Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Deployment | Cloud, VPC, on-prem or air-gapped with region selection |
| Auditability | Request, model and response logging for operational review |
| Data grounding | Embeddings and RAG are live for manuals, policies and disruption playbooks |
| Structured output | JSON mode returns passenger-notice and case records in fixed schemas |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Free tier | Free plan with 2 free AI models; 14-day full-access trial |
| Endpoint roadmap | Audio, images, moderation, batch and fine-tuning are coming soon |
TL;DR
- Classify passenger, operational and safety data before any AI workflow goes live.
- Keep passenger data in private deployments with documented data paths.
- Ground disruption and policy answers in approved playbooks with citations.
- Log operational answers so any guidance can be reconstructed later.
- Require human sign-off for safety-sensitive or passenger-facing decisions.
How it works, step by step
- Inventory AI workflows and the systems they touch: reservations, loyalty, operations, crew services.
- Label data classes and decide which may reach shared cloud, and which require VPC or air-gapped deployment.
- Issue per-application keys with rotation, and connect enterprise SSO and RBAC for console access.
- Index manuals, policies and disruption playbooks, and require citations on every answer.
- Define review gates for passenger communications and any safety-adjacent output.
- Log request IDs, model versions, sources and outputs under your retention policy.
- Rehearse an incident scenario: wrong answer, leaked data, or model outage, with fallback routes.
Try it yourself
Open the AI API key security checklist →
Passenger data and booking systems
Passenger records, loyalty profiles and payment details carry strict handling expectations in most jurisdictions. Keep these flows inside private deployments, pass only the minimum fields needed to answer a question, and never let identifiers appear in logs you cannot control. Where a workflow touches payment data, keep it out of the model path entirely and use tools that return only the status or outcome the answer requires.
Operations and safety-sensitive workflows
Ground operations AI should retrieve from approved, version-controlled documents and cite the revision used. Anything that could influence a safety, maintenance or dispatch decision needs a named human reviewer and a logged approval. Treat generated text as a draft for a qualified person, never as an instruction to act.
For disruption management, retrieval over current playbooks and policy is high value: it speeds consistent passenger handling without letting the model improvise commitments.
Keys, vendors and shared tooling
Airlines run on vendors: ground handlers, catering, maintenance partners and platforms. Scope API keys per application and integration, store them in a secrets manager, and revoke them as contracts change. Avoid a single shared key spanning operations and marketing, because it destroys both attribution and blast-radius control. See API keys, RBAC and audit logs for the control pattern.
Logging, review and incident response
Log enough to reconstruct an operational answer: request ID, model and version, retrieved sources, output and the human decision that followed. Retain logs under a defined schedule and restrict who can read them. Write the incident playbook before launch: how you detect a wrong or leaked answer, who decides to disable a workflow, and how fallback to human processes works during a model outage.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Passenger data | Private VPC, on-prem and air-gapped deployment options | Identifiers pasted into chat tools | Data protection |
| Operations answers | RAG with citations over approved playbooks | Undocumented model guidance | Operations control |
| Identity | Scoped keys, rotation, enterprise SSO and RBAC options | Shared keys across teams | Security engineering |
| Audit trail | Request, model and source logging | No reconstruction path | Compliance |
| Vendor access | Per-integration keys and usage analytics | Unmanaged partner credentials | Procurement |
| Incident readiness | Fallback patterns and status visibility | No disable procedure | Resilience team |
Frequently asked questions
Can passenger data be processed on Plugsky?
Only under a deployment and data-handling agreement that satisfies your obligations. For strict requirements choose VPC, on-prem or air-gapped so data stays inside your environment, and minimize identifiers in prompts.
How do we keep answers aligned with current policy?
Index approved, version-controlled playbooks and require citations that include the revision. Refresh the index whenever policy or procedures change.
Should AI answer safety or maintenance questions?
It can retrieve and summarize approved documents for a qualified person. It should not act or decide. Require a named human reviewer and a logged approval for any safety-adjacent output.
What happens during a model or provider incident?
Define a fallback model per workflow, keep a human process available, and use the status page for visibility. Test the fallback path before you need it.
Is voice or audio supported for call centers?
Audio endpoints are coming soon. Today, transcribe calls with your existing speech tooling and route the text through the live chat API.
How do we audit a disputed answer?
Log request ID, model and version, retrieved sources, output and the following human decision. That trail lets reviewers reconstruct exactly what the system saw and suggested.
Where should a pilot start?
Use internal manuals and public policy content on the free plan, prove retrieval accuracy and logging, then extend to passenger workflows on a private deployment.