Key facts
| API surface | OpenAI-compatible /v1/chat/completions; change base_url and model name |
| Deployment | Plugsky cloud, your VPC, on-prem or air-gapped |
| Data residency | Region selection and sovereign deployment options |
| Models | 30+ models behind one API, including long-context and multilingual options |
| Access control | Scoped API keys and request logs; enterprise RBAC and SSO |
| Pricing | Flat monthly self-serve plans; see the live pricing page |
| Free tier | Free plan with 2 free AI models (plugsky-micro, plugsky-lite), no card |
| Contracting | DPA and SLA documents available for review |
TL;DR
- Keep clinical, safety and batch records inside a boundary you control: region choice, VPC, on-prem or air-gapped.
- Evaluate residency, retention, auditability, model choice and exit before you commit.
- 30+ models behind one OpenAI-compatible API, so trusted application layers do not change with deployment.
- Start on the free plan or the 14-day full-access trial, then move the same workload to a private deployment.
- Keep the evaluation set and evidence pack so periodic re-review stays repeatable.
How it works, step by step
- Map where trial data, safety reports, submission dossiers, lab notebooks and batch records live today and which systems are in scope.
- Write down residency, retention and access requirements, and who signs off on each.
- Shortlist deployment modes: managed cloud, VPC, on-prem or air-gapped, per study phase and data sensitivity.
- Run a pilot on the free plan or the 14-day full-access trial with a fixed set of real scientific questions.
- Score answers, citations, refusals, latency and cost on the same test.
- Complete security, DPA, SLA and vendor-review documentation, with exportable logs and a documented exit plan.
- Roll out use case by use case and re-run the evaluation after each model or deployment change.
Original data
Try it yourself
Open the AI data residency checklist →
What sovereign AI means for pharmaceuticals
Sovereign AI for pharmaceuticals means the models, prompts and retrieved data stay under your jurisdiction and operational control. In practice that means a deployment you can place in your own region or network, with identity, logging and retention governed by the controls your quality and IT teams already run.
The business case is not secrecy for its own sake: it is keeping clinical trial data, safety case reports, submission material and manufacturing records inside a boundary you can audit, while still using modern models through a standard API.
The five things to evaluate
Score every candidate on these five areas, and require evidence rather than claims:
- Residency and deployment: region choice, and whether VPC, on-prem and air-gapped options actually exist.
- Data handling: whether prompts and outputs are used for training, how long they are retained, and which subprocessors are involved.
- Access and audit: scoped API keys, RBAC and SSO for enterprise, and request-level logs you can export.
- Model choice and portability: how many models you can route between, and how hard it is to move away.
- Commercials and exit: predictable pricing, SLA terms, and a documented data-return path.
Deployment modes and their trade-offs
Cloud is fastest: a managed, region-based deployment with residency selection. VPC puts inference inside your own cloud account and network boundary. On-prem runs in your data center; air-gapped runs with no outbound connectivity at all. The trade-off is operational: the further you move from managed cloud, the more you own upgrades, capacity and monitoring.
Life-sciences teams often start on managed cloud for evaluation, then move the same OpenAI-compatible workload to a private deployment when trial, patient or batch data must stay inside a controlled environment. Because the API surface does not change, application code usually stays put.
A scorecard approach to procurement
Run a structured evaluation: define ten questions that represent real pharmaceutical work, test two or three models, and score answers, citations and refusals. Add a review covering identity, key rotation, logging and data flow, then a commercial review covering pricing predictability, SLA and exit.
Begin on the free plan or the 14-day full-access trial, document the decision, and keep the evaluation set so you can re-run it after every model or deployment change.
Honest comparison
| Evaluation area | Plugsky | Vendor cloud-only | Building in-house |
|---|---|---|---|
| Residency | Region selection plus sovereign deployment options | Usually vendor regions only | Fully under your control |
| Deployment modes | Cloud, VPC, on-prem, air-gapped | Managed cloud only | Your infrastructure |
| Model choice | 30+ models behind one API | Single vendor catalogue | You host each model |
| Auditability | Scoped keys and request logs; enterprise RBAC and SSO | Vendor-defined logging | You build logging |
| Pricing | Flat monthly self-serve plans; see live pricing | Often per-token or per-seat | GPU plus operations cost |
| Time to production | Fast on managed cloud; private options for sensitive workloads | Fast but fixed residency | Months of build and ops |
Frequently asked questions
What makes an AI deployment sovereign?
Sovereign deployment keeps models, prompts and data under your jurisdiction and control: you choose the region, own the boundary, and keep identity, logging and retention under your existing governance.
Can we keep data inside our own country or network?
Yes. Plugsky supports region selection plus VPC, on-prem and air-gapped deployments, so inference and data can sit where your study, partner or regulator requires.
Does Plugsky train on our data?
For strict requirements, choose a private or air-gapped deployment so content stays inside your environment. Review the current data-handling terms and DPA for cloud plans before rollout.
Can we start without a private deployment?
Yes. Evaluate on the free plan, which includes two free AI models with no card, or the 14-day full-access trial, then move the same workload to a private deployment for production.
How do we avoid lock-in?
Plugsky is OpenAI-compatible: applications use a standard API, so you can change base_url and model name with minimal code changes, and keep your evaluation set to compare alternatives.
Do you claim GxP or regulatory compliance?
No. Plugsky provides deployment, residency, logging and access-control capabilities; qualification, validation and compliance mapping remain with your team, quality function and auditors.
Can we keep unpublished or pre-approval material private?
Yes. Keep pre-approval dossiers and unpublished findings in a private deployment with scoped keys and logs, and separate document collections by programme or therapeutic area.