Key facts
| Deployment | Cloud, VPC, on-prem and air-gapped for remote or restricted sites |
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Auditability | Request, model and response logging for incident and HSE review |
| Data grounding | Embeddings and RAG are live for procedures, permits and HSE documentation |
| Resilience | Multi-model fallback and status visibility for degradation planning |
| Models | 30+ models behind one API for office and field knowledge workloads |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Endpoint roadmap | Images, audio, moderation, batch and fine-tuning are coming soon |
TL;DR
- Separate corporate IT workflows from OT-adjacent ones and deploy accordingly.
- Air-gapped sites need local serving, local indexes and planned updates.
- Ground HSE and permit answers in current revisions with citations.
- Define and test degraded modes before relying on AI in operations.
- Log interactions for incident and safety investigations.
How it works, step by step
- Map AI workflows across corporate functions, generation assets, grids and field operations.
- Mark OT-adjacent workflows and confine them to on-prem or air-gapped deployment.
- Plan for sites with limited connectivity: local serving, local indexes and scheduled updates.
- Scope keys per system and environment, and connect SSO and RBAC for console access.
- Index procedures, permits and HSE documentation, and require revision citations.
- Set review gates so safety and environmental outputs receive qualified human sign-off.
- Rehearse degraded modes and log request IDs, model versions, sources and decisions.
Try it yourself
Open the AI API key security checklist →
OT and IT: two worlds, one policy
Energy companies run corporate IT and operational technology under different risk models. AI policy should reflect that split. Knowledge assistants for policy, procurement and HR can live on standard cloud infrastructure; anything that reads telemetry, control documentation or safety systems belongs inside the operational boundary.
Write one policy that defines both zones, then document every workflow's placement. The common failure is an operations team adopting a convenient cloud tool because the boundary was never made explicit.
Field connectivity and air-gapped sites
Remote assets may have intermittent links or none at all. On-prem and air-gapped deployments run serving, retrieval and logging locally, so answers remain available when connectivity drops. Plan updates as reviewed artifacts applied on your schedule, and keep a local index refresh process so procedure changes reach the site.
The OpenAI-compatible API keeps application code identical between the office pilot and the field deployment.
HSE and environmental content controls
Safety and environmental answers must come from approved, current revisions. Store revision metadata with indexed procedures and permits, retrieve the approved version, and cite it. When a document is updated, re-index before the change takes effect in the field.
Any output that could influence a safety or environmental decision requires qualified human review. The assistant retrieves and summarizes; it does not authorize work.
Resilience and incident drills
Define what happens when the assistant is slow, unavailable or wrong: cached guidance, printed procedures, or a named person to consult. Use fallback models per task class, bound retries, and rehearse the switch. Log request IDs, model and revision versions, outputs and decisions so safety and incident investigations can reconstruct exactly what was presented. See disaster recovery and failover for patterns.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| OT boundary | On-prem and air-gapped deployment options | Telemetry workflows on shared cloud | OT security |
| Field availability | Local serving, retrieval and logging | Assistants fail without connectivity | Field operations |
| HSE grounding | RAG with revision citations | Answers from superseded procedures | HSE leadership |
| Access | Scoped keys per system, enterprise SSO and RBAC options | Shared credentials across sites | Security engineering |
| Resilience | Multi-model fallback and status visibility | No defined degraded mode | Operations |
| Audit trail | Request, model and source logging | No investigation evidence | Compliance |
Frequently asked questions
Can AI support operations at remote sites?
Yes, as an advisory knowledge tool on local infrastructure. Keep control decisions with qualified people and ensure it works when connectivity is lost.
How do we keep HSE answers current?
Store revision metadata with indexed documents, retrieve the approved version by default, cite it in the answer, and re-index whenever a procedure changes.
What does air-gapped deployment change?
Serving, retrieval and logging run inside the network with no outbound connectivity. Updates arrive as reviewed artifacts on your schedule, and application code remains unchanged.
What happens if the model is unavailable?
A predefined degraded mode: cached guidance, printed procedures or a named expert. Test the switch during drills and measure how long it takes.
Which endpoints are live today?
Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live. Images, audio, moderation, files, batch, assistants, responses and fine-tuning are coming soon.
How do we secure keys across many sites?
One key per system and environment, centrally stored and rotated, with immediate revocation when staff or vendors change. Avoid shared site credentials.
Where should a pilot start?
Use public standards and internal procedures on the free plan, confirm citations and logging, then move operational workflows into the boundary.