Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Deployment | Cloud, VPC, on-prem or air-gapped for embargoed and participant data |
| Auditability | Request, model and response logging for reproducible review |
| Data grounding | Embeddings and RAG are live for literature, protocols and datasets |
| Structured output | JSON mode returns extraction and coding records in fixed schemas |
| Models | 30+ models behind one OpenAI-compatible API |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Endpoint roadmap | Files, batch and fine-tuning are coming soon |
TL;DR
- Classify embargoed findings separately from published literature.
- Treat participant data as its own class with ethics review before use.
- Pin model versions and log parameters so analyses are reproducible.
- Decide residency and retention before importing external datasets.
- Keep a named researcher accountable for conclusions.
How it works, step by step
- Inventory AI use cases across literature review, coding, extraction and writing.
- Classify content by publication status, embargo, participant sensitivity and licence.
- Choose deployment per class: region cloud, VPC, on-prem or air-gapped.
- Issue per-project and per-application keys with rotation and central inventory.
- Define log fields and retention: request ID, model, parameters, sources, output, reviewer.
- Pin model versions for analyses and record them alongside results.
- Complete ethics and data-sharing review before using restricted datasets.
Try it yourself
Research data and embargo classification
Research content spans published papers, preprints, internal drafts, embargoed findings, participant data and grant applications. Each class needs a handling rule, and embargoed or participant-linked material usually prohibits processing on shared public infrastructure.
Start with published literature and open datasets, then extend to restricted content only on private deployments where prompts, datasets and embeddings stay inside the institution or project boundary.
Keys, labs and least privilege
Issue a distinct API key per project, application and environment, and keep them in a secrets manager with a rotation schedule. Research teams change composition constantly, so connect enterprise SSO and RBAC options to keep console permissions aligned with current project membership, including visiting scholars and external co-investigators.
Never place participant identifiers or embargoed results in prompts where retrieval can supply only the passage a task requires.
Residency, retention and reproducibility
Decide where processing happens and how long records live. Region selection covers many residency needs; VPC, on-prem and air-gapped deployment covers restricted datasets and institutions with strict data agreements. Retention applies to prompts, outputs, logs and retrieval indexes, and data-sharing agreements may set their own deletion terms.
Log enough to reproduce an analysis: request ID, model and version, parameters, retrieved source identifiers, output and the reviewing researcher. See AI audit logs for a schema.
Model governance and researcher review
Keep an approved model list with evaluation evidence, pin versions for analyses, and re-run evaluations when versions change. Ground extraction and summaries in cited sources and mark AI-assisted output as such in drafts. A qualified researcher remains accountable for conclusions, so the checklist should name the reviewer and record model parameters alongside results so others can reproduce them.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Identity | Scoped keys per project, rotation, SSO and RBAC options | Shared lab credentials | IT security |
| Data boundary | Cloud, VPC, on-prem or air-gapped deployment | Embargoed data in public tools | Research office |
| Reproducibility | Version pinning plus request and parameter logging | Model version unrecorded | Principal investigator |
| Retention | Configurable logging under data agreements | No defined deletion | Data steward |
| Grounding | Embeddings and RAG over cited literature | Unsourced AI summaries | Library services |
| Review | Citations and structured output for researchers | AI drafts treated as findings | Ethics and supervision |
Frequently asked questions
Does using Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, private deployment, logging - that you document and audit against your own ethics, funder and data-sharing obligations.
Can embargoed findings stay private?
Yes. Keep them out of shared indexes and use private deployment where prompts, documents and embeddings stay inside the institution or project boundary.
What should we log for reproducibility?
Request IDs, model names and versions, generation parameters, retrieved sources, outputs and the reviewing researcher, retained under your data agreements.
How do we handle participant data?
Complete ethics and data-sharing review first, de-identify where possible, and keep participant-linked material on private deployment with restricted retrieval.
Is fine-tuning available for coding schemes?
Fine-tuning, files and batch endpoints are coming soon. Today, use retrieval over approved codebooks with JSON mode for consistent structured output.
Can external collaborators get access?
Yes, with separate scoped keys per collaborator and project, explicit expiry, and indexes limited to the material each agreement covers.
Where should a pilot start?
Pilot on published literature and open datasets with the free plan, verify citations and logging, then extend to restricted data on private deployment.