Key facts
| Encryption at rest | AES-256 with per-region KMS envelope encryption |
| Encryption in transit | TLS 1.3 only, HSTS preloaded |
| Authentication | Bearer API keys; SAML 2.0 and OIDC SSO on Enterprise |
| Authorization | RBAC with workspace, role and resource scopes; SCIM and mTLS on Enterprise |
| Audit logs | Every request logged with model, token count, latency, IP, user and region; SIEM export |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or on-prem HSM |
| Compliance | SOC 2 Type II report under NDA; ISO 27001/27017/27018; HIPAA with BAA; GDPR/PDPL |
| FedRAMP | Moderate in process (targeted Q4 2026) |
TL;DR
- Data is encrypted with AES-256 at rest and TLS 1.3 in transit.
- Keys are scoped and role-based; SSO, SCIM and mTLS are Enterprise options.
- Audit logs are exportable to your SIEM and retainable up to 7 years.
- BYOK keeps key custody with you via KMS or on-prem HSM.
- FedRAMP Moderate is in process — treat it as pending, not available.
How it works, step by step
- Issue narrowly scoped API keys — never give production keys admin scope.
- Enforce TLS 1.3 at your edge and rotate keys on a quarterly schedule.
- Turn on workspace RBAC and define roles before inviting team members.
- Configure SAML or OIDC SSO and SCIM provisioning on Enterprise.
- Export audit logs to your SIEM and set a retention period that matches policy.
- Enable BYOK or zero-knowledge mode for regulated workloads.
Original data
Try it yourself
Open the sovereign AI readiness scorecard →
Encryption and key custody
Data at rest is encrypted with AES-256 using envelope encryption and per-region KMS keys. In transit, the platform accepts TLS 1.3 only and serves HSTS-preloaded endpoints. Customers who need to own key custody can bring keys from AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM; optional per-request encryption is available for highly regulated workloads, and zero-knowledge mode lets your gateway encrypt before data reaches the model.
Secrets hygiene matters as much as algorithms: keys are never logged or returned in responses, and stored credentials are hashed with Argon2id.
Authentication and authorization
API requests authenticate with a bearer key. Keys carry scopes and roles — the built-in read role can list models and view usage, infer can run chat, embeddings and other inference, and admin adds key management, billing and RBAC. Enterprise adds SAML 2.0 and OIDC SSO, SCIM provisioning and mTLS for service-to-service calls.
- Rotate keys quarterly; old keys stay valid briefly so deployments roll without brownouts.
- Use per-key rate limits to contain a leaked credential.
- Keep admin keys out of application runtimes.
Audit logging and observability
Every request is logged with a timestamp, model, prompt and completion hashes, token count, latency, IP, user ID and region. Audit logs export to SIEM platforms such as Splunk, Sentinel, QRadar and Datadog. Retention defaults to 90 days and can extend up to 7 years on Enterprise. Key lifecycle events — creation, rotation, scope change and deletion — are logged separately so security teams can reconstruct who did what.
Compliance status, stated honestly
Plugsky documents SOC 2 Type II, ISO 27001, ISO 27017 and ISO 27018 programs, HIPAA with a BAA, GDPR with EU SCCs, and PDPL alignment for Saudi Arabia and the wider GCC. The SOC 2 Type II report is available to customers under NDA through the account team.
Where the platform is not there yet: FedRAMP Moderate is in process with a Q4 2026 target on the live page, so do not plan federal workloads on the assumption that authorization is already granted. Confirm current status with the security team before procurement.
Honest comparison
| Control | Plugsky | Typical API vendor | Self-hosted stack |
|---|---|---|---|
| Encryption at rest | AES-256, per-region KMS | Usually AES-256 | You configure |
| Key custody | BYOK via KMS or on-prem HSM | Often vendor-managed only | You own |
| SSO and provisioning | SAML, OIDC, SCIM on Enterprise | Varies | You integrate |
| Audit export | SIEM export, up to 7-year retention | Varies | You build it |
| Compliance reports | SOC 2 Type II under NDA; ISO and HIPAA programs | Varies | You certify yourself |
| FedRAMP | Moderate in process (targeted Q4 2026) | Some vendors authorized | Very expensive |
Frequently asked questions
How do I get a SOC 2 Type II report?
Enterprise customers can request the report under NDA from their account manager or via the security contact published in the docs.
Is BYOK available on self-serve?
BYOK is Enterprise-only. Self-serve uses Plugsky-managed KMS keys per region.
How do I enable SAML SSO?
On Enterprise, enable SAML SSO in workspace settings. Entra ID, Okta, Google Workspace, Ping and ADFS are supported, along with any SAML 2.0-compliant identity provider.
What is zero-knowledge mode?
Your gateway encrypts prompts before they are sent, so the model and platform never see plaintext. It is intended for highly regulated workloads where end-to-end confidentiality is mandatory.
How long are audit logs retained?
The default is 90 days, configurable up to 7 years on Enterprise.
Is FedRAMP authorization available today?
No. FedRAMP Moderate is in process with a targeted Q4 2026 milestone; confirm current status with Plugsky before committing federal workloads.
How do I report a vulnerability?
Email the security contact published in the docs with the report; the team responds and credits researchers through its disclosure program.
Plugsky (2026). “Security Reference — Encryption, Auth, Compliance”. Plugsky. Available at: https://plugsky.com/docs/security (last updated 2026-09-25).