​

Core Concepts

​

Tenant Isolation

​

Encryption Model

KEK (Key Encryption Key)
 └── encrypts → DEK (Data Encryption Key, per tenant)
      └── encrypts → Document content, titles, metadata

• Content, titles, and metadata are stored as ciphertext in PostgreSQL
• S3 objects use client-side encryption before upload
• Qdrant vectors contain only embeddings and minimal non-sensitive metadata
• Logs are scrubbed to prevent sensitive data leakage

​

Crypto-Shredding

​

Processing Pipeline

Ingest API
  → Redis Streams (job queue)
    → Worker picks up job
      1. Encrypt content with tenant DEK
      2. Store encrypted content in S3
      3. Chunk text into segments
      4. Generate embeddings (voyage-3.5-lite)
      5. Classify & extract entities (Grok 4.1 Fast via xAI API)
      6. Index chunks in Qdrant
      7. Store metadata in PostgreSQL

​

Query Modes

​

Fast Mode (mode: "fast")

• Latency: <500ms (typically 200-600ms)
• Method: Hybrid search combining vector similarity (Qdrant) and BM25 keyword matching
• Results: Ranked chunks with Reciprocal Rank Fusion (RRF)
• No LLM call — pure retrieval

{"query": "Q1 priorities", "mode": "fast"}

​

Rich Mode (mode: "rich")

• Latency: <5s cold, <3s cached
• Method: Query expansion → parallel retrieval → RRF fusion → LLM reranking → LLM synthesis (all using Grok 4.1 Fast via xAI API)
• Results: Reranked chunks plus optional natural language synthesis field
• Budget-aware: Skips reranking/synthesis if time budget exhausted
• Caching: Expansion and rerank results cached in Redis for 15 minutes

{"query": "Q1 priorities", "mode": "rich", "synthesize": true}

​

Filtering