Key facts
| Sovereignty criteria | Data residency, model control, operational sovereignty and compliance alignment |
| Deployment models | Plugsky cloud region, VPC/private endpoint, on-prem and fully air-gapped |
| Air-gapped mode | No internet egress, local model registry and offline update channels |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM |
| Audit | Per-request logs with region; SIEM export; retention up to 7 years |
| Compliance | SOC 2 Type II under NDA, ISO 27001, HIPAA with BAA; FedRAMP Moderate in process |
| Data planes | Region-locked planes in EU (Frankfurt), GCC (UAE), APAC (Singapore) and US (Virginia); nearest for Netherlands: EU (Frankfurt) |
| Local presence | No Netherlands office or data centre claimed; sovereignty comes from the deployment topology |
TL;DR
- Sovereignty covers data, models, operations and compliance — not just where servers sit.
- Plugsky publishes no Netherlands facility; sovereignty comes from the deployment topology.
- Region-locked planes keep prompts, completions, embeddings and logs in the chosen region.
- Air-gapped sites run with no internet egress, a local model registry and offline updates.
- Start on the free plan with plugsky-micro and plugsky-lite, or the 14-day full-access trial.
How it works, step by step
- Write down the sovereignty criteria that apply in Netherlands: residency, model control, operations and compliance.
- Map data classes, logs and sub-processors before choosing a topology.
- Pick the deployment: a region-locked plane, your VPC, on-prem or fully air-gapped.
- Settle key custody and rotation with KMS, Key Vault, Vault or an on-prem HSM.
- Define patching and model-approval workflows for restricted networks.
- Validate audit fields, SIEM export and retention against policy.
- Pilot one workload, gather the evidence procurement needs, then scale after sign-off.
Try it yourself
Open the AI data residency checklist →
The Netherlands case for sovereign AI
Sovereign AI is four requirements at once: data residency, model control, operational sovereignty and compliance alignment. A deployment that only stores data in-country satisfies one of the four.
The Netherlands applies the GDPR through the UAVG, supervised by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Logistics and ports, financial services, agriculture and food, energy and the public sector. Dutch-language products with very high English proficiency in engineering teams.
Sovereignty is a property of the deployment, not a marketing badge. That distinction matters in Netherlands, where sector rules and public-sector expectations often go beyond the baseline privacy statute.
Deployment options for Netherlands teams
Plugsky ships four deployment patterns for sovereign programmes:
- Region-locked cloud: pin a workspace to EU (Frankfurt), GCC (UAE), APAC (Singapore) or US (Virginia); Riyadh is available on Enterprise.
- VPC or private endpoint: the control plane inside your own AWS, Azure or GCP account with no public ingress.
- On-prem: open-weight models on hardware you operate.
- Air-gapped: no internet egress, a local model registry and offline update channels.
For Netherlands, the nearest published plane is EU (Frankfurt). Where a plane satisfies only part of the requirement, the private options close the gap without changing application code.
Controls: keys, audit and evidence
Keys stay with you through BYOK in AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, with customer-managed keys and zero-knowledge mode available on Enterprise. Per-request audit logs capture model, tokens, latency, user and region, and export to your SIEM with retention up to 7 years.
Procurement can review documented programmes rather than assurances: SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process, so treat federal authorisation as pending.
From sovereign pilot to production in Netherlands
Start with one workload and a written definition of the criteria that apply in Netherlands. Choose the topology and key custody, define patching and model-approval flows for restricted networks, then validate audit fields, SIEM export and retention against policy before scaling.
The API stays OpenAI-compatible and one key reaches 30+ models, so existing SDK code, prompts and evaluations carry over. New accounts start on the free plan with plugsky-micro and plugsky-lite and a 14-day full-access trial; current plans are on the live pricing page.
Honest comparison
| Capability | Plugsky | Typical public-cloud AI | Building in-house |
|---|---|---|---|
| Sovereignty scope | Data, model, operations and compliance together | Usually data location only | You must build and prove all four |
| Deployment models | Cloud region, VPC, on-prem, air-gapped | Shared public cloud only | Your own infrastructure only |
| Air-gapped operation | No internet egress, offline updates | Not offered | Custom engineering effort |
| Key custody | BYOK via KMS, Key Vault, Vault or HSM | Provider-managed keys | You operate the HSMs |
| Audit evidence | Per-request logs with region, SIEM export | Often limited retention | You build the pipeline |
| Local presence in Netherlands | No facility claimed; residency is deployment-based | Varies by provider | Depends on your own sites |
Frequently asked questions
Does Plugsky have a facility in the Netherlands?
No. Plugsky does not claim a Netherlands office or data centre; sovereignty is delivered through deployment topology — a region-locked plane, your VPC, on-prem or air-gapped infrastructure.
What makes a deployment sovereign?
Four criteria at once: data residency, model control, operational sovereignty and compliance alignment. Pinning storage to a region alone does not satisfy the full set.
Which region should Netherlands teams choose?
The nearest published plane is EU (Frankfurt). If regulation requires in-country processing, choose a private deployment instead of a shared region.
Can Plugsky run fully air-gapped?
Yes. Air-gapped deployments run with no internet egress, a local model registry and offline update channels, which suits defence, government and critical infrastructure programmes.
Who holds the encryption keys?
You can. BYOK is supported through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, and Enterprise adds customer-managed keys and zero-knowledge mode.
What compliance evidence is available?
SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process.
How do we prove residency to an auditor?
Export audit logs to your SIEM, keep the DPA and sub-processor list current, and document the architecture and region choice. Enterprise contracts add right-to-audit clauses and custom localisation addenda.
Is the EU plane suitable for Dutch public-sector work?
The EU plane in Frankfurt covers GDPR residency; Dutch public-sector buyers may add national cloud and transparency criteria, so confirm their framework early and choose a private deployment if required.