Key facts
| Sovereignty criteria | Data residency, model control, operational sovereignty and compliance alignment |
| Deployment models | Plugsky cloud region, VPC/private endpoint, on-prem and fully air-gapped |
| Air-gapped mode | No internet egress, local model registry and offline update channels |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM |
| Audit | Per-request logs with region; SIEM export; retention up to 7 years |
| Compliance | SOC 2 Type II under NDA, ISO 27001, HIPAA with BAA; FedRAMP Moderate in process |
| Data planes | Region-locked planes in EU (Frankfurt), GCC (UAE), APAC (Singapore) and US (Virginia); nearest for Australia: APAC (ap-southeast-1, Singapore) |
| Local presence | No Australia office or data centre claimed; sovereignty comes from the deployment topology |
TL;DR
- Sovereignty covers data, models, operations and compliance — not just where servers sit.
- Plugsky publishes no Australia facility; sovereignty comes from the deployment topology.
- Region-locked planes keep prompts, completions, embeddings and logs in the chosen region.
- Air-gapped sites run with no internet egress, a local model registry and offline updates.
- Start on the free plan with plugsky-micro and plugsky-lite, or the 14-day full-access trial.
How it works, step by step
- Write down the sovereignty criteria that apply in Australia: residency, model control, operations and compliance.
- Map data classes, logs and sub-processors before choosing a topology.
- Pick the deployment: a region-locked plane, your VPC, on-prem or fully air-gapped.
- Settle key custody and rotation with KMS, Key Vault, Vault or an on-prem HSM.
- Define patching and model-approval workflows for restricted networks.
- Validate audit fields, SIEM export and retention against policy.
- Pilot one workload, gather the evidence procurement needs, then scale after sign-off.
Original data
Try it yourself
Open the sovereign AI readiness score →
What sovereign AI means for Australia
Sovereign AI is four requirements at once: data residency, model control, operational sovereignty and compliance alignment. A deployment that only stores data in-country satisfies one of the four.
Australia's Privacy Act 1988 and the Australian Privacy Principles are enforced by the Office of the Australian Information Commissioner (OAIC), and government cloud typically expects an IRAP assessment against the ISM. Banking and superannuation, government, mining and resources, healthcare and education are the main adopters. English-language workloads with accessibility obligations in the public sector.
Auditors and procurement boards increasingly ask about all four criteria, not just server location. A deployment that only stores data in-country satisfies one of them, which is why the architecture and the evidence trail have to be designed together.
Deployment options for Australia teams
Plugsky ships four deployment patterns for sovereign programmes:
- Region-locked cloud: pin a workspace to EU (Frankfurt), GCC (UAE), APAC (Singapore) or US (Virginia); Riyadh is available on Enterprise.
- VPC or private endpoint: the control plane inside your own AWS, Azure or GCP account with no public ingress.
- On-prem: open-weight models on hardware you operate.
- Air-gapped: no internet egress, a local model registry and offline update channels.
For Australia, the nearest published plane is APAC (ap-southeast-1, Singapore). Where a plane satisfies only part of the requirement, the private options close the gap without changing application code.
Controls: keys, audit and evidence
Keys stay with you through BYOK in AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, with customer-managed keys and zero-knowledge mode available on Enterprise. Per-request audit logs capture model, tokens, latency, user and region, and export to your SIEM with retention up to 7 years.
Procurement can review documented programmes rather than assurances: SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process, so treat federal authorisation as pending.
From sovereign pilot to production in Australia
Start with one workload and a written definition of the criteria that apply in Australia. Choose the topology and key custody, define patching and model-approval flows for restricted networks, then validate audit fields, SIEM export and retention against policy before scaling.
The API stays OpenAI-compatible and one key reaches 30+ models, so existing SDK code, prompts and evaluations carry over. New accounts start on the free plan with plugsky-micro and plugsky-lite and a 14-day full-access trial; current plans are on the live pricing page.
Honest comparison
| Capability | Plugsky | Typical public-cloud AI | Building in-house |
|---|---|---|---|
| Sovereignty scope | Data, model, operations and compliance together | Usually data location only | You must build and prove all four |
| Deployment models | Cloud region, VPC, on-prem, air-gapped | Shared public cloud only | Your own infrastructure only |
| Air-gapped operation | No internet egress, offline updates | Not offered | Custom engineering effort |
| Key custody | BYOK via KMS, Key Vault, Vault or HSM | Provider-managed keys | You operate the HSMs |
| Audit evidence | Per-request logs with region, SIEM export | Often limited retention | You build the pipeline |
| Local presence in Australia | No facility claimed; residency is deployment-based | Varies by provider | Depends on your own sites |
Frequently asked questions
Does Plugsky have a facility in Australia?
No. Plugsky does not claim a Australia office or data centre; sovereignty is delivered through deployment topology — a region-locked plane, your VPC, on-prem or air-gapped infrastructure.
What makes a deployment sovereign?
Four criteria at once: data residency, model control, operational sovereignty and compliance alignment. Pinning storage to a region alone does not satisfy the full set.
Which region should Australia teams choose?
The nearest published plane is APAC (ap-southeast-1, Singapore). If regulation requires in-country processing, choose a private deployment instead of a shared region.
Can Plugsky run fully air-gapped?
Yes. Air-gapped deployments run with no internet egress, a local model registry and offline update channels, which suits defence, government and critical infrastructure programmes.
Who holds the encryption keys?
You can. BYOK is supported through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, and Enterprise adds customer-managed keys and zero-knowledge mode.
What compliance evidence is available?
SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process.
How do we prove residency to an auditor?
Export audit logs to your SIEM, keep the DPA and sub-processor list current, and document the architecture and region choice. Enterprise contracts add right-to-audit clauses and custom localisation addenda.
Does the Singapore plane meet Australian government expectations?
Government cloud often expects an IRAP assessment and certified hosting, which is a bespoke process. The APAC plane suits commercial workloads; public-sector programmes should start with the assessment path.