“A locally hosted machine connected to the internet is not inherently more secure than a well-configured cloud API from a major provider.”