Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Department separation | Separate keys and retrieval indexes per faculty or service |
| Deployment | Cloud, VPC, on-prem or air-gapped for student and research data |
| Auditability | Request, model and response logging for academic review |
| Data grounding | Embeddings and RAG are live for policy, courses and research content |
| Free access | Free plan with two models helps students and staff experiment |
| Models | 30+ models behind one OpenAI-compatible API |
| Endpoint roadmap | Audio, images, moderation, files and fine-tuning are coming soon |
TL;DR
- Classify student records and research data before campus-wide rollouts.
- Let departments own keys and indexes instead of one shared account.
- Write an acceptable-use policy students and staff can actually follow.
- Apply retention to chat logs the same way as student records.
- Keep grades, admissions and discipline decisions with named humans.
How it works, step by step
- Inventory AI use cases across teaching, research, administration and student services.
- Classify data by student-record sensitivity, research confidentiality and licence.
- Choose deployment per class: region cloud, VPC, on-prem or air-gapped.
- Issue per-department and per-application keys with rotation and central inventory.
- Define log fields and retention: request ID, model, sources, output, staff reviewer.
- Publish an acceptable-use policy covering disclosure and academic integrity.
- Require human review for grades, admissions, discipline and funding decisions.
Try it yourself
Student, research and campus data
University data spans public course catalogues, internal policy, student records, research data and grant material. Each class needs its own rule, and student-record privacy obligations apply to anything that identifies a learner, including support chats.
Most institutions start with public policy and course content, then extend to student and research data only on deployments that keep prompts, documents and embeddings inside the university or an approved boundary.
Keys, departments and least privilege
Issue a distinct API key per department, service and environment. Faculties operate autonomously, and a single shared institutional key makes both least privilege and incident response impossible. Store keys in a secrets manager, rotate on a schedule, and connect enterprise SSO and RBAC options so access follows staff and student-worker lifecycles.
Never place student identifiers in prompts where retrieval can supply only the fields a service needs, and keep research data out of general-purpose indexes.
Residency, retention and student-record privacy
Decide where processing happens and how long records live. Region selection covers many requirements; VPC, on-prem and air-gapped deployment covers institutions with stricter data-handling rules or international partnerships. Retention applies to prompts, outputs, logs and retrieval indexes, and chat transcripts about a student are student records.
Log enough to review an academic decision: request ID, model and version, retrieved source identifiers, output and the staff reviewer. See AI audit logs for a schema.
Model governance and academic review
Keep an approved model list with evaluation evidence and re-test when versions change. Ground answers in current policy and course material with citations, and state clearly where AI use is permitted in assessed work. Grades, admissions, discipline and funding decisions stay with named humans, and the checklist should document how students and staff can question an automated outcome. The free plan lets teaching staff and students experiment without procurement friction.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Department separation | Separate keys and indexes per faculty or service | One institutional key | IT services |
| Identity | Scoped keys, rotation, enterprise SSO and RBAC options | Shared staff credentials | Identity team |
| Data boundary | Cloud, VPC, on-prem or air-gapped deployment | Student data in public tools | Registrar and privacy |
| Retention | Configurable logging under records policy | Chats kept indefinitely | Records management |
| Policy | Structured output and citations for guidance | Unclear acceptable-use rules | Academic governance |
| Review | Human review for decisions affecting students | Automated decisions unseen | Faculty and registry |
Frequently asked questions
Does using Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, department separation, private deployment, logging - that you document and audit against your own student-record and research obligations.
Can student data stay on campus?
Yes. VPC, on-prem and air-gapped deployment keeps prompts, documents and embeddings inside the university environment, and the API stays OpenAI-compatible.
What should we log?
Request IDs, model names and versions, retrieved sources, outputs and the staff reviewer, retained under records policy so decisions affecting students can be reviewed.
Can students use the platform for projects?
Yes. The free plan includes plugsky-micro and plugsky-lite with no card, which suits coursework and experimentation under your acceptable-use policy.
How do we handle research confidentiality?
Keep research data in separate indexes with permissions matching current collaboration agreements, and use private deployment where funders or partners require it.
Are audio and moderation features available?
Audio, images, moderation, files and batch endpoints are coming soon. Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live today.
Where should a pilot start?
Pilot on public policy and course content with the free plan, validate citations and logging, then extend to student services on private deployment.