Take a workflow that chases purchase order acknowledgments. It reads every supplier reply: part numbers, unit prices, promise dates, revision levels. Point the same tooling at supplier corrective actions and it reads the nonconformance description and the 8D. Put it in front of quoting and it reads the customer’s drawing.
That reading list is the plant’s intellectual property. Pricing tells a competitor your cost position. Nonconformance history tells them where your process is weak. And in a contract shop the drawing usually isn’t yours at all. It’s your customer’s, and the NDA you signed to get it says who else may see it.
Every call to a hosted model sends that text to somebody else’s servers. Don’t send it. Run the model inside the building.
01What the Contract Promises
Start with the easy case. In April 2023 CIO Dive, citing The Economist Korea, reported three incidents in Samsung’s semiconductor business. Employees trying to get work done had entered source code from a facility measurement database program, program code for identifying defective equipment, and a recorded meeting into ChatGPT. Nobody broke in.
A workflow running under a business API agreement is better protected than that. OpenAI’s API terms are typical. Your data isn’t used for training, and logs are kept up to 30 days “unless longer retention is required by law.” A zero-retention arrangement is available separately.
On May 13, 2025, in the New York Times copyright suit, a federal court ordered OpenAI to preserve output logs it would otherwise have deleted. The Cyber Express reported the scope as ChatGPT Free, Plus, Pro and Team subscribers, along with API customers without Zero Data Retention agreements. Those customers weren’t parties to the case. A fight about newspaper articles put their deletion on hold until September 26, 2025. Mashable reported that the logs already preserved remain accessible, and that OpenAI still has to keep logs for accounts the Times has flagged.
Enterprise accounts and zero-retention contracts were excluded from the order, and they held.
The clause works if you signed the right one. Do you know which one your integrator signed?
02Secrecy Is Something You Have to Prove
Trade secret law protects only what you took reasonable measures to keep secret. In January a federal court in California dismissed a trade secret claim in Trinidad v. OpenAI. The plaintiff had voluntarily shared the material with ChatGPT and alleged no reasonable measures to protect it. She was an individual representing herself, and Foley Hoag’s write-up of the case notes that many enterprise AI platforms do carry confidentiality terms. A manufacturer with a proper contract stands on better ground than she did.
It’s still ground you defend afterward, in front of a judge, with the contract as your exhibit. Peter Toren, writing in IPWatchdog in April, called it an open question with legal support on the contract’s side. He still judged an enterprise license alone unlikely to be sufficient, because a court will ask about access, policies and training too. Data that never left the building doesn’t need the argument.
Then there’s the plain security count. IBM’s release on its 2026 X-Force index has manufacturing as the most-targeted industry for the fifth year, at 27.7% of the incidents X-Force observed, with data theft the most common. The same release counts more than 300,000 ChatGPT credentials exposed by infostealer malware in 2025. Every outside account that holds your data is one more set of credentials to lose, on a system you can’t audit.
03What Local Costs
I’ve got numbers for this, because there’s a local model on my bench.
It’s Gemma 4, which Google released in April under an Apache 2.0 license. The 26-billion-parameter version activates only 3.8 billion of them at a time, which keeps the computing load small. The PC has an NVIDIA RTX 3060 with 12 GB of memory, a consumer gaming card. The model is bigger than the card, so about half of it runs from the PC’s main memory. The job is reading a supplier’s reply to a purchase order and classifying it.
It started badly. On my install, n8n’s connector for the local model left the model’s thinking mode on and set no limit on output. One ordinary prompt, 988 tokens long, ran for 13 minutes and 24 seconds, produced more than 21,000 tokens of deliberation, and came back HTTP 200. Success, as far as the software was concerned. n8n flagged nothing. The 33-second median on record before that was the same problem in a milder form.
With thinking switched off, the real classification prompt returned a well-formed answer in 3.7 seconds. Then the workflow’s full test contract ran on that PC: 317 checks passed, none failed, three skipped. Across 27 timed runs the median was four seconds and the slowest was 51. Those are test fixtures, not live supplier mail.
That’s the cost of local, and the card is the cheap part. You own the box, including the day it misbehaves and nothing tells you. A hosted API hides all of that. A hosted frontier model is also smarter than anything that runs on a desktop like this one.
This work doesn’t need smarter. It’s reading an email and classifying the reply, and one design rule covers the rest.
The model proposes. A rule or a person decides.
04What Local Still Needs
A local stack needs the internet once, to download the model weights and the container images. After that you block outbound traffic from the machine at the firewall, then prove the workflow runs from first step to last with no call to an outside model.
A firewall isn’t magic either. Someone already inside your network can reach the model server the same way they reach the ERP. What local buys is narrower. No second copy of your data sits on someone else’s servers, waiting on someone else’s lawsuit.
Pick the workflow you’d automate first and list every document it reads. Which of them would you hand to a company whose servers you’ve never seen?