An assistant that answers from your documents, wikis and databases - with permissions enforced technically before retrieval. Built on an open stack, operated by us or by you, handed over with documentation.
Your company knowledge is scattered across documents, wikis, tickets and databases - and whoever searches asks colleagues instead of systems. An internal AI assistant based on RAG connects these sources to a language model: answers come from your content, with citations, and everyone sees only what they are allowed to see. We build it as your system - from mapping the sources through the permission architecture to production operations.
Documents, wikis, tickets, databases. Every answer names the passage it came from, so people can check it instead of having to believe it.
Whoever may not open a document never gets it quoted. Permissions apply before retrieval, not as a filter on the result.
Open components, European or local models, operated by us, in an EU cloud or on your hardware. The system belongs to you.
The common pattern: the answer is written down somewhere, but the fastest route to it currently runs through a colleague who has no time right now.
Question: How do we actually do this here?
Assistant: The assistant pulls the answer from the handbook, the wiki and old tickets - with a link to the passage, so new colleagues learn the source and not just the answer.
Question: What exactly did we commit to for this customer?
Assistant: It finds the relevant passage in your contract and quote archive and cites it, instead of someone searching through five file shares.
Question: How was this customer's setup configured?
Assistant: It answers from runbooks, tickets and documentation and shows which document in which version the answer came from.
Question: Have we seen this error before?
Assistant: It searches resolved tickets and knowledge articles and returns the earlier fix, including the ticket number.
Question: What are we allowed to do here?
Assistant: It answers from the valid version of your policies and names the version date, instead of an outdated PDF in a folder.
Question: What have we already written on this topic?
Assistant: It finds text modules, earlier projects and references. That is the starting point for a draft, not a replacement for the author.
The bottleneck is rarely the model. It is the sources, the permissions and the question of whose version counts.
We map where knowledge lives: file shares, Nextcloud, wiki, ticket system, databases. This regularly reveals which store nobody maintains any more - that is a result too.
Which group may see which source? Permissions come from your directory service and are applied on every request, before anything is retrieved.
Documents are split into meaningful passages (chunking), translated into vectors (embeddings) and stored in a vector database, usually Qdrant. This is the technical part nobody sees later.
The interface is Open WebUI or your existing channel. Behind the LiteLLM gateway sits one model or several - interchangeable without users noticing.
With test questions from real daily work we check whether answers are cited and correct. Langfuse makes cost, latency and quality visible instead of a matter of opinion.
New documents are pulled in automatically. You receive infrastructure code, runbooks and training; operations by us is an option, not a condition.
An assistant that shows too much gets switched off. That is why these are the first decisions in a project, not the last.
| Concern | What is built against it |
|---|---|
| The assistant quotes a document I am not allowed to see | Permissions are applied before retrieval: what your group cannot open is not part of the search space for that request - it is not merely hidden in the result. |
| Permissions change, the index stays old | Group membership is read from the directory at query time, not frozen at indexing time - with a cache of a few minutes that is deliberately invalidated on critical role changes. Document shares come from the index and are checked against the source again before citation. |
| Nobody can check whether the answer is correct | Every answer names document, passage and version. Without a cited passage the assistant says it does not know. |
| The model invents something plausible | Answers are formed from the retrieved passages, not from training knowledge. That does not rule out errors, but it makes them checkable - which is exactly what the citation is for. |
| Our data ends up with a US provider | The stack runs on European infrastructure or your hardware, with a European model (Mistral) or local models. You decide what leaves the building. |
| We are tied to the provider forever | You receive infrastructure code, configuration, knowledge base and documentation. Taking over yourself is a documented path, not a contract dispute. |
The most common design mistake is telling the language model what it must not show. That is not access control, it is a request. Permissions apply at three points - and only the middle one decides.
The connector carries the permissions over from the source: owner, direct shares, group shares, inherited folder rights. They are normalised and stored on every passage - not only on the document, because passages are what gets retrieved.
This is where it is decided. The signed-in user's groups are resolved and turned into a mandatory search filter. The database only ever sees the query with that filter attached. What the user may not see is not a worse match - it is no match at all.
Before output, the retrieved passages are checked against the source again. A share may have been revoked between the indexing run and the query. This second check costs milliseconds and catches exactly the case that would otherwise be expensive.
| Where the check sits | What happens when a permission is revoked | Does it hold? |
|---|---|---|
| In the prompt ("do not show anything from folder X") | Nothing. The passage is already in the model's context and can come back out through a differently phrased question. | No |
| After the search, as a filter on the result list | The hit disappears from the list - but it was already retrieved, and the number of hits reveals that something is there. | Partly |
| Before the search, as a condition of the query | The passage is outside the search space. It cannot be retrieved, cannot be counted and cannot be inferred. | Yes |
On 17 October 2025 the German Data Protection Conference (DSK) published guidance on RAG systems, recommending among other things permission and role concepts as well as access restrictions on the vector database. We build along that line - and we lay the architecture open so your data protection officer can examine it rather than having to take it on trust.
The question comes up in every second conversation, so here is the honest answer rather than the sales answer.
The two are not mutually exclusive. Some organisations use Copilot for office work and run their own assistant alongside it for the corpora that do not belong there. For context: Copilot reaches external sources through connectors. For the usual source types - Confluence, wikis, file shares, SQL, CRM - those are indexing connectors, so your content ends up additionally in the Microsoft index. There is no prebuilt connector for Nextcloud, and building an indexing one yourself is the expensive route.
An internal assistant logs who asked what. That makes it objectively capable of recording behaviour or performance - which triggers a co-determination right under section 87(1) no. 6 of the German Works Constitution Act. It does not matter whether you intend to monitor. It matters whether the system could.
Not before the rollout, before the decision. A body handed a finished system negotiates differently from one that helped write the requirements.
Operations need the timestamp, the number of hits and whether an answer was sourced. The question verbatim together with the person is rarely needed for analysis and turns the assistant into a monitoring instrument.
The quality report answers which topics go unanswered - not who asked how often. Person-level analysis needs its own stated reason.
Purpose limitation, logging scope, retention, analysis rights, shutdown. In writing, before the system goes live - after that you negotiate from the weaker position.
We are not a law firm and replace neither counsel nor your data protection officer. We provide the technical description your body needs to understand what it is deciding on - and we build the boundaries the way you agreed them.
A number before the corpus analysis would be a guess. These six points determine it - and you can judge in advance where you stand.
One-off: corpus analysis, connecting the sources, permission model, test questions and acceptance. Ongoing: operations, model and security updates, re-indexing, quality report. How the corpus analysis is charged is settled in the first conversation.
The implementation is called retrieval-augmented generation, or RAG: your documents are split into passages and stored as vectors. On every question the matching passages are retrieved and handed to the language model as context. The model formulates from those passages - and only from those. That is why it can name the source, and why the answer changes the moment you change the document.
The building blocks are open source and individually replaceable. None of them ties you to us:
Stores the passages as vectors and finds the ones that match by meaning, even when the question is phrased differently from the text.
DetailsOne entry point for all models: European ones such as Mistral, local ones, or both. Switch without touching the application.
DetailsShows what is being asked, what it costs and where answers are weak. Without measurement, quality stays a gut feeling.
DetailsThe chat interface for your staff, with user management and a connection to your existing login.
DetailsThe WZ-IT offer finder on this website runs on exactly this stack: visitors describe their project in their own words, the system maps it to the right solutions via semantic search and a curated knowledge base, with source references and follow-up questions. What we build for you, we operate ourselves.
The stack we build for you
We would rather build a smaller system that holds than a large one nobody opens after three months.
An assistant can only find what is written down. Where there is no documentation, writing it is the first step - not the AI.
If three versions of the same handbook are in circulation, an assistant only makes the confusion faster to retrieve. Clean up first, then connect.
Without clean groups and ownership nobody can say who may see what. That is organisational work no system takes off your hands.
Then a good FAQ page or a form is cheaper and faster. An assistant pays off where the questions are varied and the sources are many.
Honestly upfront: we have advised against projects because the documentation did not hold. An assistant does not make poor sources better - it only makes it visible faster that they are poor.
For law firms, medical practices, notaries & more we build the assistant locally - the data stays in-house, and we take on a written secrecy obligation as a contributing person.
When public or association knowledge should be opened up in a guided way.
When something should be done, not just answered: tickets, workflows, systems.
When website visitors should be routed to the right offer.
Monitoring, updates, backup and SLA for day-to-day operations - optional and cancellable.
Answers to the most important questions
At indexing time the shares are carried over from the source and stored on every passage. Before each search the signed-in user’s groups are resolved from the directory and turned into a mandatory filter - the database only ever sees the query with that filter. Before output the hits are checked against the source again, in case a share was revoked in the meantime. What matters is that the filter sits before the search and not in the prompt.
All common formats - unstructured texts (PDFs, Word documents, Markdown), semi-structured data (JSON, XML), APIs, databases (SQL, NoSQL), knowledge graphs, Confluence, SharePoint, and many more. We analyze your specific data sources and develop the appropriate connectors.
Every answer names the document, passage and version it came from - one click is enough to verify it. If the assistant finds no cited passage, it says so instead of formulating something. That is why citation is not an extra but part of the architecture.
Either a European model such as Mistral via the LiteLLM gateway, or an open-source model run locally on your hardware. The application always talks to the gateway, never directly to the model - switching is therefore a configuration change, not a rebuild.
Both options are possible. For high requirements regarding data sovereignty and control, on-premises or hybrid is recommended. Cloud solutions offer flexibility and easier scaling.
An important part of a RAG solution is updating and synchronizing between the underlying data sources and the vector index. We establish a process for regular data ingestion, monitoring, and versioning of your vector index.
No - RAG significantly reduces the risk of hallucinations through the use of reliable data sources, but it does not eliminate them completely. We complement technical measures with high-quality data basis, metadata selection, and an evaluation system for answers.
No, and this is the most common design mistake. A prompt is an instruction, not access control. If the passage is already in the context, it can come back out through a differently phrased question. Access rights have to take effect technically before the search, so that impermissible content is never retrieved in the first place.
Groups are read from the directory at query time, not from a copy in the index. A change therefore takes effect with the next query. We cache groups for a few minutes because querying on every search would be needlessly slow - for critical role changes the cache can be invalidated deliberately.
As a rule, yes. A system that logs who asked what is objectively capable of recording behaviour or performance - which triggers a co-determination right under section 87(1) no. 6 of the German Works Constitution Act, regardless of whether monitoring is intended. Involve the body before the selection, not before the rollout. We supply the technical description it needs for its decision.
Copilot is the shorter route if your knowledge sits essentially entirely in Microsoft 365 and permissions there are maintained - it inherits them, and that is its strength. Your own assistant pays off if your knowledge is spread out (Nextcloud, DMS, wiki, file shares, ERP), if professional or trade secrecy rules out processing outside your control, if you want to choose the model yourself, or if a per-seat licence does not add up because only part of the workforce needs the system.
We name the price after the corpus analysis, because before that it would be a guess. It splits into one-off - analysis, connecting the sources, permission model, test questions, acceptance - and ongoing: operations, model and security updates, re-indexing, quality report. It is driven by the number and type of sources, the state of the permissions, the PDF share, the number of different views and the operating model.
It says so. An answer without a sourced passage is the most expensive mistake a system can make on an internal corpus - which is why the assistant only formulates from retrieved passages and otherwise hands over. How often that happens is in the quality report, and the topic list from it doubles as your editorial backlog: you see what people ask about and what has no content.
Yes. You get infrastructure code, configuration, knowledge base and operations documentation in a documented format. The corpus itself was always yours - the assistant lays a layer over it and does not pull your content into a system it cannot leave.
With an assessment: which sources exist, who may see what, which questions should be answered? From that comes a first production use case on a clearly bounded set of sources. Further sources are added afterwards without rebuilding the system.
Runs where you want
No risk: worst case, you leave with a clearer understanding of your project than before.


“WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.”
ml&s speaks about integrating a local AI solution. The other voices cover architecture, data sovereignty and operations - exactly the maturity an AI project needs to reach production.
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Timo Wevelsiep & Robin Zins
Managing Directors of WZ-IT
