Key facts
| Deployment models | Plugsky cloud, private endpoint in your VPC, on-prem, air-gapped |
| API authentication | Scoped API keys with per-key rotation and revocation |
| Identity | SAML 2.0 / OIDC SSO and SCIM provisioning on Enterprise |
| Authorization | RBAC at workspace, role and resource level; per-key rate limits and quotas |
| Audit | Audit log export to SIEM (Splunk, Sentinel, QRadar, Datadog) |
| Key management | AES-256 at rest with per-region KMS; BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or HSM |
| Compliance posture | SOC 2 Type II and ISO 27001 readiness in progress (not yet certified); GDPR and PDPL alignment |
| SLA and status | 99.9% uptime on paid plans; Enterprise 4-hour support SLA — see /legal/sla |
TL;DR
- Scope every API key to one workspace, environment and rate limit — never one key for every team.
- Put SSO (SAML 2.0 or OIDC) and SCIM in place before rollout so access follows your joiner-mover-leaver process.
- Require audit log export in a standard schema; logs you cannot export are logs you cannot investigate.
- Use BYOK or an HSM when key custody falls inside your regulatory scope.
- Move from shared cloud to a private endpoint, on-prem or air-gapped deployment without changing application code.
How it works, step by step
- Inventory every location where an API key is stored; replace shared keys with per-service keys.
- Define roles (admin, developer, read-only, billing) and map them to identity-provider groups.
- Enable SAML 2.0 / OIDC SSO and SCIM provisioning on Enterprise, then test a full deprovisioning cycle.
- Configure audit log export to your SIEM and verify events carry actor, action, resource and timestamp.
- Set per-key rate limits and quotas, and alert on anomalous usage patterns.
- Decide key custody — provider-managed, BYOK, or HSM — against your regulatory scope.
- Rehearse key rotation and security incident response quarterly.
Original data
Try it yourself
Open the sovereign AI readiness score →
The four control planes to evaluate
Assess any AI API vendor on four control planes, not a single checkbox. Keys: can each key be scoped to a workspace, environment and rate limit? Identity: does the vendor federate with your IdP through SAML 2.0 or OIDC, and does SCIM automate provisioning and deprovisioning? Authorization: is RBAC enforced at workspace, role and resource level? Audit: can you export every security-relevant event to your own SIEM in a stable schema?
Plugsky exposes these controls in its docs and security documentation; identity and SCIM features are Enterprise-tier, so confirm plan coverage during evaluation.
Questions that separate real controls from marketing
- Can we export audit events to Splunk, Sentinel, QRadar or Datadog ourselves, or only receive a PDF?
- Is SSO self-serve or a professional-services project?
- Can a key be limited to one environment and one model tier?
- Can we bring our own keys (BYOK) and revoke them unilaterally?
- Which subprocessors touch prompts and completions, and where are they located?
- What happens to logs and vectors on contract termination?
Common pitfalls
Most incidents are configuration failures, not vendor breaches. The recurring ones: one long-lived key copied across services; no deprovisioning when an employee leaves; audit logs that exist but cannot be exported; and treating a certification roadmap as an operating control. Design for least privilege and test the deprovisioning path before go-live.
Where Plugsky fits — and where it does not
Plugsky supports scoped keys, SSO/SCIM, RBAC, SIEM audit export, BYOK, private endpoints, on-prem and air-gapped deployments behind an OpenAI-compatible API. Gaps to weigh honestly: SOC 2 Type II and ISO 27001 are in progress rather than completed, and hyperscalers offer broader native governance suites. If your timeline requires a completed audit today, plan compensating controls or a private deployment while readiness work concludes.
Honest comparison
| Capability | Plugsky | Hyperscaler AI platform | Building in-house |
|---|---|---|---|
| API key model | Scoped keys with per-key limits and revocation | Scoped keys with native IAM integration | You build key management |
| SSO / SCIM | SAML 2.0 / OIDC and SCIM on Enterprise | Mature, broad IdP coverage | Weeks to months of work |
| Audit export | SIEM export (Splunk, Sentinel, QRadar, Datadog) | Native cloud audit logs plus SIEM | Custom pipeline to maintain |
| BYOK / HSM | AWS KMS, Azure Key Vault, HashiCorp Vault, HSM | Cloud KMS and HSM services | You operate the HSM |
| Certifications | SOC 2 / ISO 27001 readiness in progress | Completed audits in most regions | Your own audit burden |
| Isolation tiers | Shared cloud, VPC, on-prem, air-gapped | Shared tenancy by default | You own everything |
Frequently asked questions
What is the minimum viable AI API security baseline?
Scoped keys with rotation, SSO for human access, RBAC for authorization, and exportable audit logs. Add BYOK or a private deployment when key custody or data residency enters your regulatory scope.
Does Plugsky support SSO and SCIM?
Yes — SAML 2.0 / OIDC SSO and SCIM provisioning are Enterprise features. Confirm current plan details with the enterprise team during evaluation.
Can I export audit logs to my SIEM?
Yes. Audit log export to Splunk, Sentinel, QRadar and Datadog is documented; verify event coverage for your compliance framework during a trial.
Can I bring my own encryption keys?
Yes — BYOK supports AWS KMS, Azure Key Vault, HashiCorp Vault and on-prem HSM, so revocation stays under your control.
Is Plugsky SOC 2 or ISO 27001 certified?
Not yet — SOC 2 Type II and ISO 27001 readiness are in progress. Treat certifications as pending and validate the controls that matter to your auditor directly.
How do I keep prompts and completions inside my network?
Deploy a private endpoint in your VPC, on-prem, or air-gapped. The API contract stays OpenAI-compatible, so application code does not change.
What happens if an API key leaks?
Because keys are scoped and revocable, you rotate the affected key, review audit logs for usage, and adjust rate limits. Keys scoped per environment contain the blast radius.
Where can I see current availability commitments?
The legal SLA page at /legal/sla documents uptime commitments and credits, and /status shows live component health.