Key facts
| BYOK availability | Enterprise deployments, scoped in an agreement |
| Key custody (BYOK) | Customer KMS or HSM holds the root key; envelope encryption wraps data keys |
| Key custody (self-serve) | Plugsky-managed encryption on the shared cloud |
| Deployment options | Plugsky cloud, VPC, on-prem, air-gapped |
| Rotation and revocation | Customer-controlled in BYOK deployments |
| API impact | None — the OpenAI-compatible API is unchanged |
| Audit | Key usage and access events logged for enterprise deployments |
| Product status | Live for enterprise deployments |
TL;DR
- BYOK is real but enterprise-scoped — it is not a self-serve toggle today.
- Your KMS or HSM holds the root key; the platform wraps data keys with it.
- On-prem and air-gapped deployments give the strongest key custody.
- The API stays OpenAI-compatible, so application code does not change.
- If you destroy a root key, data wrapped by it cannot be recovered — plan rotation.
How it works, step by step
- Map which data classes must be protected by customer-managed keys.
- Choose the deployment model that matches your custody requirement: VPC, on-prem or air-gapped.
- Define the key hierarchy: root key location, wrapping keys and rotation cadence.
- Integrate your KMS or HSM with the deployment during onboarding.
- Test rotation and revocation in staging before you rely on them in production.
- Document key ownership, escalation and recovery responsibilities in the agreement and runbooks.
Try it yourself
Open the AI API key security checklist →
What BYOK means for an AI API
Bring-your-own-key means the encryption keys protecting your data are yours, not your provider's. In practice you keep a root key in your own KMS or HSM, and the platform uses it to wrap the data-encryption keys it uses day to day — an approach called envelope encryption. Rotating or revoking the root key changes who can unwrap data at rest, which is why security teams ask for BYOK in regulated or high-assurance environments. The goal is simple: reduce the blast radius if a key or credential is compromised, and keep key custody aligned with your security policy.
Where customer-managed keys fit in Plugsky deployments
Key custody depends on the deployment model:
- Shared cloud (self-serve): encryption is managed by Plugsky; you get isolation and a compliant API, but not key ownership.
- VPC: keys can live in your own cloud KMS while the gateway runs inside your network boundary.
- On-prem and air-gapped: keys never leave your environment, which is the strongest custody available.
Because BYOK is scoped per agreement, start from your security requirements — key location, rotation cadence, revocation and audit evidence — and scope the deployment to match them. See the live pricing page for contact paths.
What we do and what we do not do
What we do: support customer KMS/HSM integrations in enterprise deployments, customer-controlled rotation and revocation, and audit trails of key usage. What we do not do: offer BYOK as a self-serve setting today, host your HSM for you, or recover data after you permanently destroy a key — custody means responsibility. Treat BYOK as an architecture decision to confirm during scoping rather than assuming parity across every plan, and read the terms and SLA for the commitments that apply.
Honest comparison
| Capability | Plugsky enterprise (BYOK) | Plugsky self-serve | Fully managed provider |
|---|---|---|---|
| Key ownership | You hold the root key in your KMS/HSM | Plugsky-managed | Provider-managed |
| Key rotation | Customer-controlled | Provider-controlled | Provider-controlled |
| Deployment required | VPC, on-prem or air-gapped agreement | Shared cloud | Shared cloud |
| Application code changes | None — API unchanged | None — API unchanged | None — API unchanged |
| Revocation effect | Wrapped data becomes unreadable immediately | Not applicable | Not available |
| Recovery if a key is lost | Not possible by design | Provider handles | Provider handles |
Frequently asked questions
Can I use BYOK on the free plan?
No. BYOK is an enterprise deployment option scoped in an agreement; the free plan and shared self-serve cloud use Plugsky-managed encryption.
Which KMS or HSM products are supported?
Support is confirmed during scoping: VPC deployments typically integrate with the cloud KMS of the provider you run in, and on-prem deployments use your own HSM. Ask for the current integration list.
Does BYOK change how I call the API?
No. The API stays OpenAI-compatible, so you change nothing in application code — encryption is handled below the application layer.
What happens if I rotate or revoke my key?
Rotation is designed to be transparent when done through the supported process. Revoking a root key without re-wrapping makes data protected by it unreadable, which is the point of customer custody.
Can Plugsky staff read my data on a managed plan?
Operational access is limited and governed by policy and audit logs. If your requirement is strictly no provider access, choose a private deployment where keys and data stay inside your boundary.
Is BYOK available for air-gapped deployments?
Yes — air-gapped is the deployment with the strongest custody because keys, data and inference all stay inside your isolated network.
How do I get BYOK?
Begin on the free plan to validate workloads, then scope an enterprise deployment with the team. Availability and terms are set in the agreement; see the live pricing page for contact paths.