Key facts
| Data boundary | Privileged material never leaves the firm's perimeter |
| Deployment | On-prem and air-gapped tiers alongside cloud and VPC options |
| Models | Open-weight models suitable for offline operation from the catalogue |
| API contract | OpenAI-compatible endpoint; review tooling unchanged across tiers |
| Isolation | Workspace and scoped keys per matter or client |
| Grounding | Retrieval with plugsky-embed; every claim cites a source document |
| Audit | Access, key and inference events exportable to internal SIEM |
| Status | Live platform; enterprise deployment terms per engagement |
TL;DR
- Privilege stays enforceable when documents never leave the network.
- Keep a workspace and key set per matter so walls are technical, not procedural.
- Ground answers in retrieved passages and verify citations before use.
- Log access at document level for defensibility.
- Start with review-heavy tasks, not advice.
How it works, step by step
- Identify engagements or clients whose confidentiality terms require no external processing.
- Select review-heavy workflows: clause extraction, diligence summarisation, chronologies and redaction support.
- Deploy the runtime and verified open-weight models inside the firm's network, with version inventory and rollback bundles.
- Provision a workspace and scoped keys per matter, with vector indexes inside the same boundary.
- Index matter documents and require answers to cite retrieved passages; add a citation-verification pass.
- Keep all writes out of the agent loop: exports flow through tracked changes and lawyer review.
- Export access and inference events to internal SIEM and review a sample of outputs with the matter team.
Try it yourself
Open the private LLM deployment estimator →
When privilege demands an air gap
Most legal work can run in a compliant cloud or VPC deployment, but some engagements, clients or jurisdictions require that privileged material never touches an external system. Air-gapped Plugsky answers that requirement: open-weight models and the runtime run inside the firm's network, and retrieval, inference and logs all stay within the perimeter.
The practical advantage is that the interface does not change. The same OpenAI-compatible endpoints serve cloud pilots and isolated production, so review tooling, prompt libraries and evaluation sets transfer between environments without rework.
Isolation and grounding in practice
Two controls do most of the work. First, matter isolation: a workspace and scoped key set per matter, with the vector index and logs inside the same boundary, so no query can retrieve across client walls. Second, grounding: agents answer only from retrieved passages, quote their support, and submit to a verification pass that resolves every citation to a source document.
- Least corpus: index only what the matter requires; avoid firm-wide indexes.
- Short retention: configure retention per workload and purge at matter close.
- Read-only tools: the agent drafts; lawyers edit and file.
Defensibility and operations
Legal work is adversarial later, so assume someone will ask how a document was reviewed. Log access at document level: who queried the matter, which documents were retrieved, which model version answered and who verified the result. Export those events to internal SIEM and retain them according to the engagement's records policy.
Operationally, treat model updates as validated releases with staging and rollback, and re-run the matter evaluation suite after every change. Measure extraction precision, missed issues and citation accuracy on a lawyer-reviewed sample; those numbers are how the firm decides what the agent may touch next.
Honest comparison
| Legal concern | Plugsky air-gapped | Cloud AI service | DIY open-source stack |
|---|---|---|---|
| Privilege boundary | Documents never leave the network | Requires contractual controls | Depends on your build |
| Matter isolation | Workspace and keys per matter | Shared tenancy | You design it |
| Grounding | Retrieval plus citation verification | Varies | You build it |
| Audit | Document-level access events to SIEM | Vendor logs | Your pipelines |
| API compatibility | OpenAI-compatible offline | Vendor API | You define it |
| Effort | Deployment and update pipeline | Lowest | Highest |
Frequently asked questions
Is air-gapped deployment necessary for privilege?
Not always. Contractual controls, retention settings and region-locked deployments satisfy many engagements. An air gap is for matters where any external processing is ruled out.
How do we enforce privilege walls technically?
Provision a workspace and scoped keys per matter, keep the vector index and logs in the same boundary, and verify that retrieval cannot cross between workspaces.
How do we stop hallucinated citations?
Answer only from retrieved passages, require quoted support, and add a verification step that resolves each citation before a lawyer reviews the draft.
What is logged?
Document-level access events, key and administrative changes, and inference metadata including model and prompt version, exportable to internal SIEM for defensibility.
Can the agent edit documents directly?
It should not. Exports flow through tracked changes and lawyer review, keeping the professional judgement and the record of it with the matter team.
How are model updates managed?
As validated releases with checksums, staging against a production mirror, evaluation on your matter dataset, and a tested rollback path before promotion.
How do we start?
Choose one matter and one review task, deploy to the isolated staging environment, and validate output quality with the matter team before broader rollout.