Key facts
| Deployment options | Region-locked cloud plane, private VPC endpoint, on-prem and fully air-gapped |
| API compatibility | OpenAI-compatible /v1/chat/completions — change the base URL and model name |
| Models | 30+ models behind one key, from efficient to frontier tiers |
| Capacity | Flat monthly self-serve plans with unlimited fair-use usage; Enterprise sizing reviewed during procurement |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM |
| Audit | Per-request logs with model, tokens, latency, user and region; SIEM export; retention up to 7 years |
| Compliance | SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA; FedRAMP Moderate in process |
| Access control | RBAC with workspace, role and resource-level permissions; SAML/OIDC SSO and SCIM on Enterprise |
TL;DR
- Keep subscriber, network and billing data inside an operator-controlled perimeter.
- Choose region-locked cloud, VPC, on-prem or air-gapped; the API stays identical.
- BYOK and an on-prem HSM keep encryption keys under the operator, not the vendor.
- Per-request audit logs export to Splunk, Sentinel, QRadar or Datadog with retention up to 7 years.
- Pilot on internal knowledge first, then extend to customer-facing workflows.
How it works, step by step
- Classify AI workloads by data sensitivity: network telemetry, subscriber records, care transcripts, internal knowledge.
- Choose the deployment pattern for each class — region-locked plane, VPC, on-prem or air-gapped.
- Decide key custody with your security team: managed KMS or an on-prem HSM with BYOK.
- Wire audit logs into the existing SIEM and agree a retention period that matches policy.
- Run a pilot on one internal corpus, such as network runbooks or care-agent assist.
- Extend to further workloads only after security, legal and the regulator-facing team sign off.
- Review model choice and capacity quarterly as usage grows.
Original data
Try it yourself
Open the sovereign AI readiness score →
Why telcos need AI inside the operator perimeter
Telecoms run on data that is unusually sensitive and unusually interlinked: call detail records, subscriber identity data, network telemetry, billing histories and care transcripts. Internal teams want AI on top of all of it — ticket summarisation, network runbook search, field-engineer assist, churn signals — but the data cannot be handed to an unaccountable pipeline. Operators also face sector regulators and data-protection regimes that ask where processing happens and who can access it.
Private AI turns those questions into architecture: inference, embeddings and logs stay inside a perimeter the operator governs, while teams still call a standard OpenAI-compatible API.
Four deployment patterns for operator data
Plugsky supports a ladder of deployment patterns, and the same client code works at every rung:
- Region-locked cloud plane: pin processing and log storage to a published region — EU (Frankfurt), GCC (UAE), APAC (Singapore) or US (Virginia).
- Private VPC endpoint: run inside the operator's own AWS, Azure or GCP account with no public ingress.
- On-prem: open-weight models on operator hardware for BSS/OSS-adjacent workloads.
- Air-gapped: no internet egress, a local model registry and offline update channels for critical network functions.
Keys stay under operator control with BYOK through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, and RBAC, SSO and SCIM govern who can do what.
Controls, audit and vendor review
Procurement and security teams can review documented controls rather than assurances: per-request logs record model, tokens, latency, user and region, and export to Splunk, Sentinel, QRadar or Datadog with retention up to 7 years. Compliance evidence includes SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA and GDPR/EU SCC coverage; FedRAMP Moderate is in process, so treat it as pending. Enterprise contracts add a DPA with EU SCCs, sub-processor terms, right-to-audit clauses and custom SLAs.
Pin model versions where reproducible output matters for review, and keep human sign-off on any workflow that affects subscribers directly.
A realistic telco pilot
Start with one internal corpus — network runbooks, product catalogues or policy manuals — inside a region-locked plane, and measure retrieval quality and latency on real questions. Keep the OpenAI SDK and existing evaluation harness so the pilot does not become a migration project.
Prototype on the free plan with plugsky-micro and plugsky-lite, then use the 14-day full-access trial for a wider evaluation. When the workload proves out, move it to a VPC, on-prem or air-gapped deployment and review capacity during procurement. See the live pricing page for current plans.
Honest comparison
| Capability | Plugsky | Typical public-cloud AI | Building in-house |
|---|---|---|---|
| Deployment patterns | Region-locked plane, VPC, on-prem, air-gapped | Shared public cloud only | Operator infrastructure only |
| Residency | Published region-locked data planes | Usually region selectable, not pinned | You control the sites |
| Key custody | BYOK via KMS or on-prem HSM | Provider-managed keys | You operate the HSMs |
| Audit and SIEM | Per-request logs, SIEM export, retention up to 7 years | Often limited export | You build the pipeline |
| Vendor review | SOC 2 Type II under NDA, ISO 27001, HIPAA BAA, DPA with SCCs | Varies by provider | You commission the audits |
Frequently asked questions
Can telco data stay in-country?
Yes for supported regions. Plugsky publishes a region-locked GCC data plane in the UAE; where policy requires stricter placement, VPC, on-prem or air-gapped deployments keep processing on infrastructure you control.
Do we need to rewrite our applications?
No. The API is OpenAI-compatible, so migrating an existing chatbot, summariser or RAG pipeline is a base URL and model-name change.
Is there a free plan for evaluation?
Yes — plugsky-micro and plugsky-lite with 2 API keys and no card. A 14-day full-access trial supports wider evaluations.
How is capacity handled at telecom scale?
Self-serve plans are flat monthly with unlimited fair-use usage; Enterprise capacity, SLAs and deployment topology are reviewed during procurement.
Who holds encryption keys?
You can. BYOK is supported through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, with per-region envelope encryption for data at rest.
What audit evidence is available?
Per-request logs with model, tokens, latency, user and region, exportable to your SIEM, with retention up to 7 years; administrative events are covered too.
Can we keep using our existing identity provider?
Yes on Enterprise: SAML 2.0 / OIDC single sign-on plus SCIM provisioning and RBAC with workspace, role and resource-level permissions.
What compliance evidence can we review?
SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA and GDPR/EU SCC coverage; FedRAMP Moderate is in process, so treat it as pending.