Ingest
Forward it in chat or drop it on the dashboard. Encrypted before it touches disk.
Document Brain
Your files, searchable, and honest about what they do not say.
A PDF you forwarded in March, answering a question you asked in August — with the page it came from. This page is the long version: how it works, what protects it, and what is still not proven.
The pipeline
Four steps, and nothing hidden in between.
Extract
Text from PDFs, OCR from images. Page numbers are kept, because a citation without one is a claim.
Index
Chunked, then indexed twice — once for words, once for meaning.
Answer
Retrieve, rank, answer, cite. If the passages do not cover it, say so.
Hybrid retrieval
Two searches, because one of them always misses.
Keyword search finds an invoice number, a VAT id, a surname — the things people actually ask about, and exactly where meaning-based search is weakest. Meaning-based search finds the paragraph you can only half remember. Both run, and their rankings are merged, so a question of either kind lands.
Getting this wrong once is why it works this way: an early version searched by meaning alone and could not find a client’s surname sitting in plain text on page one.
What an answer looks like
What was the notice period we agreed?
Sixty days, in writing, either side. The clause reads: “Either party may terminate on sixty (60) days’ written notice.”
contratto-acme.pdf · page 4
And the penalty for late payment?
The passages I have do not mention one. I would rather say that than guess.
The second answer matters as much as the first. A retrieval system that always finds something is a retrieval system that sometimes invents it.
What protects it
Three guarantees, each with a test behind it.
A key per object
Every stored file gets its own key, wrapped by the master key. One file is one blast radius.
Deletion that means it
Deleting a document removes the chunks and the embeddings with it. A test proves the agent can no longer answer from it.
A document cannot give orders
Retrieved text is wrapped as untrusted before a model sees it, scanned for instruction-shaped patterns, and anything suspicious is written to your audit log.
32
sanitisation and injection checks
27
action-gating checks
17
memory checks
619
checks in total, on every push
Still unproven
The parts we would not claim yet.
A page that lists only what works is a page you cannot calibrate against. These are the gaps as they stand.
- Vector search is not exercised in CI — it needs a real embedding key, so continuous integration runs the lexical half only.
- Audio and video are not read. A voice note is transcribed as a message; it does not become a document.
- Answers draw on one document at a time. Synthesising across several is a known next step, not a shipped feature.