Key facts
| Sovereignty criteria | Data residency, model control, operational sovereignty and compliance alignment |
| Deployment models | Plugsky cloud region, VPC/private endpoint, on-prem and fully air-gapped |
| Air-gapped mode | No internet egress, local model registry and offline update channels |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM |
| Audit | Per-request logs with region; SIEM export; retention up to 7 years |
| Compliance | SOC 2 Type II under NDA, ISO 27001, HIPAA with BAA; FedRAMP Moderate in process |
| Data planes | Region-locked planes in EU (Frankfurt), GCC (UAE), APAC (Singapore) and US (Virginia); nearest for Ireland: EU (Frankfurt) |
| Local presence | No Ireland office or data centre claimed; sovereignty comes from the deployment topology |
TL;DR
- Sovereignty covers data, models, operations and compliance — not just where servers sit.
- Plugsky publishes no Ireland facility; sovereignty comes from the deployment topology.
- Region-locked planes keep prompts, completions, embeddings and logs in the chosen region.
- Air-gapped sites run with no internet egress, a local model registry and offline updates.
- Start on the free plan with plugsky-micro and plugsky-lite, or the 14-day full-access trial.
How it works, step by step
- Write down the sovereignty criteria that apply in Ireland: residency, model control, operations and compliance.
- Map data classes, logs and sub-processors before choosing a topology.
- Pick the deployment: a region-locked plane, your VPC, on-prem or fully air-gapped.
- Settle key custody and rotation with KMS, Key Vault, Vault or an on-prem HSM.
- Define patching and model-approval workflows for restricted networks.
- Validate audit fields, SIEM export and retention against policy.
- Pilot one workload, gather the evidence procurement needs, then scale after sign-off.
Try it yourself
Open the data residency checker →
Sovereignty requirements for Ireland enterprises
Sovereign AI is four requirements at once: data residency, model control, operational sovereignty and compliance alignment. A deployment that only stores data in-country satisfies one of the four.
Ireland applies the GDPR through the Data Protection Act 2018, and the Data Protection Commission (DPC) acts as lead supervisory authority for many multinationals with EU operations based there. Technology, pharmaceuticals and medtech, financial services, and food and agri-business. English-language operations, with Irish-language duties in some public services.
For Ireland, the practical test is whether prompts, completions, embeddings and logs stay inside the required jurisdiction, whether local administrators can operate and patch the stack, and whether the evidence survives a regulator's review.
Deployment options for Ireland teams
Plugsky ships four deployment patterns for sovereign programmes:
- Region-locked cloud: pin a workspace to EU (Frankfurt), GCC (UAE), APAC (Singapore) or US (Virginia); Riyadh is available on Enterprise.
- VPC or private endpoint: the control plane inside your own AWS, Azure or GCP account with no public ingress.
- On-prem: open-weight models on hardware you operate.
- Air-gapped: no internet egress, a local model registry and offline update channels.
For Ireland, the nearest published plane is EU (Frankfurt). Where a plane satisfies only part of the requirement, the private options close the gap without changing application code.
Controls: keys, audit and evidence
Keys stay with you through BYOK in AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, with customer-managed keys and zero-knowledge mode available on Enterprise. Per-request audit logs capture model, tokens, latency, user and region, and export to your SIEM with retention up to 7 years.
Procurement can review documented programmes rather than assurances: SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process, so treat federal authorisation as pending.
From sovereign pilot to production in Ireland
Start with one workload and a written definition of the criteria that apply in Ireland. Choose the topology and key custody, define patching and model-approval flows for restricted networks, then validate audit fields, SIEM export and retention against policy before scaling.
The API stays OpenAI-compatible and one key reaches 30+ models, so existing SDK code, prompts and evaluations carry over. New accounts start on the free plan with plugsky-micro and plugsky-lite and a 14-day full-access trial; current plans are on the live pricing page.
Honest comparison
| Capability | Plugsky | Typical public-cloud AI | Building in-house |
|---|---|---|---|
| Sovereignty scope | Data, model, operations and compliance together | Usually data location only | You must build and prove all four |
| Deployment models | Cloud region, VPC, on-prem, air-gapped | Shared public cloud only | Your own infrastructure only |
| Air-gapped operation | No internet egress, offline updates | Not offered | Custom engineering effort |
| Key custody | BYOK via KMS, Key Vault, Vault or HSM | Provider-managed keys | You operate the HSMs |
| Audit evidence | Per-request logs with region, SIEM export | Often limited retention | You build the pipeline |
| Local presence in Ireland | No facility claimed; residency is deployment-based | Varies by provider | Depends on your own sites |
Frequently asked questions
Does Plugsky have a facility in Ireland?
No. Plugsky does not claim a Ireland office or data centre; sovereignty is delivered through deployment topology — a region-locked plane, your VPC, on-prem or air-gapped infrastructure.
What makes a deployment sovereign?
Four criteria at once: data residency, model control, operational sovereignty and compliance alignment. Pinning storage to a region alone does not satisfy the full set.
Which region should Ireland teams choose?
The nearest published plane is EU (Frankfurt). If regulation requires in-country processing, choose a private deployment instead of a shared region.
Can Plugsky run fully air-gapped?
Yes. Air-gapped deployments run with no internet egress, a local model registry and offline update channels, which suits defence, government and critical infrastructure programmes.
Who holds the encryption keys?
You can. BYOK is supported through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, and Enterprise adds customer-managed keys and zero-knowledge mode.
What compliance evidence is available?
SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process.
How do we prove residency to an auditor?
Export audit logs to your SIEM, keep the DPA and sub-processor list current, and document the architecture and region choice. Enterprise contracts add right-to-audit clauses and custom localisation addenda.
Does the DPC's role affect our vendor choice?
The DPC is the lead authority for many multinationals in Ireland, so cross-border processing and sub-processor terms get close scrutiny. EU (Frankfurt) residency plus a DPA and audit export supports that review.