Key facts
| RAG endpoints | POST /v1/embeddings, POST /v1/rag/collections and POST /v1/rag/query |
| Embedding models | plugsky-embed-v1 (1536 dimensions, OpenAI-ada compatible) and plugsky-embed-large (3072 dimensions) |
| Retrieval modes | Keyword, vector and hybrid search with optional cross-encoder reranking |
| Citations | Every query returns ranked chunks with source attribution |
| Ingestion | Documents are chunked, embedded and indexed automatically per collection |
| Batch limits | Up to 2,048 inputs per embeddings request, max 8,191 tokens each |
| Data handling | Per-collection encryption at rest; API data is not used to train models |
| Deployment | Hosted, VPC, on-prem and air-gapped options; 30+ models behind one API |
TL;DR
- Separate administrative corpora from anything touching patient data.
- Run covered workloads in a VPC, on-prem or air-gapped with BYOK.
- HIPAA with a BAA plus audit logs and SIEM export support compliance review.
- Citations and human review are non-negotiable for clinically relevant answers.
- Pilot on formulary or policy documents before clinical content.
How it works, step by step
- Split use cases into administrative and patient-data workloads and set rules for each.
- Choose a first corpus with low risk and high re-use, such as formulary or coding policy.
- Create collections and ingest documents with access rules that match minimum necessary.
- Make citations mandatory and define retrieval acceptance criteria with clinical reviewers.
- Configure BYOK, audit logging, SIEM export and retention with privacy and security officers.
- Run the pilot with human review and measure retrieval against current guidelines.
- Extend scope only after governance sign-off and a documented safety review.
Original data
Try it yourself
Open the RAG chunk size calculator →
Why healthcare need RAG grounded in their own content
Healthcare has two very different AI knowledge problems. The first is administrative and policy-heavy: coding rules, formulary questions, referral procedures, staff handbooks. The second touches patient data and sits under HIPAA and clinical governance. RAG helps with both, but they need different corpora, access rules and review.
Keep protected health information out of general-purpose collections, apply minimum-necessary access, and make citations mandatory. A retrieved guideline passage that a clinician can verify is useful; an unsourced model answer is a liability.
The Plugsky RAG stack: embeddings, collections, queries
Plugsky collapses the usual multi-vendor RAG stack into three OpenAI-compatible endpoints: POST /v1/embeddings turns text into vectors, POST /v1/rag/collections creates and manages collections, and POST /v1/rag/query returns ranked chunks with citations. Ingestion is automatic — documents are chunked, embedded and indexed per collection — and retrieval supports keyword, vector and hybrid modes with optional cross-encoder reranking. The embedding models are plugsky-embed-v1 (1536 dimensions, OpenAI-ada compatible) and plugsky-embed-large (3072 dimensions). For healthcare teams, per-collection encryption and mandatory citations are what make retrieval reviewable rather than a black box.
The controls healthcare should configure first
For covered workloads, choose a deployment that keeps PHI inside your perimeter: VPC, on-prem or air-gapped, with BYOK through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM. Per-request audit logs record model, tokens, latency, user and region and export to your SIEM with retention up to 7 years, supporting access reviews and incident investigation. HIPAA with a BAA is available; SOC 2 Type II under NDA and ISO 27001/27017/27018 support the wider vendor review.
Clinical safety is a design decision, not a prompt: keep a human in the loop for anything that influences care, pin model versions, and run regular reviews of retrieval quality against current guidelines.
A practical pilot path
Start with an administrative corpus — formulary, coding or policy documents — where the risk is low and the value is immediate. Build an evaluation set with expected sources, measure retrieval before generation quality, and only then consider clinical content with governance sign-off. Prototype on the free plan, and use the 14-day full-access trial for a wider evaluation. See the live pricing page for current plans.
Honest comparison
| Capability | Plugsky | Assembling your own stack | Keyword search only |
|---|---|---|---|
| Retrieval | Keyword, vector and hybrid with optional reranking | You integrate and tune each component | Keyword matching, no semantics |
| Citations | Ranked chunks with source attribution | You build attribution yourself | Document links, not passages |
| Embeddings | plugsky-embed-v1 (1536d) and plugsky-embed-large (3072d) | Model choice spread across vendors | Not applicable |
| Deployment | Hosted, VPC, on-prem and air-gapped | Depends on every component | Usually on-prem already |
| Data handling | Per-collection encryption; API data not used to train models | You audit every vendor | Existing controls apply |
| Time to first answer | One collection and a query call | Weeks of integration work | Days, with lower answer quality |
Frequently asked questions
Is Plugsky suitable for PHI?
For covered workloads, deploy in your VPC, on-prem or air-gapped with BYOK, and sign a HIPAA BAA. Keep PHI out of shared collections and apply minimum-necessary access through scoped keys and RBAC.
Can AI make clinical decisions with this architecture?
No. This architecture is for retrieval and summarisation with citations. Keep a qualified human in the loop for any output that influences care, and pin model versions for reproducibility.
Do we have to change our application code?
No. The RAG endpoints are OpenAI-compatible, so existing SDKs, prompts and evaluation harnesses keep working when you point the base URL at Plugsky.
Is there a free plan?
Yes — plugsky-micro and plugsky-lite with 2 API keys and no credit card. A 14-day full-access trial is also available.
How is pricing structured?
Self-serve plans are flat monthly with unlimited fair-use usage and no per-token charges or overage fees. See the live pricing page for current plans.
Does Plugsky train on our data?
Plugsky states that API data is not used to train models, and collections are encrypted at rest; on Enterprise you can keep everything inside your own VPC.