Onboarding
Question:
How do we actually do this here?
Assistant:
The assistant pulls the answer from the handbook, the wiki and old tickets - with a link to the passage, so new colleagues learn the source and not just the answer.
Search company documents with AI: an internal AI assistant that cites its sources
Knowledge sits scattered across file shares, wikis and tickets, and people ask the colleague who knows. An internal AI assistant answers questions from your documents, names the passage it used and shows each person only what they are allowed to see.
- Internal AI assistant with citations
- Permissions apply before retrieval
- Start with a RAG proof of value
The situation
The knowledge exists. Finding it takes time.
Documents, wikis, tickets and databases grow for years in separate systems. Whoever needs something asks colleagues instead of systems. Three patterns recur in almost every company.
Knowledge is scattered
Handbook in the wiki, contract in the DMS, fix in an old ticket, policy as a PDF on the network drive. Every store has its own search, and none knows the others.
Searching takes time
Full-text search finds words, not the answer. Without the term used in the document you find nothing or too much, and in the end someone gets asked who is actually busy with something else.
Knowledge leaves with people
Long-serving staff know which version applies and where it lives. When that person changes role or retires, the route to the knowledge is gone, even though the documents remain.
AI knowledge management
AI knowledge management for business: answers with citations
Staff ask in their own words. The assistant searches the approved sources and answers with document, section and version. The interface is Open WebUI, with user management and sign-in through your existing login.
Quotes and contracts
Question:
What exactly did we commit to for this customer?
Assistant:
It finds the relevant passage in your contract and quote archive and cites it, instead of someone searching through five file shares.
Technical documentation
Question:
How was this customer's setup configured?
Assistant:
It answers from runbooks, tickets and documentation and shows which document in which version the answer came from.
Support and service desk
Question:
Have we seen this error before?
Assistant:
It searches resolved tickets and knowledge articles and returns the earlier fix, including the ticket number.
Policies and compliance
Question:
What are we allowed to do here?
Assistant:
It answers from the valid version of your policies and names the version date, instead of an outdated PDF in a folder.
Research in your own material
Question:
What have we already written on this topic?
Assistant:
It finds text modules, earlier projects and references. That is the starting point for a draft, not a replacement for the author.
Permissions and sources
Permissions apply before retrieval, the sources stay authoritative
The most common design mistake is telling the language model what it must not show. That is not access control, it is a request. Permissions apply at three points - and only the middle one decides.
- 01
At indexing time
The connector carries the permissions over from the source: owner, direct shares, group shares, inherited folder rights. They are normalised and stored on every passage - not only on the document, because passages are what gets retrieved.
- 02
Before the vector search
This is where it is decided. The signed-in user's groups are resolved and turned into a mandatory search filter. The database only ever sees the query with that filter attached. What the user may not see is not a worse match - it is no match at all.
- 03
At citation time
Before output, the retrieved passages are checked against the source again. A share may have been revoked between the indexing run and the query. This second check costs milliseconds and catches exactly the case that would otherwise be expensive.
The knowledge base can draw from these systems
- File shares and document folders
- Nextcloud and SharePoint
- DMS and document archives
- Wikis and manuals
- Tickets and service documentation
- Databases and APIs
The source systems remain authoritative. Connectors carry content, versions, and permissions into the search index and refresh it on an agreed schedule. Group memberships are read from your directory service at runtime, not frozen at indexing time. A change of department takes effect with the next request; the cache of a few minutes can be dropped deliberately for critical role changes.
- Sign-inGroups from the directory
- Search scopeapproved sections only
- Citationre-checked against the source
Evidence and co-determination
Three designs, three outcomes
| Where the check sits | What happens when a permission is revoked | Does it hold? |
|---|---|---|
| In the prompt ("do not show anything from folder X") | Nothing. The passage is already in the model's context and can come back out through a differently phrased question. | No |
| After the search, as a filter on the result list | The hit disappears from the list - but it was already retrieved, and the number of hits reveals that something is there. | Partly |
| Before the search, as a condition of the query | The passage is outside the search space. It cannot be retrieved, cannot be counted and cannot be inferred. | Yes |
- On 17 October 2025 the German Data Protection Conference (DSK) published guidance on RAG systems, recommending among other things permission and role concepts as well as access restrictions on the vector database. We build along that line - and we lay the architecture open so your data protection officer can examine it rather than having to take it on trust. RAG with permissions
- In Germany, an assistant that logs requests triggers the works council's co-determination right under section 87(1) no. 6 of the Works Constitution Act, regardless of intent. What works: involve the works council before selection, log only what operations need, evaluate only in aggregate and record the result in a works agreement. We supply the technical description for it and do not replace legal advice. AI assistants and the works council
Approach and price
From proof of value to a production assistant
The bottleneck is rarely the model. It lies in the sources, the permissions and the question of which version applies. That is why the path starts with a bounded corpus.
Step 1
RAG proof of value
A bounded knowledge area is made searchable and tested against 40 to 60 reference questions with sources. You receive a quality report and a reasoned recommendation on whether expansion is worthwhile. Its price is credited against the production knowledge assistant.
from €9,900 excl. VAT
Step 2
Production Knowledge Assistant
Connect the sources, permission model from the directory service, prepare the content, Open WebUI with your login, test questions and acceptance in the target environment.
from €34,900 excl. VAT
Included
- One use case with up to three approved standard sources
- One SSO integration, RBAC and ingestion pipeline with vector store
- Chat interface, evaluation framework and agreed reference test set
- Staging and production, logging and observability
- Technical documentation, key-user training and operational handover
Scope details
Outcome and verification
- Acceptance of agreed functionality, source attribution, permissions and operational checks in the target environment.
Quoted separately
- New GPU/AI platform, arbitrary custom adapters and HA · Additional applications and ongoing operations
- Delivery timeframe
- 4–8 weeks
Introduce an internal knowledge assistant into production on a suitable existing platform.
Step 3
Operations and quality
New documents are picked up automatically; answer quality, cost and errors are measured regularly. You receive infrastructure code, runbooks and training; operation by us is an option, taking it over yourself a documented path.
from €1,990 excl. VAT / month
Terms and notes
Delivery starts once agreed data, access and stakeholders are available. The binding scope and price are defined in your proposal. Hardware, hosting, model consumption, licences and ongoing operations are quoted separately. Follow-on projects are costed against reusable results. We credit the pilot price when you commission the production rollout; there is no requirement to purchase every stage. All prices are net and exclude statutory VAT. The offers are addressed to businesses.
Limits
When an internal assistant does not pay off
We would rather build a smaller system that holds than a large one nobody opens after three months.
The knowledge is in people's heads, not in documents
- Before a knowledge assistant can provide answers, expertise must be captured and reviewed. Our knowledge transfer pilot processes your interviews and documents with subject-matter approval. Your team can add further content independently.
Nobody knows which version counts
- If three versions of the same handbook are in circulation, an assistant only makes the confusion faster to retrieve. Clean up first, then connect.
Permissions are unresolved
- Without clean groups and ownership nobody can say who may see what. That is organisational work no system takes off your hands.
It is a handful of always-identical questions
- Then a good FAQ page or a form is cheaper and faster. An assistant pays off where the questions are varied and the sources are many.
An assistant does not make poor sources better; it only shows faster that they are poor. If the documentation does not hold up, we advise against the project.
Alternative
What about Microsoft 365 Copilot?
Copilot and your own assistant solve related tasks under different conditions. The decision depends mainly on where your knowledge lives.
Take Copilot if
- Your relevant knowledge sits essentially entirely in Microsoft 365 - SharePoint, OneDrive, Teams, Exchange.
- Your permissions there are already properly maintained. Copilot inherits them, and that is its strength.
- You hold M365 licences anyway and the per-seat add-on adds up for you.
- Processing in the Microsoft cloud is acceptable for your data.
Take your own assistant if
- Your knowledge is spread out - Nextcloud, a DMS, a wiki, file shares, an ERP.
- Professional secrecy, trade secrets or contract terms rule out processing outside your control.
- You want to choose or change the model yourself rather than being given one.
- You do not want to pay per head, because only part of the workforce needs the system.
- You want catalogue, configuration and index back if you switch providers.
The two are not mutually exclusive. Some organisations use Copilot for office work and run their own assistant alongside it for the corpora that do not belong there. For context: Copilot reaches external sources through connectors. For the usual source types - Confluence, wikis, file shares, SQL, CRM - those are indexing connectors, so your content ends up additionally in the Microsoft index. There is no prebuilt connector for Nextcloud, and building an indexing one yourself is the expensive route.
Implementation
What sits underneath, technically
Technically this is retrieval-augmented generation (RAG): the answer is built from the retrieved passages, not from training data, which is why it can name its source. The components are open and individually replaceable:
The building blocks
- Qdrant: vector databaseStores the passages as vectors and finds the ones that match by meaning, even when the question is phrased differently from the text.
- LiteLLM: model gatewayOne entry point for all models: European ones such as Mistral, local ones, or both. Switch without touching the application.
- Langfuse: reportingShows what is being asked, what it costs and where answers are weak. Without measurement, quality stays a gut feeling.
- Open WebUI: interfaceThe chat interface for your staff, with user management and a connection to your existing login.
Where it runs
- Explore the AI platformHosted in Germany: Open WebUI with knowledge bases and models, no hardware of your own.
- See the AI CubeThe assistant runs locally on your hardware, for example on the AI Cube with Open WebUI and a prepared model inside your own network, or hosted in German data centres.
- See the offer finderWe run the same stack ourselves: the offer finder on this website is built on it.
Might fit better
- Knowledge navigatorWhen public or association knowledge should be opened up in a guided way.
- AgentsWhen something should be done, not just answered: tickets, workflows, systems.
- Service assistantWhen service knowledge for a machine family should be available with traceable versions and sources.
- RAG for professional secrecy holders?For law firms, medical practices, notaries & more we build the assistant locally - the data stays in-house, and we take on a written secrecy obligation as a contributing person.
Frequently asked questions about the internal AI assistant
Answers to the most important questions
- An AI knowledge base makes approved company sources searchable in natural language. Documents, wikis, tickets, DMS platforms, file shares, or databases are indexed; on a question, the system retrieves relevant passages and cites them. The source systems remain authoritative, and permissions have to apply before retrieval.
- The entry point is the RAG proof of value (from €9,900 excl. VAT): a bounded corpus tested against reference questions. Rolling out a production knowledge assistant is from €34,900 excl. VAT, ongoing operations with quality measurement (Managed LLMOps) from €1,990 excl. VAT / month. The binding price depends on the number and type of sources, the state of the permissions, the PDF share, the number of different views and the operating model; it is stated in the quote. Hardware, hosting and model usage are itemised separately.
- The proof of value takes two to three weeks, the production rollout of the first use case four to eight weeks, each counted from the provision of the agreed data, access and contacts. It starts with an inventory: which sources exist, who may see what, and which questions should be answered? Further sources are added afterwards without rebuilding the system.
- At indexing time the shares are carried over from the source and stored on every passage. Before each search the signed-in user’s groups are resolved from the directory and turned into a mandatory filter - the database only ever sees the query with that filter. Before output the hits are checked against the source again, in case a share was revoked in the meantime. What matters is that the filter sits before the search and not in the prompt.
- All common formats - unstructured texts (PDFs, Word documents, Markdown), semi-structured data (JSON, XML), APIs, databases (SQL, NoSQL), knowledge graphs, Confluence, SharePoint, and many more. We analyze your specific data sources and develop the appropriate connectors.
- Locally on your hardware, such as the AI Cube, or hosted in German data centres. The model is an open-source model run locally or a European model such as Mistral. The application always talks to the LiteLLM gateway, never directly to the model, so switching is a configuration change rather than a rebuild. You decide what leaves the building.
- Every answer names the document, passage and version it came from; one click is enough to verify it. If the assistant finds no cited passage, it says so instead of formulating something. RAG reduces invented answers but does not rule out errors. How often the assistant finds nothing is shown in the quality report, and the topic list from it doubles as your editorial backlog.
- Copilot is the shorter route if your knowledge sits essentially entirely in Microsoft 365 and permissions there are maintained - it inherits them, and that is its strength. Your own assistant pays off if your knowledge is spread out (Nextcloud, DMS, wiki, file shares, ERP), if professional or trade secrecy rules out processing outside your control, if you want to choose the model yourself, or if a per-seat licence does not add up because only part of the workforce needs the system.
Reviews & projects
What clients say about working with us
From a knowledge base with an AI assistant and local AI integration to data sovereignty and ongoing operations.
AI Platform
We were looking for a secure yet easy-to-use alternative to the large American providers and came across WZ-IT. WZ-IT advised us on choosing the right models and implemented the integration for us. Beforehand, we were able to try everything out calmly on a test instance. Today WZ-IT runs Open WebUI for us on our own domain, with a convenient Microsoft login and open-source models hosted by a German provider. Our team can now work productively with AI without resorting to external tools or shadow AI. Working together is straightforward, and questions are answered quickly and clearly. With WZ-IT we also have a partner at our side for further AI projects. (translated)
Carl-Frederic KornHead of E-Commerce & Online Marketing, Krüger Dirndl GmbH
Knowledge Management & AI
The knowledge from many years in the solar industry lived in the head of our former managing director, and it still lives in the heads of our employees today. We wanted to secure it, not as a folder full of notes, but in a way that lets us ask questions in daily work and get reliable answers. WZ-IT advised us from the start and weighed different approaches and knowledge management systems against each other with us before we decided. What was built is a custom knowledge base with an AI assistant that brings together conversations, notes, documentation and manuals: from the platform through onboarding our team to support in operation. Conversations are transcribed and facts are extracted; we review and correct everything ourselves before it is stored, because we do not want to trust an AI blindly. The system runs in our own environment, and the data stays with us. What surprised us was how efficient it was: WZ-IT used existing open-source software and extended it specifically for our requirements, instead of selling an expensive custom build from scratch, as is often usual with IT service providers. Timo and Robin understood our actual problem, preserving knowledge during the generational handover, and implemented it step by step: from the proof of concept through setup and validation with our own data to productive operation, explaining everything clearly along the way. Next, we want to extend this to the knowledge of our employees, so that this does not depend on individual people either.
Joshua von AmelnManaging Director, solarwerkstatt berlin GmbH
Read client reviews
International
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Enquiry
Assess an internal AI assistant
Name the knowledge sources, user groups, and key questions the assistant should answer.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.