Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Deployment | Cloud, VPC, on-prem or air-gapped across brands and properties |
| Auditability | Request, model and response logging for service-quality review |
| Data grounding | Embeddings and RAG are live for brand standards and local guides |
| Structured output | JSON mode returns booking and request records in fixed schemas |
| Models | 30+ models behind one OpenAI-compatible API |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Endpoint roadmap | Audio, images, moderation, files, batch and fine-tuning are coming soon |
TL;DR
- Classify guest data and agree brand, franchise and property boundaries first.
- Issue a scoped key per application, brand or property channel.
- Decide residency and retention explicitly for guest and loyalty records.
- Log guest-facing interactions so service issues can be reconstructed.
- Keep a named human accountable for refunds, upgrades and exceptions.
How it works, step by step
- Inventory guest-facing AI use cases and the data each one touches, then label data classes.
- Agree data ownership across brand, franchise and management-company boundaries.
- For each class, choose the deployment mode: cloud, VPC, on-prem or air-gapped.
- Issue per-application keys, store them in a secrets manager, and rotate on a schedule.
- Define log fields and retention: request ID, model, retrieved sources, output, handling agent.
- Approve a model allow-list and require citations from current brand documentation.
- Route refunds, upgrades and exceptions to a named human with an escalation path.
Try it yourself
Open the AI API key security checklist →
Guest data and brand boundaries
Hospitality data spans brands, franchises, management companies and loyalty programs, so classification must assign an owner for each class. Public property information and local recommendations are low risk; reservation records, loyalty profiles, dietary and accessibility notes, and payment references are not.
Write down which entity may process which class and where. Conversation logs from a concierge assistant often contain more personal detail than the booking system, so treat transcripts as guest records.
Keys, channels and least privilege
Issue a distinct API key per application and channel - web, app, front desk, contact centre - and per environment. Store keys in a secrets manager, rotate them on a schedule, and revoke them when a vendor, franchise or integrator relationship ends. Enterprise SSO and RBAC options keep console access aligned with staff movement across properties.
Never let a shared production key serve multiple brands, and keep payment references out of prompts entirely.
Residency, retention and audit trails
Decide where guest data is processed and how long transcripts live. Region selection covers many residency needs; VPC, on-prem and air-gapped deployment supports groups that require data to stay in a country or inside their own estate. Retention is your policy applied to prompts, outputs, logs and retrieval indexes.
Log enough to reconstruct a guest interaction: request ID, model and version, retrieved source identifiers, output and the handling agent. See AI audit logs for a schema.
Model governance and service accountability
Keep an approved model list with evaluation evidence, and re-run evaluations when versions change. Ground guest answers in current brand standards and property facts, and require citations so staff can verify before acting. Refunds, upgrades and complaint resolutions stay with named humans, so the checklist should document who reviews and who can override.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Identity | Scoped keys per channel, rotation, SSO and RBAC options | One key shared across brands | IT security |
| Data boundary | Cloud, VPC, on-prem or air-gapped deployment | Transcript path undocumented | Data protection |
| Retention | Configurable logging of requests and responses | Chat logs kept indefinitely | Data protection |
| Audit trail | Request, model and source logging | Guest complaints not traceable | Guest experience |
| Grounding | Embeddings and RAG over brand standards | Outdated policy answers | Brand operations |
| Human sign-off | Citations and structured output for agents | Automated refund promises | Property manager |
Frequently asked questions
Does Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, private deployment, logging - that you document and audit against your own guest-data obligations.
Can guest data stay in one country or inside our estate?
Yes. Region selection covers many cases, and VPC, on-prem and air-gapped deployments keep prompts, documents and embeddings inside your environment.
What should we log for guest interactions?
Request IDs, model names and versions, retrieved source identifiers, outputs and the handling agent, retained under your policy so complaints can be reconstructed.
How do we handle loyalty and dietary notes?
Classify them as guest records, restrict retrieval to workflows that need them, and keep them on private deployment where the brand requires it.
Can we use AI for multilingual concierge service?
Yes. Multilingual chat models are in the 30+ model catalogue; evaluate on real guest questions and local languages before enabling a channel.
Are voice and image features available?
Audio, images and moderation endpoints are coming soon. Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live today.
Where should a pilot start?
Pilot on public property information and brand FAQs with the free plan, measure answer quality and logging, then extend to loyalty and reservation workflows on private deployment.