Key facts
| Single sign-on | SAML 2.0 / OIDC SSO on Enterprise |
| Provisioning | SCIM user provisioning and deprovisioning on Enterprise |
| Permission model | RBAC with workspace, role and resource-level permissions |
| API keys | Scoped keys per project, environment or tenant; per-key rate limits and quotas |
| Audit logs | Request and admin events export to SIEM (Splunk, Sentinel, QRadar, Datadog) |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM |
| Compliance | SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA; FedRAMP Moderate in process |
| Deployment | Hosted, VPC, on-prem and air-gapped with the same API |
TL;DR
- One access model serves internal hygiene and enterprise security reviews.
- Scoped keys per service and tenant beat shared credentials every time.
- Support access should be a named, logged, ideally time-bound role.
- SSO and SCIM let customer admins manage their own users.
- Audit export and retention answer the strictest questionnaires.
How it works, step by step
- List the access questions that appear in your enterprise questionnaires.
- Issue scoped keys per service and environment, and per tenant where applicable.
- Define staff roles, including a limited support role for customer investigations.
- Enable audit logging and confirm user, model and region fields are captured.
- Add SSO and SCIM for customer admins when enterprise demand appears.
- Set retention and SIEM export to match buyer requirements.
- Publish the control model on your security page and keep it current.
Try it yourself
Open the AI API key security checklist →
Why SaaS teams need an access model
SaaS teams meet access control twice: internally, for their own staff and services, and externally, in the security review that gates every enterprise deal. The same design answers both. Buyers ask how support staff access their data, how keys are scoped, and what evidence exists after the fact.
Build the internal model first — scoped keys per service and environment, roles for staff, audit logging on — then reuse it as the story you tell in questionnaires. Security pages write themselves when the architecture is real.
The four layers: identity, permission, keys, evidence
Start with identity, then constrain what each identity can do. Federation uses SAML 2.0 or OIDC on Enterprise; SCIM provisions and removes users automatically. Authorisation is RBAC with workspace, role and resource-level permissions, and machine access is separated into scoped API keys per project, environment or tenant with their own rate limits and quotas. Everything is observable: request and administrative events export to Splunk, Sentinel, QRadar or Datadog, and retention runs up to 7 years. For SaaS teams, these four layers are also the answers to the access-control section of an enterprise security questionnaire.
Controls SaaS teams should configure first
Map the platform to your tenancy model. If customers share an application, give each tenant a collection boundary and a key held server-side; if you run per-tenant deployments, keep the same role model so operations stay uniform. Support access should be a named, logged role rather than a shared credential, ideally time-bound for sensitive investigations.
For enterprise readiness, SSO and SCIM mean customer admins can provision and revoke their own users, and audit logs with user, model and region fields support SOC 2 evidence and incident response. Retention up to 7 years and SIEM export cover buyers with stricter logging requirements, and BYOK is available where key custody is part of the review.
A practical rollout order
Ship in order of buyer impact: audit logging first, then scoped keys per service, then role separation for support, then SSO and SCIM when the first enterprise contract requires them. Prototype on the free plan and use Enterprise for federated identity. See the live pricing page for current plans.
Honest comparison
| Control | Plugsky | Shared API keys only | Building in-house |
|---|---|---|---|
| Single sign-on | SAML 2.0 / OIDC on Enterprise | Not available | You integrate the IdP |
| Deprovisioning | SCIM on Enterprise | Manual key deletion | Custom lifecycle jobs |
| Permission granularity | Workspace, role and resource-level | One key for everything | You build the model |
| Key scoping | Per project, environment or tenant, with quotas | Shared key, no attribution | Custom key service |
| Audit evidence | Request and admin events with SIEM export | Limited request logs | You build the pipeline |
| Key custody | BYOK via KMS or on-prem HSM | Provider-managed keys | You operate the HSMs |
Frequently asked questions
What should we build first for enterprise readiness?
Audit logging and scoped keys. They address the most common questionnaire items, improve incident response, and cost little to adopt early.
How do support engineers access customer data safely?
Give them a limited role with logged, ideally time-bound access, and never a shared credential. Audit entries then show exactly which engineer acted for which tenant.
Do we need the OpenAI SDK to change?
No. Authentication and access control sit alongside the same OpenAI-compatible API, so application code keeps working when keys or roles change.
Is there a free plan?
Yes — plugsky-micro and plugsky-lite with 2 API keys and no credit card. A 14-day full-access trial is also available.
How is pricing structured?
Self-serve plans are flat monthly with unlimited fair-use usage and no per-token charges or overage fees. See the live pricing page for current plans.
Can we keep our own identity provider?
Yes on Enterprise: SAML 2.0 / OIDC SSO and SCIM provisioning work with standard identity providers, and RBAC maps your roles to workspace and resource permissions.