Service · O-03
Enterprise RAG
Retrieval-augmented generation over your private documents, with access control mapped to your identity provider, citations enforced on every answer, audit logging throughout, and a factual-precision benchmark you agree before the build begins.
What you get
- A document inventory and classification
- Access-control lists mapped to your identity provider
- An ingestion pipeline for your document sources
- Embeddings and a vector database (Qdrant, Weaviate, or pgvector)
- Retrieval with reranking for relevance
- Citation enforcement on every generated answer
- A Ragas evaluation harness for ongoing measurement
- Audit logging of queries and retrieved sources
How it runs
The build runs over eight to fourteen weeks: document inventory and classification, ingestion and embeddings, the vector database, retrieval and reranking, citation enforcement, access control, and audit logging. We agree the evaluation benchmark up front and measure against it before sign-off.
What we need from you
- Access to the document sources in scope
- A data classification, or time to build one together
- Identity-provider access for access-control mapping
- A set of representative questions for the benchmark
Indicative price
€45k – €120k
Fixed-scope between €45,000 and €120,000, depending on the number of sources, the complexity of the access model, and the size of the document corpus.
Acceptance criteria
- ≥80% factual precision on a 200-question benchmark
- The benchmark is agreed up front, before the build
- Every answer carries citations to its sources
A measured benchmark, agreed before the build, not a subjective "it seems to work".
Questions we hear often
What can RAG not do?
RAG retrieves and grounds answers in your documents. It does not invent knowledge that is not there, and it is not a substitute for documents that do not exist. If the source material is contradictory, out of date, or missing, the system will surface that rather than paper over it. We are explicit about this because over-promising on RAG is the most common way these projects fail.
Why do you measure precision and recall?
Because 'it seems to work' is not an acceptance criterion. We agree a benchmark of around 200 representative questions up front and measure factual precision against it. The target is ≥80%. Measuring it means you can trust the number, and it gives you a baseline to track as documents change.
How is citation enforcement done?
The system is configured so that generated answers must cite the retrieved sources they are grounded in. If the retrieval step returns nothing relevant, the system says so rather than guessing. Citations make every answer auditable back to a document.
Which model do you use?
An open-weights model appropriate to your data and hardware, served on-premise. The retrieval and reranking layers do much of the heavy lifting, so the generation model is chosen for grounding quality and latency rather than raw size. As with our other builds, open-weights means no lock-in.
Where does our data live?
Entirely within your perimeter. Documents, embeddings, the vector database, and inference all run on infrastructure you control. Nothing is sent to an external API. Access-control lists are mapped to your identity provider so retrieval respects the permissions your documents already carry.
How do you handle document access controls?
Retrieval is filtered by the access-control lists we map from your identity provider, so a user only ever retrieves from documents they are permitted to see. This is designed in from the start rather than added afterwards.
What does the audit logging capture?
Queries, the sources retrieved, and the answers returned: enough to reconstruct what was asked, what was used to answer it, and who asked. That record is what makes the system defensible under regulated review.
Answers you can trace to the source.
RAG over your private documents, with citations enforced, access controls respected, and a precision benchmark you agree before we build.