Key facts
| Access control | Scoped API keys with rotation; enterprise SSO and RBAC options |
| Deployment | On-prem, air-gapped, VPC or edge placement near operations |
| Resilience | Multi-region and failover guidance for continuity |
| Auditability | Request, model and response logging for safety and outage review |
| Data grounding | Embeddings and RAG are live for procedures and asset knowledge |
| Models | 30+ models behind one OpenAI-compatible API |
| Pricing model | Flat monthly self-serve plans; no per-token billing on self-serve |
| Endpoint roadmap | Vision, files, batch and fine-tuning are coming soon |
TL;DR
- Separate operational, customer and commercial data before any pilot.
- Respect the IT/OT boundary; choose placement before choosing a model.
- Give each control room, crew and application its own scoped key.
- Log safety and outage-related requests for after-action review.
- Keep switching, dispatch and billing decisions with qualified staff.
How it works, step by step
- Inventory AI use cases across outage response, maintenance, safety and billing.
- Classify data by operational criticality, customer sensitivity and safety relevance.
- Choose placement per class: region cloud, VPC, on-prem, edge or air-gapped.
- Issue per-control-room and per-application keys with rotation and central inventory.
- Define log fields and retention: request ID, model, sources, output, operator decision.
- Approve a model allow-list with evaluation evidence and re-test on version changes.
- Require qualified review before output informs operations or safety procedures.
Try it yourself
Open the private LLM deployment estimator →
Grid, outage and customer data
Utility content spans public safety information, internal operating procedures, grid and asset data, outage records and customer billing details. Each class needs its own rule, and grid topology information carries security value well beyond privacy.
Start with public procedures and internal documentation, then extend to operational and customer workflows only where inference stays inside the utility boundary and retrieval indexes remain under your control.
Keys, control rooms and least privilege
Issue a distinct API key per control room, crew, application and environment. Store keys in a secrets manager, rotate on a schedule, and revoke them when contractors demobilise, which happens often during storm response. Enterprise SSO and RBAC options keep console access aligned with shift rotations and role changes across regions.
Never place customer identifiers or asset coordinates in prompts where retrieval can supply only the fields a task requires.
Residency, retention and safety audit trails
Decide where inference runs for each workflow. Region selection covers corporate use cases; on-prem, edge and air-gapped deployment covers safety and operations workflows that must stay inside the operational network. Retention applies to prompts, outputs, logs and retrieval indexes, and outage and safety records follow their own schedules.
Log enough for an after-action review: request ID, model and version, retrieved source identifiers, output and the operator decision. See AI audit logs for a schema.
Model governance and operations review
Keep an approved model list with evaluation evidence and re-test when versions change. Ground answers in current operating procedures and asset documentation with citations so crews can verify during an outage. Switching, dispatch and billing decisions stay with qualified staff, and the checklist should name the reviewer for each workflow. Plan continuity as well: multi-region and failover guidance keeps supporting services resilient when the grid itself is stressed.
Honest comparison
| Control area | Plugsky capability | Common gap | Owner |
|---|---|---|---|
| Placement | On-prem, edge, VPC or air-gapped deployment | Grid data sent to public tools | OT security |
| Identity | Scoped keys per crew and application, SSO and RBAC options | Shared control-room credentials | Security engineering |
| Resilience | Multi-region and failover guidance | No continuity plan | Operations |
| Retention | Configurable logging of requests and responses | No defined schedule | Records management |
| Audit trail | Request, model and operator logging | Outage decisions not traceable | Operations assurance |
| Review | Citations and structured output for crews | AI guidance used unreviewed | Control-room supervisor |
Frequently asked questions
Does using Plugsky make us compliant?
No. Compliance is your program. Plugsky provides deployable controls - scoped keys, private placement, logging - that you document and audit against your own safety and regulatory obligations.
Can inference stay inside the operational network?
Yes. On-prem, edge and air-gapped deployment keeps prompts, documents and embeddings inside the utility boundary, and the API stays OpenAI-compatible.
What should we log?
Request IDs, model names and versions, retrieved sources, outputs and the operator decision, retained under your policy so safety and outage events can be reconstructed.
Can AI assist in outage response?
Retrieval over current procedures works today with citations, but dispatch and switching decisions stay with qualified staff. Keep the interaction log for after-action review.
How do we handle contractor crews?
Issue separate scoped keys per contractor and crew with expiry dates, and revoke them on demobilisation without affecting permanent staff.
How do we keep services running if inference fails?
Configure fallback models and resilient deployment options, and keep manual procedures current so response never depends on a single path.
Where should a pilot start?
Pilot on public safety information and internal procedures with the free plan, validate citations and logging, then extend to operations on private or air-gapped deployment.