Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Deployment | Cloud, VPC, on-prem or air-gapped for regulated content |
| Auditability | Request, model and response logging for quality review trails |
| Data grounding | Embeddings and RAG are live for submissions, SOPs and safety content |
| Structured output | JSON mode returns case and review records in fixed schemas |
| Models | 30+ models behind one OpenAI-compatible API |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Endpoint roadmap | Files, batch and fine-tuning are coming soon |
TL;DR
- Separate controlled documents from general knowledge and public literature.
- Design audit trails so every output is attributable to a model and a person.
- Prefer private deployment for submissions, batch records and safety cases.
- Apply retention that matches regulated record schedules, not chat defaults.
- Keep qualified QA and safety staff accountable for final decisions.
How it works, step by step
- Inventory AI use cases across regulatory, manufacturing, safety and medical affairs.
- Classify content by regulated status, data-integrity requirements and confidentiality.
- Choose deployment per class: region cloud, VPC, on-prem or air-gapped.
- Issue per-function and per-application keys with rotation and central inventory.
- Define log fields and retention: request ID, model, sources, output, reviewer and decision.
- Approve a model allow-list with evaluation evidence and re-test on version changes.
- Require qualified review and sign-off before output enters a regulated record.
Try it yourself
Open the RAG architecture builder →
Regulated records and data classification
Pharmaceutical content spans published literature, internal SOPs, controlled documents, batch and manufacturing records, regulatory submissions, and safety case reports. Each class needs its own rule, and controlled records demand attributable, contemporaneous and traceable handling.
Start with literature and general SOPs, then extend to controlled and submission content only on private deployments where prompts, documents and embeddings stay inside the organisation.
Keys, functions and least privilege
Issue a distinct API key per function, application and environment. Regulatory, manufacturing, safety and commercial teams should not share credentials, and supplier or partner integrations should have their own scoped keys with clear revocation paths. Store keys in a secrets manager, rotate on a schedule, and connect enterprise SSO and RBAC options so console permissions follow personnel records.
Never place patient identifiers or batch details in prompts where retrieval can supply only the fields a task requires.
Residency, retention and regulated audit trails
Decide where processing happens and how long records live. Region selection covers many residency needs; VPC, on-prem and air-gapped deployment covers submissions and manufacturing records with stricter handling requirements. Retention applies to prompts, outputs, logs and retrieval indexes, and regulated records follow their own multi-year schedules.
Log enough to reconstruct an output: request ID, model and version, retrieved source identifiers, output, reviewer and decision. See AI audit logs for a schema.
Model governance and quality sign-off
Keep an approved model list with evaluation evidence, and re-run evaluations when versions or prompts change. Ground answers in current controlled documents with citations so reviewers can verify against the effective version. AI output stays a draft: qualified QA, regulatory or safety staff sign off before anything enters a controlled record, and the checklist should name who approves each workflow. File and batch endpoints are coming soon; plan document-heavy processes around that status.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Identity | Scoped keys per function, rotation, SSO and RBAC options | Shared department credentials | IT quality |
| Data boundary | Cloud, VPC, on-prem or air-gapped deployment | Controlled records in public tools | Regulatory affairs |
| Retention | Configurable logging under regulated schedules | No defined retention | Records management |
| Audit trail | Request, model, source and reviewer logging | Outputs not attributable | Quality assurance |
| Grounding | Embeddings and RAG over effective SOPs and submissions | Superseded document answers | Document control |
| Sign-off | Citations and structured output for reviewers | AI drafts in controlled records | Qualified person |
Frequently asked questions
Does using Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, private deployment, logging - that you document and validate against your own regulatory and quality obligations.
Can regulated records stay inside the company?
Yes. VPC, on-prem and air-gapped deployment keeps prompts, documents and embeddings inside your environment, and the API stays OpenAI-compatible.
What should we log?
Request IDs, model names and versions, retrieved source identifiers, outputs, reviewers and decisions, retained under regulated schedules so each output is attributable.
How do we handle superseded documents?
Refresh the retrieval index when documents change, keep effective versions in the index, and require citations so reviewers can see which version grounded an answer.
Is fine-tuning available for our templates?
Fine-tuning, files and batch endpoints are coming soon. Today, use retrieval over approved templates with JSON mode for consistent structured output.
Can we use AI in pharmacovigilance intake?
Retrieval and structured extraction can assist intake, but qualified safety staff must review and own case decisions, and the audit trail must capture both model and reviewer.
Where should a pilot start?
Pilot on public literature and general SOPs with the free plan, prove citations and attribution, then extend to controlled content on private deployment.