Running an AI assistant on your own computer sounds private, but many self-hosted tools still send your conversations to cloud services, embedding APIs, or remote search engines without you realizing it. A comprehensive evaluation of ten open-source AI assistants published this week reveals a critical distinction: self-hosting the software interface is not the same as keeping your data private.

The distinction matters because privacy-conscious users often assume that downloading and running software locally means their information stays local. In reality, many popular self-hosted assistants rely on external services for embeddings, transcription, search, or model inference. "Self-hosting gives you control over the application, chat history, user accounts, knowledge bases, and deployment environment," explained Eva Wong, Technical Writer at ZimaSpace. "It does not automatically make every conversation private. If your assistant still calls a cloud model, search API, transcription service, or remote embedding endpoint, data can leave your network".

The guide evaluated ten assistants with standard open-source licenses against six practical dimensions: self-hosting quality, assistant usefulness, model choice, privacy boundaries, operational fit, and license clarity. Project details were verified against official documentation and repositories as of August 24, 2026.

What Makes a Self-Hosted AI Assistant Actually Private?

True privacy requires both a self-hosted interface and local or explicitly approved backends. This means the language model, embedding model, vector database, and any search or transcription tools must all run on your hardware or infrastructure. Many assistants fail this test because they default to cloud providers for convenience or cost reasons.

The evaluation identified a critical licensing issue affecting several popular tools. Open WebUI's current codebase includes branding restrictions that prevent it from qualifying as truly open-source. LobeHub uses a proprietary community license, and Dify adds conditions to its community license. While these tools may still be useful and self-hostable, they fall into a "source-available" category rather than open-source, which affects your legal rights to modify and redistribute the software.

How to Evaluate Self-Hosted AI Tools for Real Privacy

• Check the License: Verify the software uses a recognized open-source license such as MIT, Apache-2.0, or AGPL-3.0, not a proprietary or restricted community license.
• Trace Data Flows: Review documentation to identify where conversations, documents, embeddings, and credentials are stored and processed. If any component calls an external service, that data leaves your network.
• Verify Local Model Support: Confirm the tool can connect to local language models and embedding models without forcing reliance on hosted providers like OpenAI or Anthropic.
• Test Multi-User Isolation: If you plan to share the assistant with others, ensure the tool supports separate user accounts and conversation isolation to prevent data leakage between users.
• Assess Deployment Complexity: Understand whether you need Docker, a dedicated server, or a simple desktop installation, and whether you have the technical skills to secure and maintain it.

The guide identified LibreChat as the best overall option for users seeking a familiar chat experience without locking into one model provider. LibreChat unifies major cloud providers and compatible local backends in a single self-hosted web application. It supports AI agents, MCP servers, custom actions, artifacts, conversation search, file workflows, and multi-user authentication. However, a serious LibreChat setup requires application configuration, a database, authentication choices, and model credentials, making it more complex than a simple desktop program.

For users focused specifically on document privacy, AnythingLLM emerged as the strongest option. Its workspace feature lets you organize documents and conversations around separate subjects, teams, or projects. The Docker edition supports both single-user and multi-user deployment, and it can connect to local or hosted language models, embedding models, and vector databases. The key advantage is document-centered retrieval with relatively little setup, making it suitable for manuals, research collections, policies, and internal reference libraries.

Why Privacy Boundaries Matter More Than Self-Hosting Alone

The evaluation emphasized that operators must be able to identify exactly where conversations, documents, embeddings, and credentials are stored. This transparency is essential because a single misconfiguration or default setting can expose sensitive information. For example, an assistant might store chat history locally but send document embeddings to a cloud vector database, creating a privacy leak that users may not notice.

OpenClaw represents a different privacy model entirely. Rather than a browser-based chat interface, it functions as a self-hosted gateway connecting an AI assistant to messaging channels such as Slack, Telegram, Discord, Signal, and Matrix. This design appeals to users who want an assistant to take real actions, such as operating files, invoking services, or executing controlled workflows. However, this capability creates a substantially larger security burden. A gateway connected to messaging accounts, shell tools, files, and external services has a much wider attack surface than a read-only chat interface. The guide recommends using a dedicated account, limiting tool permissions, isolating the runtime, protecting the gateway from the public internet, and requiring confirmation for irreversible actions.

The broader implication is that privacy in self-hosted AI is not binary. It exists on a spectrum determined by which components run locally, which services are called externally, and how carefully you configure each tool. Users seeking genuine privacy must move beyond the assumption that "self-hosted" means "private" and instead audit each tool's actual data flows and dependencies.