Enterprise RAG development for an AI knowledge base your team can trust
We build private, permission aware AI search over SharePoint, Google Drive, Confluence, Zendesk and your databases, with cited answers and measured accuracy. It runs in your cloud, and you own every part of it.
What is enterprise RAG?
Enterprise RAG (retrieval augmented generation) is an AI knowledge base that answers questions from your company’s own documents and data. It searches sources such as SharePoint, Confluence, Google Drive and your databases, retrieves only passages the person asking is allowed to see, and has a language model write an answer with citations to those passages. The enterprise part is everything a demo leaves out: permissions, hybrid search, reranking, freshness, audit logs and measured accuracy. Vrisic builds these systems in your own cloud.
| What it is | Private, cited AI search and Q&A over your company knowledge |
|---|---|
| Sources | SharePoint, OneDrive, Google Drive, Confluence, Notion, Zendesk, databases, PDFs |
| First release | Knowledge assistant in 4 to 8 weeks |
| Typical budget | $15,000 to $100,000; company wide platforms from $100,000 |
| Accuracy | Measured on 150 to 400 of your real questions before launch |
| Hosting | Your AWS, Azure or Google Cloud account, or on premises |
| Languages | English and Arabic, plus other languages on request |
Enterprise RAG and AI search your team can trust, explained
- 1Connect SharePoint, Drive, Confluence and more
- 2Build a private, permission aware index
- 3Ask in plain language
- 4Get answers with the source, measured for accuracy
Read the video transcript
Enterprise RAG and AI search your team can trust. Answers from your own documents, with sources and permissions. Here is the problem. People spend hours looking for the right document. Answers live in one person’s head. And public chatbots cannot see your data, and should not. Here is how it works. First, connect SharePoint, Drive, Confluence and more. Second, build a private, permission aware index. Third, ask in plain language. And finally, get answers with the source, measured for accuracy. What do you get? Runs in your cloud account. Respects existing document permissions. Accuracy tested on your real questions. Knowledge assistant $15,000 to $40,000, in 4 to 8 weeks. The easiest way to start is a $1,500 AI Pilot on your own data. You see a working version in ten business days, and the fee is credited to the full build. Book a free call, or message us on WhatsApp, at vrisic.com.
How does an AI knowledge base answer from your documents?
An AI knowledge base works in two moves: find the right passages, then write an answer from them. Everything else is about doing those two moves well at company scale.
A large language model such as GPT, Claude or Gemini has read a vast amount of public text, but it has never seen your leave policy or last quarter’s pricing exceptions. Ask about them and it will refuse or, worse, produce something plausible and wrong.
Retrieval augmented generation solves this by treating the model as a skilled writer with no memory of your business. Before the model answers, a search step fetches the handful of passages that matter. Here is the whole loop in plain terms:
- Ingest. Connectors copy text and permissions from your sources. Long documents are split into passages (chunks) of a few hundred words, each tagged with its title, section, date, owner and access list.
- Index. Each passage is stored twice: as keywords for exact matching and as an embedding, a list of numbers that captures meaning so “annual leave” matches “holiday allowance”.
- Retrieve. When someone asks a question, the system searches both indexes, keeps only passages that user may read, and reranks the best 50 or so candidates down to the top 5 to 10.
- Generate. The model receives the question plus those passages, with instructions to answer only from them, cite each claim and say so plainly when the documents do not cover the question.
- Check. The answer, its sources and the user’s feedback are logged, so accuracy can be measured and bad answers traced back to the passage that caused them.
That is why RAG suits company knowledge: documents can change daily without touching the model, every answer can be verified against its source, and access rules are applied before the model ever sees a word. Our guide on how to build an AI knowledge base walks through the same steps for teams who want to try a first version themselves.
What makes enterprise RAG different from a weekend demo
Anyone can upload ten PDFs to a vector database and get impressive answers in an afternoon. These seven pieces turn that demo into enterprise RAG solutions people rely on.
- 01
Permission aware retrieval
Every passage carries the access list of its source document, synced from SharePoint, Google Drive, Confluence or your own database. At query time we resolve the user’s identity and groups through Microsoft Entra ID, Okta or Google Workspace and filter the search before ranking, so a restricted HR file can never shape an answer for someone outside HR.
Best for: Any knowledge base with confidential HR, legal, finance or client material
- Document level and, where needed, row level security
- Group membership cached and refreshed on a schedule
- Tests that try to retrieve restricted content as the wrong user
- 02
Hybrid search
Vector search is good at meaning and poor at exact strings. Keyword search, typically BM25, is the reverse. Part numbers, policy codes, client names and acronyms need keywords; loosely worded questions need vectors. We run both and merge the results with reciprocal rank fusion, which usually beats either approach alone.
Best for: Content full of codes, product names, clause numbers or jargon
- BM25 plus dense vector retrieval
- Metadata filters for department, region and date
- Query rewriting for vague or multi part questions
- 03
Reranking
First stage search is tuned for speed, so its ordering is rough. A reranker, a smaller model that reads the question and each candidate passage together, reorders the top 30 to 100 results by true relevance. A reranker such as Cohere Rerank is often the cheapest accuracy gain available, for 100 to 300 milliseconds per query.
Best for: Large collections where many passages look similar
- Hosted or self hosted rerank models
- Relevance thresholds so weak matches are dropped
- Latency budget agreed up front
- 04
Chunking and metadata that respect document structure
Cutting every document into equal slices splits tables in half and separates headings from the rules beneath them. We parse layout first, keep sections, lists and tables intact, attach the heading path to each chunk, and add metadata such as document type, effective date, owner, region and version. Good metadata lets the system prefer the current policy over the 2021 draft.
Best for: Policies, contracts, manuals and spreadsheets with real structure
- Layout aware parsing for PDFs, Word and slides
- Table extraction with row and column context
- Version and effective date tagging
- 05
Citations people can check
Each claim in an answer links to the passage it came from, opening the source document at the right page or section. Experts can spot a stale document in seconds, and compliance teams get an audit trail. When sources disagree or say nothing, the assistant says so instead of guessing.
Best for: Regulated teams and anyone who must defend an answer later
- Inline citations with page or section anchors
- Automatic check that each citation supports its claim
- A clear “not found in our documents” response
- 06
Freshness sync
A knowledge base that is a week out of date will be abandoned in a month. Connectors pick up new, edited and deleted content through change notifications or incremental syncs, and permission changes travel the same path. Answers show the date of their sources, and stalled connectors raise an alert.
Best for: Fast changing content such as support articles, pricing and procedures
- Incremental sync with deletion handling
- Per source freshness targets
- Alerts on failed or stalled connectors
- 07
Groundedness evaluation
Groundedness means every statement in the answer is supported by the retrieved sources. We score it automatically on a fixed test set and on a daily sample of live traffic, alongside retrieval recall and answer correctness. A drop after a prompt tweak, a model update or a new batch of documents is caught before users notice it.
Best for: Any system where a wrong answer has a cost
- Automated scoring on every change
- Weekly human review of sampled answers
- Trend reports your team can read
AI knowledge base use cases by team and industry
The retrieval engine is the same everywhere. What changes is the content, the people asking and what a wrong answer would cost.
Customer support teams
Agent assist that drafts replies from Zendesk macros, help centre articles and past resolved tickets, with citations the agent checks before sending. The same index can power a customer facing help assistant.
Shorter handle time, consistent answers
Law firms and legal teams
Search across precedents, clause libraries, matter files and know how notes, restricted by matter team, with answers that quote the exact clause and link to the document management system.
Faster research, fewer missed precedents
Read moreHealthcare providers
Staff assistants over clinical protocols, formularies, payer rules and internal procedures, built to HIPAA requirements with protected health information kept out of the index where the task allows.
Less time hunting for the right protocol
Read moreSales and bid teams
An RFP and security questionnaire assistant that drafts answers from approved past responses, product documentation and policy files, and flags any answer older than its review date.
Faster, more consistent proposals
Ecommerce and retail
Product and policy search for store and support staff across catalogues, supplier specs, returns rules and shipping terms, grounded in live data from your ecommerce platform and ERP.
Fewer escalations, correct policy answers
Read moreReal estate and property management
Answers from leases, building manuals, compliance certificates and tenant handbooks, scoped per property and per client so managers only see their own portfolio.
Quicker tenant and owner responses
Read moreHR, finance and operations
An internal policy assistant for leave, expenses, procurement and travel rules across regions, answering in the employee’s language and routing edge cases to the right person.
Fewer repetitive internal tickets
How we test RAG accuracy before anyone relies on it
We treat accuracy as a number agreed with you before the build, measured on your own questions, and rerun on every change. Vibes from a few test prompts are not a quality process.
In the first two weeks we collect 150 to 400 real questions from ticket histories, search logs and subject experts. Each question gets an approved answer and the document or documents that support it. We include hard cases: questions with no answer, conflicting policies, answers buried in tables, and questions a user should not be allowed to answer.
That test set becomes the scoreboard. We measure four things separately, because each one points to a different fix:
- Retrieval recall. Did the right passage appear in the top 10 results? If not, the fix is in chunking, metadata, hybrid weights or the reranker, not the prompt.
- Faithfulness (groundedness). Is every statement in the answer supported by the retrieved passages? Low scores mean the model is filling gaps from memory.
- Answer correctness. Does the answer match the approved one in substance? This is scored by a judging model and spot checked by people.
- Citation accuracy and safe refusal. Do citations point to passages that actually support the claim, and does the system decline when the documents are silent?
We use open source tooling such as Ragas alongside our own checks, and log every run in Langfuse or LangSmith. Permission tests run in the same suite: we query as users from different groups and confirm restricted passages never appear.
Before launch you receive a report with the scores and examples of each failure type. After launch, questions with thumbs down feedback join the test set every week, so the system is measured against what people actually ask. If you want this discipline applied to a system someone else built, our AI architecture and engineering team runs evaluation and hardening engagements on their own.
RAG vs fine tuning vs long context: which fits company knowledge?
There are three common ways to give a model your knowledge. Each wins somewhere. For most enterprise AI search the answer is RAG, sometimes combined with one of the others.
| Fine tuning a model | Long context prompting | Enterprise RAG by Vrisic | |
|---|---|---|---|
| How it works | Retrains a model on your examples | Pastes whole documents into each prompt | Retrieves relevant passages per question |
| Adds reliable factual knowledge | Unreliably | Yes | Yes |
| Content can change daily | No | Yes | Yes |
| Enforces who can see what | No | Only if you filter first | Yes |
| Citations to exact sources | No | Possible, less precise | Yes |
| Scales to millions of pages | Not the right tool | No | Yes |
| Cost per question | Low once trained | High, every prompt is huge | Low to moderate |
| Teaches tone, format or a narrow skill | Yes | Through examples | Through prompts and templates |
| Best when | You need a style or classification task | A few long documents, low volume | Large, changing, permissioned knowledge |
Long context windows now run to hundreds of thousands of tokens, which is useful for reviewing one contract or report in full. It does not replace search across a whole company, and cost and latency grow with every page you paste in. We cover the tradeoffs in more depth in RAG vs fine tuning.
Data sources and technology behind our enterprise AI search
We connect to where your knowledge already lives and build on widely supported components your own team can maintain. Each connector brings content, metadata and permissions together, never content alone.
Document and knowledge sources
Access lists are synced alongside content, and deletions are honoured on the next sync.
Support, CRM and business systems
Tickets and records are indexed with their status and owner so answers can filter by them.
Databases and files
Queried live through read only SQL tools, not copied into vectors.
Search and vector stores
Chosen by scale and hosting rules.
Models and rerankers
Embedding and answer models are picked on your test set, including Arabic where needed.
Pipelines, cloud and evaluation
Infrastructure as code in your account, with traces for every query.
Bring 20 questions your team asks every week
On a free 30 minute scoping call we look at where the answers live today, what access rules apply and what a first release would take. You leave with a realistic scope and price range, whether or not you build with us.
From scattered documents to cited answers in six steps
The work is front loaded: content, permissions and the test set are settled before we tune a single prompt.
- 01
Scoping call and source audit
1 weekWe list the sources, estimate document volumes, check how permissions are managed and identify the first group of users. You get a written proposal with a fixed price, a first release scope and the access approvals we will need from IT.
You get: Source inventory, Fixed price proposal, Access request list
- 02
Question collection and test set
1 to 2 weeksWorking with subject experts, we gather 150 to 400 real questions with approved answers and supporting documents, including questions that should be refused. This set defines success for the rest of the project.
You get: Evaluation set v1, Accuracy targets agreed in writing
- 03
Connectors and ingestion
2 to 4 weeksWe build connectors for each source with content, metadata and access lists, then parse, clean and chunk the documents. Duplicates, old versions and unreadable scans go back to content owners.
You get: Working connectors, Content quality report
- 04
Retrieval tuning and answer design
2 to 4 weeksHybrid search, reranking, metadata filters and prompts are tuned against the test set, and we compare two or three answer models on accuracy, latency and cost. The interface, in Teams, Slack, a web app or your own product, is built alongside, and it can also be exposed as a tool for AI agents.
You get: Scored comparison report, Pilot application
- 05
Security review and pilot
1 to 2 weeksWe run permission tests, prompt injection tests based on the OWASP Top 10 for LLM Applications and load tests, then release to a pilot group. Their feedback feeds straight into the test set.
You get: Security test results, Pilot feedback summary, Runbook
- 06
Rollout, monitoring and improvement
OngoingWe widen access in stages, watch accuracy, freshness and cost dashboards, and review sampled answers each week. You can keep us on a support plan or take it in house; our way of working makes either easy.
You get: Monthly quality report, Freshness and cost dashboards
Enterprise RAG pricing
Typical ranges for RAG development services at three sizes. You get one fixed price in writing after a free scoping call, and it only moves if the scope does.
Knowledge assistant
One team and one or two well organised sources, such as a policy library or help centre
$15,000 to $40,000£12,000 to £32,000AED 55,000 to AED 147,000
4 to 8 weeks
- One or two source connectors
- Hybrid search with citations
- Evaluation set and accuracy report
- Chat interface in Teams, Slack or web
- Deployment in your cloud account
Department search with permissions
A department or business unit with several sources and confidential content
$40,000 to $100,000£32,000 to £80,000AED 147,000 to AED 367,000
8 to 14 weeks
- Three to six connectors with access list sync
- Single sign on and group based filtering
- Reranking and metadata filters
- Freshness monitoring and alerts
- Audit logs and admin console
- Security and permission testing
Company wide platform
Organisations rolling out AI search across many teams, regions or languages
From $100,000From £80,000From AED 367,000
3 to 6 months
- Many sources and structured data tools
- Multi region or in country hosting
- Arabic and English retrieval where needed
- API for other apps and agents to use
- Formal evaluation and red teaming
- Phased rollout and training
Typical ranges; you get one fixed price in writing after a free scoping call. Model, search and hosting usage is billed at cost, and managed support plans start at $1,500 per month. For comparison, published agency figures put basic RAG integration at about $30,000 to $70,000 and custom builds at $70,000 to $200,000 or more (GeekyAnts, accessed September 2026), and one Dubai agency lists enterprise RAG at AED 100,000 to AED 350,000 (Code Brew Labs, August 2026). See our AI development cost guide for wider context.
What changes the cost of a RAG system?
Document count matters less than people expect. These factors move an enterprise RAG budget.
| Cost driver | Effect on budget | Why it matters |
|---|---|---|
| Permission complexity | High | Public help articles need no access control. Matter based legal files, per client folders or row level database rules need identity integration, sync logic and dedicated tests. |
| Number and type of sources | High | Each connector needs authentication, incremental sync and deletion handling. Modern APIs such as Microsoft Graph are straightforward; legacy file shares and custom databases take longer. |
| Content quality | High | Scanned PDFs, duplicate versions, outdated drafts and missing owners all need clean up work. Well governed content can halve ingestion time. |
| Accuracy stakes | Medium | Internal FAQs tolerate the occasional miss. Legal, clinical or financial answers need larger test sets, stricter refusal behaviour and human review steps. |
| Hosting and residency rules | Medium | Managed APIs in a standard region are simplest. In country hosting, private networking or self hosted open weight models add infrastructure work. |
| Languages | Medium | Each language needs suitable embeddings, parsing and a native speaker test set. Arabic with mixed English content needs extra evaluation for cross language retrieval. |
| Where answers appear | Low | A chat window in Teams or Slack is quick. Embedding answers inside your own product or support widget adds interface and API work. |
Security, privacy and private cloud options
A knowledge base concentrates your most sensitive documents in one searchable place. We design it so that concentration never becomes a leak.
Private cloud or on premises
The index, pipelines and application run in your AWS, Azure or Google Cloud account, inside your network. For the strictest cases we host open weight models such as Llama or Mistral on your own GPUs, so no text leaves your environment. More in our private LLM guide.
Permissions enforced before generation
Access lists are applied at search time using your identity provider, so the model only ever reads passages the user may see. Automated tests query as different users to prove it on every release.
Model provider data terms
We use business tiers of Azure OpenAI, AWS Bedrock, Google Vertex AI, OpenAI and Anthropic that do not train on your API data under standard terms, and record retention settings for each provider.
PII handling and redaction
Personal data can be masked at ingestion or excluded by source, folder or label, and logs follow your retention rules. Sensitivity labels from Microsoft Purview can drive what is indexed at all.
Audit trails and injection defence
Every question, retrieved passage and answer is logged with the user’s identity. Documents are treated as untrusted input and tested against the OWASP Top 10 for LLM Applications.
Working to your compliance frameworks
We can build to HIPAA requirements and sign a BAA where our vendors support it, and design for GDPR, UK GDPR, CCPA/CPRA, UAE PDPL and DIFC or ADGM rules. We do not claim certifications we do not hold.
Enterprise AI search in the US, UK and UAE
Retrieval quality is universal. Where data may live, which languages matter and which rules apply are not.
United States
US knowledge bases often hold health, financial or customer data, so HIPAA, the Gramm Leach Bliley Act and state privacy laws such as California’s CCPA/CPRA shape what gets indexed and who can see it.
- Hosting in US cloud regions
- BAA route for healthcare knowledge bases
- Entra ID, Okta or Google identity
- Pricing in USD
United Kingdom
UK projects run under UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. Indexing staff or client records usually calls for a data protection impact assessment, and the ICO guidance on AI and data protection is our reference. See our UK AI development guide.
- AWS London or Azure UK South hosting
- DPIA support and retention rules
- British English answers and spelling
- Pricing in GBP
United Arab Emirates
UAE knowledge bases are usually bilingual, with Arabic and English in the same folders and often in the same document. We tune parsing, OCR and embeddings for Arabic, and host in country where the UAE PDPL (Federal Decree Law No. 45 of 2021), DIFC Data Protection Law No. 5 of 2020, ADGM rules or health data rules call for it. Model availability in UAE regions varies, so we confirm it per model at scoping.
- Azure UAE North or AWS Middle East (UAE) region
- Arabic and English retrieval, right to left interface
- Arabic capable open models such as Jais where needed
- Pricing in AED
How to choose an enterprise RAG development company
Most vendors can show a slick demo on their own documents. These questions reveal whether they can make enterprise RAG work on yours.
- 1
How do you enforce document permissions, and where in the pipeline?
The right answer is at retrieval time, using synced access lists and your identity provider. If permissions are checked after the answer is written, or not at all, confidential text is already inside the model’s context.
- 2
Can we see an evaluation report from a previous build?
Ask for retrieval recall, faithfulness and answer correctness on a real test set, not a screenshot of a good answer.
- 3
Do you use hybrid search and reranking by default?
Pure vector search misses exact codes and names that enterprise users type every day. A team that treats hybrid search and reranking as optional has probably not tuned RAG on messy corporate content.
- 4
How do deletions and permission changes reach the index?
A document removed from SharePoint must disappear from answers promptly. Ask how long it takes and how you would know if a connector stopped syncing.
- 5
Where does our data live, and can it stay in our cloud or country?
Look for deployment in your account and a clear list of every service that sees your text. UAE and regulated clients should ask specifically about in country options.
- 6
What happens when the answer is not in our documents?
A good system says it could not find the answer and points to who can help. Tuning for always answering produces confident mistakes.
- 7
Who owns the connectors, index and prompts if we part ways?
You should own all of it, with the code in your repository. Our guide to AI software development companies lists more buying criteria.
Questions we hear every week
Still unsure about something? Ask us on a call. We will give you a straight answer, even if it means we are not the right partner.
What is a RAG service?
A RAG service is a system, or the team that builds and runs it, that answers questions by first retrieving relevant passages from your own documents and then asking a language model to write an answer using only those passages, with citations. RAG as a service can mean a hosted product you configure, or a custom build like ours that runs in your cloud with your permissions, your connectors and your accuracy tests.
Is ChatGPT a RAG model?
No. ChatGPT is a product built on OpenAI’s GPT models, and those models are not RAG by themselves. ChatGPT uses retrieval when it searches the web, reads files you upload or queries connected apps, which is RAG behaviour. An enterprise RAG system applies the same pattern to your private sources, adds document level permissions and citations, and is tested for accuracy on your own questions.
Can you explain RAG to a beginner?
Think of an open book exam. A language model on its own answers from memory, which is broad but out of date and knows nothing about your company. RAG hands it the right pages first. The system searches your documents, picks the few passages that answer the question, and the model writes a reply from those pages, pointing to where each fact came from.
How much does an enterprise RAG system cost to build?
A focused knowledge assistant over one or two sources typically costs $15,000 to $40,000 and takes 4 to 8 weeks. Department search with permissions and several connectors runs $40,000 to $100,000 over 8 to 14 weeks. A company wide platform starts at $100,000. Model, search and hosting usage are billed at cost. You get one fixed price in writing after a free scoping call.
Can an AI knowledge base respect SharePoint and Google Drive permissions?
Yes, and it should. We sync the access control list of every document along with its content, store it as metadata in the search index, and filter results by the signed in user’s identity and group membership before anything reaches the model. When someone loses access in SharePoint or Drive, the next sync removes it from their results too.
How accurate is enterprise RAG, and how is accuracy measured?
Accuracy depends on your content and questions, so we measure it rather than promise a number. We build a test set of 150 to 400 real questions with approved answers and score retrieval recall, faithfulness to sources, answer correctness and citation accuracy. You see the scores before launch, and they are rerun automatically after every change to prompts, chunking or models.
Should we use RAG or fine tuning for company knowledge?
Use RAG when answers must come from documents that change, need citations or must respect who can see what. Fine tuning teaches a model a style, a format or a narrow task, but it does not reliably add facts and cannot enforce permissions. Many mature systems use both: RAG for knowledge, and a small fine tuned model for classification or formatting.
Can we have a private ChatGPT for company documents without sending data to OpenAI?
Yes. You can call GPT models through Azure OpenAI inside your own Azure tenant, use Claude through AWS Bedrock or Google Vertex AI, or host an open weight model such as Llama or Mistral on your own servers. Business API tiers from these providers do not train on your data under their standard terms, and we document retention settings for each.
Does RAG work with Arabic documents?
Yes, with extra care. Arabic needs text normalisation for letter variants and diacritics, embedding models that handle Arabic well, OCR tuned for Arabic scans, and a test set written by Arabic speakers. We also test cross language retrieval, such as an English question answered from an Arabic policy.
How do you keep an AI knowledge base up to date?
Connectors sync changes on a schedule or through change notifications from sources such as Microsoft Graph, Google Drive and Confluence. New and edited documents are reindexed within minutes to hours, deleted ones are removed, and permission changes flow through the same pipeline. Each answer shows the source date, and a freshness dashboard flags sources that have stopped syncing.
Why build custom RAG instead of buying Microsoft 365 Copilot or Glean?
Buy one of those when your content lives mostly in supported apps and standard answers are good enough. Custom RAG makes sense when you need your own databases or line of business systems, strict data residency, answers inside your own product, control over models and cost, or measured accuracy on regulated questions. Some clients run both, with custom RAG for the high stakes domain.
Find the process where AI will pay off first
Message us on WhatsApp for the fastest reply, or book a free thirty minute call. You will leave with the processes most worth automating, whether to build new or upgrade what you have, a realistic timeline and a clear idea of cost, whether or not you work with us.