no idea where that new exposure is.
The Open Door Nobody Warns You About
Here is the part that gets skipped in the excitement. Ollama's API has no authentication. None. No login, no API key, no rate limiting, no allow-list. Anyone who can reach port 11434 can run a model, pull a new one, or delete what you have installed. There is no lock on this door because Ollama was never built assuming the door would face the internet.
That distinction matters more than people think. Local does not mean private. Local just means the software is running on hardware you own. Whether anyone else can talk to it depends entirely on how you configured the network around it, not on the word "local" doing any protective work by itself.
Scanners find these things fast. Shodan had indexed more than 14,000 unauthenticated public Ollama instances as of April 2026, and exposed servers typically get abused within hours of showing up online. Hours, not weeks. Someone sets OLLAMA_HOST to 0.0.0.0 to get their laptop and their server talking to each other, forgets that also opens the API to the entire internet, and by the next morning a stranger has pulled a different model onto their box or is running inference on their GPU for free.
The fix is not complicated. Knowing you need it is the part everyone skips.
The Binding and Firewall Checklist
Start with the listener itself. Ollama should bind to 127.0.0.1:11434, not 0.0.0.0. That one setting is the entire ballgame. If you need remote access, you tunnel to it, you do not open it up and hope for the best. VPS hosting guides from July repeat this same instruction over and over: never set OLLAMA_HOST=0.0.0.0. There is a reason it keeps getting repeated. People keep doing it anyway.
Check both listeners, not just one. IPv4 gets all the attention, but IPv6 is often left wide open because nobody remembered to look. A firewall rule that blocks one and ignores the other is not a firewall rule, it is a false sense of security.
If you are running Ollama in Docker, do not publish the port with -p 11434:11434 unless you actually mean to expose it. That flag is the container equivalent of setting OLLAMA_HOST to everyone. Keep it internal to the container network and let a reverse proxy handle anything that needs to reach the outside.
Put nginx or Caddy in front of the API if outside access is genuinely required, and let the proxy handle authentication, since Ollama will not do it for you.
Then test it. From a device that is not yours, try hitting /api/version. If it answers, you are not done yet.
When Self-Hosting Actually Pays Off
So back to the math. The $20,000-a-month line from those April analyses is the actual threshold where self-hosting starts winning on cost, not the moment you get spooked by a headline about a Copilot exploit. If your API bill is nowhere near that, the security checklist still matters, but the financial argument for switching is weaker than it feels in the moment.
Most small teams do not need to pick a side. Ollama's own Cloud Pro tier, starting at $20 a month as of the June release, sits in the middle. You get larger models than your hardware could reasonably run, without opening port 11434 to anything, and without paying full API rates either. It is a reasonable landing spot for someone who wants the OpenAI-compatible interface and the cost control but does not want to own a firewall configuration as a permanent job responsibility.
The decision tree is not complicated once you strip the hype out of it. High volume, sensitive data, and a team that can actually run the binding and firewall checklist correctly: self-host. Moderate volume and you just want off the metered API treadmill without babysitting a server: the cloud tier. Low volume and occasional use: honestly, keep the API plan a while longer and revisit the math when your usage graph starts climbing.