Key facts
| API compatibility | OpenAI-compatible chat, embeddings and function calling |
| Deployment | VPC in AWS, Azure or GCP via Helm chart and Terraform module |
| Network | Private endpoint with no public ingress |
| Encryption and keys | Customer-managed KMS (AWS KMS, Azure Key Vault, GCP KMS) |
| Models | 30+ models; bring your own model registry and bucket |
| Observability | Logs, metrics and traces stay in your SIEM |
| Updates | Signed model and control-plane bundles applied on your cadence |
| Pricing | Flat monthly self-serve plans; Enterprise terms for VPC |
TL;DR
- The full control plane runs in your AWS, Azure or GCP account.
- No public ingress: the API is reachable only from your network.
- Your KMS keys and your model registry; weights stay in your bucket.
- Document review, research and drafting run inside the firm's boundary with matter-level access.
- Region-locked managed planes remain available when you do not need a VPC.
How it works, step by step
- Confirm which workloads move first and which must stay in a dedicated deployment.
- Prepare networking: private subnets, endpoints and no public ingress.
- Create KMS keys and a bucket for model weights and artifacts.
- Apply the Helm chart or Terraform module for AWS, Azure or GCP.
- Connect identity, logging and monitoring to your existing systems.
- Run acceptance tests and replay your prompts and evaluations.
- Enable signed update delivery and cut over with a rollback path ready.
Try it yourself
Open the AI data residency checklist →
Why legal teams use a VPC deployment
Legal teams handle privileged material, matter files and client confidences. They need ethical walls between matters, strict access control, retention that matches legal-hold rules and answers that cite the source document rather than paraphrase it.
For legal teams, the deciding question is where the data sits: privileged communications, matter files and client documents. A shared public endpoint pushes that decision into contracts and configuration; a VPC deployment puts the API inside the network boundary you already control, with your subnets, your identity provider and your logging. That is the difference between trusting a vendor's region and knowing the traffic never leaves your account.
What the Plugsky VPC architecture includes
Plugsky ships a Helm chart and Terraform module for AWS, Azure and GCP. The control plane installs inside your cloud account and the OpenAI-compatible API is exposed on a private endpoint with no public ingress. You supply a customer-managed KMS key for encryption at rest, and model weights live in your own bucket and registry. Logs, metrics and traces stay in your SIEM, and model and control-plane updates arrive as signed bundles you apply on your maintenance cadence with rollback.
When a full rollout is more than the workload needs, the same API runs in region-locked Plugsky planes with residency guarantees. For cross-border matters, decide per matter where processing is allowed, then map each matter to the deployment that satisfies it.
Controls to wire in from day one
Controls worth wiring in from the first deployment:
- Separate matters with their own workspaces, keys and access groups so ethical walls are enforced in infrastructure, not convention.
- Keep documents and prompts inside the deployment boundary, with retention that matches legal-hold policy.
- Use audit logs to evidence who queried what and when.
- Ground answers in retrieval so output cites the clause or document it came from.
Deploy, measure, then cut over
Document review, research and drafting run inside the firm's boundary with matter-level access. The sequence is reversible: prepare the account and network, create keys and a weights bucket, apply the module, connect identity and observability, replay evaluations, then switch the base URL behind a flag. Latency is a trade-off: closer planes shorten the path, but strict boundaries can add round-trip time, so measure p50 and p95 from your own environment.
Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live; audio, images, moderation, files, batch, fine-tuning, assistants and responses are coming soon, so label those early. Self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing; current plans are on the pricing page. Start with the free plan, then the 14-day full-access trial.
Honest comparison
| Factor | Plugsky VPC deployment | Region-locked Plugsky cloud | Building in-house |
|---|---|---|---|
| Data location | Your cloud account | Plugsky region you pin | Your data centre |
| Public ingress | None — private endpoint | Public API endpoint | Depends on your build |
| Key custody | Your KMS (AWS, Azure, GCP) | Vendor-managed; BYOK on Enterprise | Your HSM |
| Models | 30+ models, bring your own registry | 30+ managed models | You host and maintain each model |
| Updates | Signed bundles on your cadence | Managed by Plugsky | Your release engineering |
| Time to production | Days to weeks | Minutes | Weeks to months |
Frequently asked questions
How do ethical walls work in practice?
Use separate workspaces, scoped API keys and access groups per matter so retrieval and inference cannot cross matter boundaries, and log access for reviews.
Where do documents and prompts live?
In the deployment you choose — your VPC, on-prem or an air-gapped environment — with your keys and your retention rules.
Can we keep using the OpenAI SDK?
Yes. Plugsky exposes an OpenAI-compatible chat completions endpoint, so you change the base URL and model name and keep your existing SDK code, prompts and evaluations.
Is there a free plan?
Yes — the free plan includes plugsky-micro and plugsky-lite with no credit card. A 14-day full-access trial is available when you want to evaluate larger models.
How is pricing structured?
Self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing. See the live pricing page for current plans.
Which capabilities are live today?
Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live; audio, images, moderation, files, batch, fine-tuning, assistants and responses are coming soon — check the docs before planning those workloads.
How is a VPC deployment priced?
VPC runs as an Enterprise engagement with terms agreed with the team; self-serve flat monthly plans cover the managed plane. See the live pricing page for current plans.
Who operates the deployment?
You run the infrastructure; Plugsky maintains the platform software and delivers signed updates for you to apply.