Key facts
| Sovereignty criteria | Data residency, model control, operational sovereignty and compliance alignment |
| Deployment models | Plugsky cloud region, VPC/private endpoint, on-prem and fully air-gapped |
| Air-gapped mode | No internet egress, local model registry and offline update channels |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM |
| Audit | Per-request logs with region; SIEM export; retention up to 7 years |
| Compliance | SOC 2 Type II under NDA, ISO 27001, HIPAA with BAA; FedRAMP Moderate in process |
| Data planes | Region-locked planes in EU (Frankfurt), GCC (UAE), APAC (Singapore) and US (Virginia); nearest for Singapore: APAC (ap-southeast-1, Singapore) |
| Local presence | No Singapore office or data centre claimed; sovereignty comes from the deployment topology |
TL;DR
- Sovereignty covers data, models, operations and compliance — not just where servers sit.
- Plugsky publishes no Singapore facility; sovereignty comes from the deployment topology.
- Region-locked planes keep prompts, completions, embeddings and logs in the chosen region.
- Air-gapped sites run with no internet egress, a local model registry and offline updates.
- Start on the free plan with plugsky-micro and plugsky-lite, or the 14-day full-access trial.
How it works, step by step
- Write down the sovereignty criteria that apply in Singapore: residency, model control, operations and compliance.
- Map data classes, logs and sub-processors before choosing a topology.
- Pick the deployment: a region-locked plane, your VPC, on-prem or fully air-gapped.
- Settle key custody and rotation with KMS, Key Vault, Vault or an on-prem HSM.
- Define patching and model-approval workflows for restricted networks.
- Validate audit fields, SIEM export and retention against policy.
- Pilot one workload, gather the evidence procurement needs, then scale after sign-off.
Original data
Try it yourself
Open the sovereign AI readiness score →
What sovereign AI means for Singapore
Sovereign AI is four requirements at once: data residency, model control, operational sovereignty and compliance alignment. A deployment that only stores data in-country satisfies one of the four.
Singapore's Personal Data Protection Act (PDPA) is administered by the Personal Data Protection Commission (PDPC), and MAS guidelines add technology-risk and outsourcing expectations for financial institutions. Financial services, logistics and supply chain, biomedical sciences and government digital services are the core demand centres. English-first products with Chinese, Malay and Tamil content requirements.
Auditors and procurement boards increasingly ask about all four criteria, not just server location. A deployment that only stores data in-country satisfies one of them, which is why the architecture and the evidence trail have to be designed together.
Deployment options for Singapore teams
Plugsky ships four deployment patterns for sovereign programmes:
- Region-locked cloud: pin a workspace to EU (Frankfurt), GCC (UAE), APAC (Singapore) or US (Virginia); Riyadh is available on Enterprise.
- VPC or private endpoint: the control plane inside your own AWS, Azure or GCP account with no public ingress.
- On-prem: open-weight models on hardware you operate.
- Air-gapped: no internet egress, a local model registry and offline update channels.
For Singapore, the nearest published plane is APAC (ap-southeast-1, Singapore). The APAC plane is hosted in Singapore itself. Where a plane satisfies only part of the requirement, the private options close the gap without changing application code.
Controls: keys, audit and evidence
Keys stay with you through BYOK in AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, with customer-managed keys and zero-knowledge mode available on Enterprise. Per-request audit logs capture model, tokens, latency, user and region, and export to your SIEM with retention up to 7 years.
Procurement can review documented programmes rather than assurances: SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process, so treat federal authorisation as pending.
From sovereign pilot to production in Singapore
Start with one workload and a written definition of the criteria that apply in Singapore. Choose the topology and key custody, define patching and model-approval flows for restricted networks, then validate audit fields, SIEM export and retention against policy before scaling.
The API stays OpenAI-compatible and one key reaches 30+ models, so existing SDK code, prompts and evaluations carry over. New accounts start on the free plan with plugsky-micro and plugsky-lite and a 14-day full-access trial; current plans are on the live pricing page.
Honest comparison
| Capability | Plugsky | Typical public-cloud AI | Building in-house |
|---|---|---|---|
| Sovereignty scope | Data, model, operations and compliance together | Usually data location only | You must build and prove all four |
| Deployment models | Cloud region, VPC, on-prem, air-gapped | Shared public cloud only | Your own infrastructure only |
| Air-gapped operation | No internet egress, offline updates | Not offered | Custom engineering effort |
| Key custody | BYOK via KMS, Key Vault, Vault or HSM | Provider-managed keys | You operate the HSMs |
| Audit evidence | Per-request logs with region, SIEM export | Often limited retention | You build the pipeline |
| Local presence in Singapore | No facility claimed; residency is deployment-based | Varies by provider | Depends on your own sites |
Frequently asked questions
Does Plugsky have a facility in Singapore?
No. Plugsky does not claim a Singapore office or data centre; sovereignty is delivered through deployment topology — a region-locked plane, your VPC, on-prem or air-gapped infrastructure.
What makes a deployment sovereign?
Four criteria at once: data residency, model control, operational sovereignty and compliance alignment. Pinning storage to a region alone does not satisfy the full set.
Which region should Singapore teams choose?
The nearest published plane is APAC (ap-southeast-1, Singapore). The APAC plane is hosted in Singapore itself. If regulation requires in-country processing, choose a private deployment instead of a shared region.
Can Plugsky run fully air-gapped?
Yes. Air-gapped deployments run with no internet egress, a local model registry and offline update channels, which suits defence, government and critical infrastructure programmes.
Who holds the encryption keys?
You can. BYOK is supported through AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM, and Enterprise adds customer-managed keys and zero-knowledge mode.
What compliance evidence is available?
SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA, and GDPR-aligned DPAs with sub-processor terms and right-to-audit clauses. FedRAMP Moderate is in process.
How do we prove residency to an auditor?
Export audit logs to your SIEM, keep the DPA and sub-processor list current, and document the architecture and region choice. Enterprise contracts add right-to-audit clauses and custom localisation addenda.
Does the Singapore plane satisfy PDPA and MAS expectations?
The published APAC plane is hosted in Singapore, which supports PDPA-aligned residency; enforcement is architectural rather than contractual. MAS outsourcing duties still need to be mapped per workload.