Key facts
| Deployment path | Region-locked cloud plane now; VPC, on-prem and air-gapped on Enterprise |
| API compatibility | OpenAI-compatible /v1/chat/completions — change the base URL and model name |
| Model access | 30+ models from efficient to frontier tiers behind one key |
| Free plan | plugsky-micro and plugsky-lite with 2 API keys, no card required |
| Trial | 14-day full-access trial available |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM |
| Audit | Per-request logs with model, tokens, latency, user and region; SIEM export; retention up to 7 years |
| Migration effort | One line of code: the base URL, plus a model name |
TL;DR
- Keep the OpenAI SDK and move the endpoint, not the codebase.
- Start free with plugsky-micro and plugsky-lite while you validate the product.
- Add region pinning, BYOK and audit logs early enough to answer security questionnaires.
- Move to a VPC, on-prem or air-gapped deployment when a contract requires it — same API.
- Flat monthly self-serve plans keep burn predictable while you grow.
How it works, step by step
- Collect the security questions your buyers ask and map each one to a control: residency, keys, audit.
- Build on the free plan with the OpenAI SDK pointed at api.plugsky.com and a scoped key per environment.
- Pin a region-locked data plane before you process customer content.
- Turn on audit logs and export them to your SIEM before the first enterprise deal.
- Write the control story into your security page and questionnaire answers.
- Move to a VPC or on-prem deployment when a contract demands network isolation.
- Review usage and model choice monthly; route cheap tasks to smaller models.
Original data
Try it yourself
Open the private LLM deployment estimator →
What private AI means for an early-stage startup
Startups rarely begin with a data centre, but they do begin with security questionnaires. Enterprise buyers ask where prompts and outputs are processed, who can read them, and how access is attributed. Private AI answers those questions by keeping inference, embeddings and logs inside a perimeter you control, while still exposing a standard API your engineers already know.
Plugsky's deployment ladder maps to startup stages: a region-locked cloud plane for the first customers, a private VPC endpoint when procurement asks for network isolation, and on-prem or air-gapped options when a contract demands them. The API stays the same across all three.
Start hosted, then move the perimeter without a rewrite
Point the OpenAI SDK at https://api.plugsky.com/v1, map your model names, and you are running. That is the whole migration: the base URL changes, the request and response shapes do not. When the first enterprise contract arrives, the same client code runs against a VPC endpoint or an on-prem deployment.
Between those stages, keep the unglamorous controls in place early: a scoped API key per environment, secrets in a manager rather than in code, region pinning before you process customer content, and audit logs switched on before anyone asks for them.
The controls that close enterprise deals
Three controls come up in almost every security review. Residency: choose a region-locked plane — EU (Frankfurt), GCC (UAE), APAC (Singapore) or US (Virginia) — so prompts, embeddings and logs stay where policy requires. Key custody: BYOK through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM keeps encryption keys under your control. Audit: per-request logs with model, tokens, latency, user and region export to your SIEM, with retention up to 7 years.
Compliance evidence supports the same review: SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and FedRAMP Moderate in process. Publish these on your own security page so buyers can self-serve the first pass.
A cost-aware path from MVP to production
Begin on the free plan with plugsky-micro and plugsky-lite and no card, so the first prototype costs nothing. As usage grows, self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing, which keeps burn predictable while you are still finding product-market fit. When volume justifies it, Enterprise adds the deployment options, key custody and contractual terms above.
One key reaches 30+ models, so a cheap model can draft and a stronger one can review sensitive answers without a second vendor contract. See the live pricing page for current plans.
Honest comparison
| Capability | Plugsky | Typical hosted AI API | Building in-house |
|---|---|---|---|
| Deployment options | Cloud region, VPC, on-prem and air-gapped | Shared public cloud only | Your infrastructure only |
| Time to first request | Minutes on the free plan | Minutes | Weeks of setup and ops |
| Key custody | BYOK via KMS or on-prem HSM | Provider-managed keys | You operate the HSMs |
| Compliance evidence | SOC 2 Type II, ISO 27001 and HIPAA with a BAA | Varies by provider | You commission the audits |
| Cost model | Flat monthly self-serve, no per-token billing | Per-token usage bills | GPU plus operations cost |
Frequently asked questions
Can a two-person startup get private AI?
Yes. Begin on the hosted region-locked plane with the free plan, keep the OpenAI SDK, and move to a VPC or on-prem deployment when a customer requires it. The application code does not change.
Do we need to rewrite our app to use Plugsky?
No. The API is OpenAI-compatible, so you change the base URL and model name and keep your existing SDK, prompts and tests.
Is there a free plan?
Yes — plugsky-micro and plugsky-lite with 2 API keys and no credit card. A 14-day full-access trial is also available.
How is pricing structured?
Self-serve plans are flat monthly with unlimited fair-use usage and no per-token charges or overage fees. See the live pricing page for current plans.
What does BYOK change for us?
You keep custody of encryption keys through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, so keys can be revoked or rotated without moving your data.
When should we move to a VPC or on-prem?
As soon as a contract, regulator or security review requires it. Because the migration is an endpoint change, it can follow the deal instead of blocking it.
What compliance evidence can we show buyers?
SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR/EU SCC coverage. FedRAMP Moderate is in process, so treat it as pending.