Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Deployment | Sovereign, VPC, on-prem and air-gapped options for public services |
| Auditability | Request, model and response logging for public accountability |
| Data grounding | Embeddings and RAG are live for legislation, policy and service content |
| Models | 30+ models behind one OpenAI-compatible API |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Transparency | Citations and structured output for public-facing explanations |
| Endpoint roadmap | Audio, images, moderation, files, batch and fine-tuning are coming soon |
TL;DR
- Classify citizen data and decide sovereign handling per service.
- Scope keys per agency, service and environment, with rotation.
- Publish a plain-language notice when AI is used in a service.
- Preserve interaction records under public records schedules.
- Keep accountable officers named for every automated workflow.
How it works, step by step
- Inventory AI use cases across citizen services, back office and policy work.
- Classify data by sensitivity and statutory handling requirements.
- Choose deployment by class: region cloud, sovereign, on-prem or air-gapped.
- Issue per-agency and per-service keys with rotation and central inventory.
- Define log fields and retention: request ID, model, sources, output, responsible officer.
- Ground service answers in current legislation and policy with citations.
- Publish an accountability map covering appeals and human review.
Try it yourself
Open the sovereign AI readiness score →
Citizen services and data classification
Public sector content spans published legislation, internal policy, citizen case files and service telemetry. Each class needs its own handling rule, and citizen records usually carry statutory protections that are stricter than a general privacy regime.
Most agencies start with legislation and public guidance, then extend to case data only on sovereign or private deployments where prompts, documents and embeddings stay in country or inside the agency boundary.
Keys, agencies and least privilege
Issue a distinct API key per agency, service and environment, store them in a secrets manager, and rotate on a schedule. Separate build, approval and operate roles so no single officer can change a production workflow unchallenged. Enterprise SSO and RBAC options keep console access aligned with personnel records and revocation processes, and contractor access should be scoped and time-bound.
Never place citizen identifiers in prompts where retrieval can supply only the fields a service needs.
Sovereignty, transparency and records
Decide where processing happens for each service and be able to evidence it. Region selection covers many needs; sovereign, on-prem and air-gapped deployment covers mandates that require in-country or in-agency processing. Retention applies to prompts, outputs, logs and retrieval indexes, and public records schedules usually outlast the system itself.
Log enough to answer scrutiny: request ID, model and version, retrieved source identifiers, output and the responsible officer. See AI audit logs for a schema and the UAE residency guide for an architecture example.
Model governance and public accountability
Keep an approved model list with evaluation evidence and re-test when versions change. Ground answers in current legislation and policy with citations, and publish a plain-language description per service: what the system does, what data it uses, who reviews outputs and how to appeal. Name an accountable owner for each workflow and sample interactions regularly so quality and fairness issues surface early.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Sovereignty | Sovereign, VPC, on-prem and air-gapped deployment options | Data processed abroad | Program office |
| Identity | Scoped keys per agency and service, SSO and RBAC options | Shared service credentials | Security |
| Transparency | Citations and structured output for public notices | AI use undisclosed | Communications |
| Retention | Configurable logging under records schedules | Deletion not enforced | Records management |
| Audit trail | Request, model and officer logging | Decisions not traceable | Internal audit |
| Accountability | Review workflows with named owners | No appeal path | Service owner |
Frequently asked questions
Does using Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, sovereign deployment, logging - that you document and audit against your own statutory obligations.
Can processing stay in country?
Yes for supported regions, and by construction with sovereign, on-prem or air-gapped deployment. Confirm the specific region and data flow in writing during procurement.
What should we log?
Request IDs, model names and versions, retrieved sources, outputs and the responsible officer, retained under public records schedules so decisions can be scrutinised.
Do we need to tell citizens AI is used?
Publish a plain-language notice per service covering what the system does, what data it uses, who reviews outputs and how to appeal. Check applicable transparency rules for your jurisdiction.
Can Arabic-language services be supported?
Multilingual chat and embedding models are in the 30+ model catalogue. Evaluate on real service questions and local dialects before enabling a channel.
How do we handle an incorrect answer?
Design an appeal path per service, name an accountable owner, and keep the interaction log so the case can be reviewed against the same evidence.
Where should a pilot start?
Pilot on public legislation and service content with the free plan, validate citations and logging, then move sensitive services to sovereign or private deployment.