Short answer
Privacy covers the model plus gateways, identity, retrieval, logs, backups, network paths, and operators. Local hosting alone proves little.
Boundary
Map connections and data classes, test denial, and approve the complete path before real sensitive data.