Key facts
| API compatibility | OpenAI-compatible chat, embeddings and function calling |
| Deployment | VPC in AWS, Azure or GCP via Helm chart and Terraform module |
| Network | Private endpoint with no public ingress |
| Encryption and keys | Customer-managed KMS (AWS KMS, Azure Key Vault, GCP KMS) |
| Models | 30+ models; bring your own model registry and bucket |
| Observability | Logs, metrics and traces stay in your SIEM |
| Updates | Signed model and control-plane bundles applied on your cadence |
| Pricing | Flat monthly self-serve plans; Enterprise terms for VPC |
TL;DR
- The full control plane runs in your AWS, Azure or GCP account.
- No public ingress: the API is reachable only from your network.
- Your KMS keys and your model registry; weights stay in your bucket.
- One architecture you operate, with per-client isolation and predictable platform costs.
- Region-locked managed planes remain available when you do not need a VPC.
How it works, step by step
- Confirm which workloads move first and which must stay in a dedicated deployment.
- Prepare networking: private subnets, endpoints and no public ingress.
- Create KMS keys and a bucket for model weights and artifacts.
- Apply the Helm chart or Terraform module for AWS, Azure or GCP.
- Connect identity, logging and monitoring to your existing systems.
- Run acceptance tests and replay your prompts and evaluations.
- Enable signed update delivery and cut over with a rollback path ready.
Try it yourself
Open the private LLM cost estimator →
Why MSPs use a VPC deployment
MSPs already run the tooling, contracts and first-line support for their clients. AI is an attach service: bundle it into managed contracts, keep per-client isolation, and protect margin with predictable platform costs.
For MSPs, the deciding question is where the data sits: client business data across many tenants. A shared public endpoint pushes that decision into contracts and configuration; a VPC deployment puts the API inside the network boundary you already control, with your subnets, your identity provider and your logging. That is the difference between trusting a vendor's region and knowing the traffic never leaves your account.
What the Plugsky VPC architecture includes
Plugsky ships a Helm chart and Terraform module for AWS, Azure and GCP. The control plane installs inside your cloud account and the OpenAI-compatible API is exposed on a private endpoint with no public ingress. You supply a customer-managed KMS key for encryption at rest, and model weights live in your own bucket and registry. Logs, metrics and traces stay in your SIEM, and model and control-plane updates arrive as signed bundles you apply on your maintenance cadence with rollback.
When a full rollout is more than the workload needs, the same API runs in region-locked Plugsky planes with residency guarantees. A two-tier offer works well: managed plane for most clients, dedicated VPC or on-prem for the ones with strict rules, all on the same API.
Controls to wire in from day one
Controls worth wiring in from the first deployment:
- Standardise one deployment pattern per client tier so onboarding is repeatable.
- Issue per-client keys and limits, and meter usage for billing and margin analysis.
- Keep client logs and data separated inside a single architecture you operate.
- Offer a dedicated VPC or on-prem tier when a client's regulation demands it.
Deploy, measure, then cut over
One architecture you operate, with per-client isolation and predictable platform costs. The sequence is reversible: prepare the account and network, create keys and a weights bucket, apply the module, connect identity and observability, replay evaluations, then switch the base URL behind a flag. Latency is a trade-off: closer planes shorten the path, but strict boundaries can add round-trip time, so measure p50 and p95 from your own environment.
Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live; audio, images, moderation, files, batch, fine-tuning, assistants and responses are coming soon, so label those early. Self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing; current plans are on the pricing page. Start with the free plan, then the 14-day full-access trial.
Honest comparison
| Factor | Plugsky VPC deployment | Region-locked Plugsky cloud | Building in-house |
|---|---|---|---|
| Data location | Your cloud account | Plugsky region you pin | Your data centre |
| Public ingress | None — private endpoint | Public API endpoint | Depends on your build |
| Key custody | Your KMS (AWS, Azure, GCP) | Vendor-managed; BYOK on Enterprise | Your HSM |
| Models | 30+ models, bring your own registry | 30+ managed models | You host and maintain each model |
| Updates | Signed bundles on your cadence | Managed by Plugsky | Your release engineering |
| Time to production | Days to weeks | Minutes | Weeks to months |
Frequently asked questions
Should MSPs offer VPC deployments?
Offer a managed cloud tier by default and a dedicated VPC or on-prem tier for clients with strict rules. One API and one key model keeps both tiers supportable.
Can we isolate each client's workloads?
Yes — per-client keys, limits and separation, plus deployment choice where regulation demands it, with usage metered per tenant for billing.
Can we keep using the OpenAI SDK?
Yes. Plugsky exposes an OpenAI-compatible chat completions endpoint, so you change the base URL and model name and keep your existing SDK code, prompts and evaluations.
Is there a free plan?
Yes — the free plan includes plugsky-micro and plugsky-lite with no credit card. A 14-day full-access trial is available when you want to evaluate larger models.
How is pricing structured?
Self-serve plans are flat monthly with unlimited fair-use usage and no per-token billing. See the live pricing page for current plans.
Which capabilities are live today?
Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live; audio, images, moderation, files, batch, fine-tuning, assistants and responses are coming soon — check the docs before planning those workloads.
How is a VPC deployment priced?
VPC runs as an Enterprise engagement with terms agreed with the team; self-serve flat monthly plans cover the managed plane. See the live pricing page for current plans.
Who operates the deployment?
You run the infrastructure; Plugsky maintains the platform software and delivers signed updates for you to apply.