Key facts
| API compatibility | OpenAI-compatible chat, embeddings and function calling |
| Deployment | VPC in AWS, Azure or GCP via Helm chart and Terraform module |
| Network | Private endpoint with no public ingress |
| Encryption and keys | Customer-managed KMS (AWS KMS, Azure Key Vault, GCP KMS) |
| Models | 30+ models; bring your own model registry and bucket |
| Observability | Logs, metrics and traces stay in your SIEM |
| Updates | Signed model and control-plane bundles applied on your cadence |
| Pricing | Flat monthly self-serve plans; Enterprise terms for VPC |
TL;DR
- The full control plane runs in your AWS, Azure or GCP account.
- No public ingress: the API is reachable only from your network.
- Your KMS keys and your model registry; weights stay in your bucket.
- Citizen-facing services and internal case work run under a defined sovereignty boundary.
- Region-locked managed planes remain available when you do not need a VPC.
How it works, step by step
- Confirm which workloads move first and which must stay in a dedicated deployment.
- Prepare networking: private subnets, endpoints and no public ingress.
- Create KMS keys and a bucket for model weights and artifacts.
- Apply the Helm chart or Terraform module for AWS, Azure or GCP.
- Connect identity, logging and monitoring to your existing systems.
- Run acceptance tests and replay your prompts and evaluations.
- Enable signed update delivery and cut over with a rollback path ready.
Try it yourself
Open the sovereign AI readiness assessment →
Why government teams use a VPC deployment
Government teams process citizen records, case files and procurement documents under sovereignty rules. Procurement asks for controlled processing, auditability and a clear answer on where data — and model weights — actually live.
For government teams, the deciding question is where the data sits: citizen records, case files and procurement documents. A shared public endpoint pushes that decision into contracts and configuration; a VPC deployment puts the API inside the network boundary you already control, with your subnets, your identity provider and your logging. That is the difference between trusting a vendor's region and knowing the traffic never leaves your account.
What the Plugsky VPC architecture includes
Plugsky ships a Helm chart and Terraform module for AWS, Azure and GCP. The control plane installs inside your cloud account and the OpenAI-compatible API is exposed on a private endpoint with no public ingress. You supply a customer-managed KMS key for encryption at rest, and model weights live in your own bucket and registry. Logs, metrics and traces stay in your SIEM, and model and control-plane updates arrive as signed bundles you apply on your maintenance cadence with rollback.
When a full rollout is more than the workload needs, the same API runs in region-locked Plugsky planes with residency guarantees. Confirm the current region map and contractual wording in the data-residency documentation, the DPA and the SLA before you commit to a topology.
Controls to wire in from day one
Controls worth wiring in from the first deployment:
- Choose the region or deployment that satisfies the residency rule, then document the data path end to end.
- Keep cryptographic keys under the agency's control rather than the vendor's.
- Retain audit records where oversight bodies can retrieve them.
- For classified or critical workloads, plan an air-gapped deployment with a local model registry and offline updates.
Deploy, measure, then cut over
Citizen-facing services and internal case work run under a defined sovereignty boundary. The sequence is reversible: prepare the account and network, create keys and a weights bucket, apply the module, connect identity and observability, replay evaluations, then switch the base URL behind a flag. Latency is a trade-off: closer planes shorten the path, but strict boundaries can add round-trip time, so measure p50 and p95 from your own environment.
Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live; audio, images, moderation, files, batch, fine-tuning, assistants and responses are coming soon, so label those early. Self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing; current plans are on the pricing page. Start with the free plan, then the 14-day full-access trial.
Honest comparison
| Factor | Plugsky VPC deployment | Region-locked Plugsky cloud | Building in-house |
|---|---|---|---|
| Data location | Your cloud account | Plugsky region you pin | Your data centre |
| Public ingress | None — private endpoint | Public API endpoint | Depends on your build |
| Key custody | Your KMS (AWS, Azure, GCP) | Vendor-managed; BYOK on Enterprise | Your HSM |
| Models | 30+ models, bring your own registry | 30+ managed models | You host and maintain each model |
| Updates | Signed bundles on your cadence | Managed by Plugsky | Your release engineering |
| Time to production | Days to weeks | Minutes | Weeks to months |
Frequently asked questions
Does a VPC deployment meet sovereignty requirements?
It is one option among cloud, on-prem and air-gapped. Choose based on your jurisdiction's rules, and validate the contractual terms in the DPA and SLA with the team.
Can it run air-gapped?
Yes. Air-gapped deployments use a local model registry and offline update channels for environments with no internet egress.
Can we keep using the OpenAI SDK?
Yes. Plugsky exposes an OpenAI-compatible chat completions endpoint, so you change the base URL and model name and keep your existing SDK code, prompts and evaluations.
Is there a free plan?
Yes — the free plan includes plugsky-micro and plugsky-lite with no credit card. A 14-day full-access trial is available when you want to evaluate larger models.
How is pricing structured?
Self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing. See the live pricing page for current plans.
Which capabilities are live today?
Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live; audio, images, moderation, files, batch, fine-tuning, assistants and responses are coming soon — check the docs before planning those workloads.
How is a VPC deployment priced?
VPC runs as an Enterprise engagement with terms agreed with the team; self-serve flat monthly plans cover the managed plane. See the live pricing page for current plans.
Who operates the deployment?
You run the infrastructure; Plugsky maintains the platform software and delivers signed updates for you to apply.