Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Free plan | Two free AI models (plugsky-micro and plugsky-lite), no card required |
| Trial | 14-day full-access trial available for evaluation |
| Deployment | Cloud by default; VPC, on-prem and air-gapped as you grow |
| Auditability | Request, model and response logging for due-diligence evidence |
| Data grounding | Embeddings and RAG are live for docs and product knowledge |
| Models | 30+ models behind one OpenAI-compatible API |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
TL;DR
- Classify customer data early; it decides everything else.
- Issue one key per app and environment, never a shared team key.
- Write the privacy page before the first customer asks.
- Keep basic request logs so due diligence is not a fire drill.
- Choose flat pricing so a viral week does not become a bill shock.
How it works, step by step
- List the AI features you ship and the customer data each one touches.
- Classify data into public, internal and customer-confidential tiers.
- Issue a separate API key per application and environment with rotation.
- Write down what you log, where it lives and how long you keep it.
- Add a subprocessor list and data-handling section to your privacy page.
- Set spend guardrails and choose pricing that keeps costs predictable.
- Re-run this checklist when a security questionnaire arrives.
Try it yourself
Open the LLM cost calculator →
Starting lean without skipping basics
A startup AI checklist should fit on one page. Classify data into public marketing content, internal documents and customer-confidential data, then decide which features may touch each tier. Most early products can ship with public and internal content while the customer-data path gets designed properly.
Start free with plugsky-micro and plugsky-lite, validate the product experience, then choose a paid plan when usage justifies it. The habits matter more than the size of the programme.
Keys from day one
Issue a distinct API key per application and environment, store keys in a secrets manager or an environment variable that never reaches the client, and rotate them on a predictable schedule. Never share one key across the team or commit it to a repository. If a key leaks, revoke and replace it the same day.
Keep customer identifiers out of prompts by default, and retrieve only the fields a feature needs. These habits are cheap now and expensive to retrofit after a security questionnaire arrives.
Residency, retention and customer promises
Decide where processing happens before you sign your first enterprise contract, because region choice and private deployment options exist at every scale. Region selection covers many residency requests; VPC, on-prem and air-gapped deployment is there when a customer requires it later. Write down what you log, how long you keep it, and how a customer can request deletion.
Log the basics from day one: request ID, model, feature and output status. See AI audit logs for a schema.
Model governance and cost predictability
Keep a short approved model list with a note on why each one is used and what it was tested against. Re-test when a model version changes, and keep a fallback model configured so an outage does not stop the product. Flat monthly pricing helps here: a launch spike changes usage headroom, not your invoice model, so you can forecast without per-token anxiety. Mention the 14-day full-access trial when teammates want to evaluate premium tiers.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Getting started | Free plan with two models, no card required | Nothing documented | Founders |
| Keys | Scoped keys with rotation per app | One shared team key | Engineering |
| Cost control | Flat monthly plans, no per-token billing | Bill shock after launch | Founders |
| Residency | Region choice, VPC, on-prem and air-gapped | No answer in sales calls | Engineering |
| Audit trail | Basic request and output logging | Logs unavailable in due diligence | Engineering |
| Growth path | Same OpenAI-compatible API as you scale | Rewrite during growth | Engineering |
Frequently asked questions
Does using Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, region choice, logging - that you document and present in your own security reviews.
How much does the free plan cost?
Nothing, and no card is required. It includes two free AI models, plugsky-micro and plugsky-lite, with API keys for development. See the live pricing page for current plan details.
What should a small team log?
Request IDs, model names, feature names and output status, retained for a defined period. That is enough to investigate an incident and answer most questionnaires.
We are pre-revenue. Where do we start?
Classify data, issue separate keys per environment, and avoid putting customer data into prompts. Those three steps prevent most early-stage incidents.
When do we need private deployment?
When a customer contract or a regulated dataset requires it. The same OpenAI-compatible API means the migration is a base URL and model name change, not a rewrite.
Is there a trial for higher tiers?
Yes, a 14-day full-access trial is available, in addition to the free plan. Check the pricing page for current options.
What about cost predictability?
Self-serve plans are flat monthly with no per-token billing, so growth changes usage headroom rather than creating invoice surprises. See the live pricing page.