Key facts
| Sovereignty criteria | Data residency, model control, operational sovereignty and compliance alignment |
| Deployment models | Plugsky cloud region, VPC/private endpoint, on-prem and fully air-gapped |
| Air-gapped mode | No internet egress, local model registry and offline update channels |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM |
| Audit | Per-request logs with region; SIEM export; retention up to 7 years |
| Compliance | SOC 2 Type II under NDA, ISO 27001, HIPAA with BAA; FedRAMP Moderate in process |
| Data planes | Region-locked planes in EU (Frankfurt), GCC (UAE), APAC (Singapore) and US (Virginia); nearest for France: EU (Frankfurt) |
| Local presence | No France office or data centre claimed; sovereignty comes from the deployment topology |
TL;DR
- Sovereignty covers data, models, operations and compliance — not just where servers sit.
- Plugsky publishes no France facility; sovereignty comes from the deployment topology.
- Region-locked planes keep prompts, completions, embeddings and logs in the chosen region.
- Air-gapped sites run with no internet egress, a local model registry and offline updates.
- Start on the free plan with plugsky-micro and plugsky-lite, or the 14-day full-access trial.
How it works, step by step
- Write down the sovereignty criteria that apply in France: residency, model control, operations and compliance.
- Map data classes, logs and sub-processors before choosing a topology.
- Pick the deployment: a region-locked plane, your VPC, on-prem or fully air-gapped.
- Settle key custody and rotation with KMS, Key Vault, Vault or an on-prem HSM.
- Define patching and model-approval workflows for restricted networks.
- Validate audit fields, SIEM export and retention against policy.
- Pilot one workload, gather the evidence procurement needs, then scale after sign-off.
Try it yourself
Open the sovereign AI readiness assessment →
Sovereignty requirements for France enterprises
Sovereign AI is four requirements at once: data residency, model control, operational sovereignty and compliance alignment. A deployment that only stores data in-country satisfies one of the four.
France applies the GDPR with guidance from the CNIL, and ANSSI's SecNumCloud qualification defines the 'cloud de confiance' benchmark used for state and sensitive workloads. Banking and insurance, defence and aerospace, healthcare, retail and public administration. French-language user content with English developer documentation.
For France, the practical test is whether prompts, completions, embeddings and logs stay inside the required jurisdiction, whether local administrators can operate and patch the stack, and whether the evidence survives a regulator's review.
Deployment options for France teams
Plugsky ships four deployment patterns for sovereign programmes:
- Region-locked cloud: pin a workspace to EU (Frankfurt), GCC (UAE), APAC (Singapore) or US (Virginia); Riyadh is available on Enterprise.
- VPC or private endpoint: the control plane inside your own AWS, Azure or GCP account with no public ingress.
- On-prem: open-weight models on hardware you operate.
- Air-gapped: no internet egress, a local model registry and offline update channels.
For France, the nearest published plane is EU (Frankfurt). Where a plane satisfies only part of the requirement, the private options close the gap without changing application code.
Controls: keys, audit and evidence
Keys stay with you through BYOK in AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, with customer-managed keys and zero-knowledge mode available on Enterprise. Per-request audit logs capture model, tokens, latency, user and region, and export to your SIEM with retention up to 7 years.
Procurement can review documented programmes rather than assurances: SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process, so treat federal authorisation as pending.
From sovereign pilot to production in France
Start with one workload and a written definition of the criteria that apply in France. Choose the topology and key custody, define patching and model-approval flows for restricted networks, then validate audit fields, SIEM export and retention against policy before scaling.
The API stays OpenAI-compatible and one key reaches 30+ models, so existing SDK code, prompts and evaluations carry over. New accounts start on the free plan with plugsky-micro and plugsky-lite and a 14-day full-access trial; current plans are on the live pricing page.
Honest comparison
| Capability | Plugsky | Typical public-cloud AI | Building in-house |
|---|---|---|---|
| Sovereignty scope | Data, model, operations and compliance together | Usually data location only | You must build and prove all four |
| Deployment models | Cloud region, VPC, on-prem, air-gapped | Shared public cloud only | Your own infrastructure only |
| Air-gapped operation | No internet egress, offline updates | Not offered | Custom engineering effort |
| Key custody | BYOK via KMS, Key Vault, Vault or HSM | Provider-managed keys | You operate the HSMs |
| Audit evidence | Per-request logs with region, SIEM export | Often limited retention | You build the pipeline |
| Local presence in France | No facility claimed; residency is deployment-based | Varies by provider | Depends on your own sites |
Frequently asked questions
Does Plugsky have a facility in France?
No. Plugsky does not claim a France office or data centre; sovereignty is delivered through deployment topology — a region-locked plane, your VPC, on-prem or air-gapped infrastructure.
What makes a deployment sovereign?
Four criteria at once: data residency, model control, operational sovereignty and compliance alignment. Pinning storage to a region alone does not satisfy the full set.
Which region should France teams choose?
The nearest published plane is EU (Frankfurt). If regulation requires in-country processing, choose a private deployment instead of a shared region.
Can Plugsky run fully air-gapped?
Yes. Air-gapped deployments run with no internet egress, a local model registry and offline update channels, which suits defence, government and critical infrastructure programmes.
Who holds the encryption keys?
You can. BYOK is supported through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, and Enterprise adds customer-managed keys and zero-knowledge mode.
What compliance evidence is available?
SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process.
How do we prove residency to an auditor?
Export audit logs to your SIEM, keep the DPA and sub-processor list current, and document the architecture and region choice. Enterprise contracts add right-to-audit clauses and custom localisation addenda.
Does SecNumCloud affect our programme?
SecNumCloud qualification matters most for state and sensitive workloads; confirm whether your programme requires a qualified provider. Otherwise the EU plane plus a DPA and audit-log export covers standard GDPR duties.