Key facts
| Deployment | Private endpoint in your VPC alongside cloud, on-prem and air-gapped tiers |
| Network | Traffic stays inside your network boundary; no public endpoint required |
| Identity | Integrates with your SSO/SCIM and RBAC model |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or HSM |
| Residency | Region-locked data planes; VPC placement keeps data in the chosen region |
| API contract | OpenAI-compatible API; application code is portable across tiers |
| Cost model | Self-serve plans are flat monthly; private deployments are quoted per engagement — see the live pricing page |
| Compliance posture | SOC 2 Type II and ISO 27001 readiness in progress (not yet certified) |
TL;DR
- BYOC keeps data in your account and lets your IAM, logging and procurement stay in familiar territory.
- You own cloud consumption and capacity planning — model that explicitly before committing.
- Verify which models and features are available in the BYOC configuration you plan to run.
- Integration work is real: networking, private DNS, egress rules and identity mapping take time.
- The same API contract across tiers means BYOC is not a one-way door.
How it works, step by step
- Define the boundary: which account, VPC/VNet, subnets and egress rules the platform may use.
- Confirm the model and feature matrix available in the BYOC deployment.
- Map identity: SSO/SCIM integration, service accounts and least-privilege roles.
- Plan networking: private endpoints, DNS, firewall rules and monitoring.
- Agree the operating split: who patches, who scales, who watches what.
- Model the full cost: infrastructure, support, engineering time and opportunity cost.
- Run a pilot workload and review before migrating production traffic.
Try it yourself
Open the private LLM cost estimator →
Why teams choose BYOC
Three motives dominate. Control: prompts, completions, logs and vectors remain in infrastructure you own and can inspect. Integration: existing network, identity, logging and cost tooling applies without exception processes. Portability: because the API contract stays OpenAI-compatible, changing tiers — cloud to VPC to on-prem — does not require rewriting applications. Plugsky supports a private endpoint in your VPC with SSO/SCIM, RBAC and BYOK, which covers the control and integration motives directly.
The trade-offs to price in
- Cloud consumption: GPU capacity, storage and egress appear on your bill.
- Capacity planning: you decide how much headroom to hold for peaks.
- Feature timing: some managed capabilities may arrive later than in the provider cloud.
- Integration work: private networking, DNS and identity mapping are projects, not toggles.
- Operating split: ambiguity about patching and scaling causes incidents; define it in writing.
BYOC vs on-prem vs managed cloud
Choose managed cloud when speed and low operations overhead matter most. Choose BYOC when data control and IAM integration matter but you still want managed model serving. Choose on-prem when jurisdiction, connectivity or policy requires the compute to sit in your facility. Air-gapped remains the narrow case where no external connectivity is permitted. The important design property is that all four share one API contract, so the decision can be revisited as requirements change.
Common pitfalls
Underestimating integration effort is the classic error: private networking and identity mapping take longer than the model deployment itself. A second is assuming full feature parity across tiers. A third is failing to define who owns scaling, leaving capacity surprises. A fourth is forgetting observability — plan log and metric flows before go-live, not after the first incident.
Honest comparison
| Capability | Plugsky BYOC / VPC | Hyperscaler AI platform | Building in-house |
|---|---|---|---|
| Data location | Your VPC and account, region-locked | Vendor account with region choice | Your data centre |
| IAM integration | Your SSO/SCIM and RBAC | Native cloud IAM | You build and operate |
| Managed model serving | Managed platform, your infrastructure boundary | Fully managed | You operate everything |
| Feature parity | Confirm matrix for your configuration | Broad but tier-dependent | Whatever you build |
| Cost profile | Your cloud bill plus platform terms | Consumption-based | Capital and people |
| Time to production | Weeks including integration | Fastest | Months |
Frequently asked questions
What does bring your own cloud mean for AI?
The model platform runs inside your cloud account or VPC. You keep data control and IAM integration while the vendor manages the serving software, subject to the deployment terms you agree.
Does Plugsky support deployment in our VPC?
Yes — a private endpoint in your VPC is one of the supported tiers, alongside cloud, on-prem and air-gapped options, with the same OpenAI-compatible API.
Who pays for the cloud infrastructure?
In self-serve cloud plans, Plugsky operates the platform. In private and BYOC deployments, infrastructure consumption is typically yours; confirm the exact commercial model on the live pricing page and with the enterprise team.
Will all models be available in our VPC?
Availability depends on the configuration and hardware profile. Ask for the model and feature matrix for your intended deployment and validate it during a pilot.
How do keys and identity work in BYOC?
Identity federates through SSO/SCIM with RBAC, and keys can remain customer-managed through BYOK, so revocation stays under your control.
Is BYOC compliant with residency rules?
It can be, because data stays in the region you select. Confirm the storage locations for logs, backups and any upstream model calls in the architecture review.
Can we move back to managed cloud later?
Yes. The API contract is consistent across tiers, so migration is primarily operational rather than a rewrite.