RAG and Enterprise Search

Architecture diagram: enterprise sources are chunked and embedded into a vector store, retrieved per query, filtered by user entitlements, then answered by an LLM with citations.

RAG and enterprise search is how you get an AI that answers from your documents — accurately, with citations, and only for the people allowed to see them. Software Depo builds retrieval-augmented generation over your real content: policies, contracts, manuals, tickets, and knowledge bases, wherever they live.

Retrieval Is Where RAG Succeeds or Fails

A RAG system is only as good as what it retrieves. Get chunking, indexing, and ranking wrong and the model answers from the wrong passage — confidently. We engineer the retrieval layer as carefully as the generation: how documents are split, how they are indexed, how hybrid and semantic search are combined, and how freshness is maintained as content changes.

What We Build

  • Document ingestion from SharePoint, Google Drive, databases, and file stores
  • Permission-aware retrieval — users only get answers from content they are allowed to see
  • Chunking and indexing tuned to your document types
  • Hybrid and semantic search for recall and precision
  • Citations, so every answer can be verified against its source
  • Freshness handling so updated documents are reflected, not cached stale
  • Evaluation, including access-control leakage testing

RAG or Fine-Tuning?

For most business knowledge, RAG beats fine-tuning: it is cheaper, it stays current as documents change, and it can cite its sources. Fine-tuning has its place — for style, format, or narrow tasks — and we will tell you the rare cases where it earns its cost. Usually the answer is retrieval done well.

Security Is Not Optional

A retrieval system that ignores permissions is a data-leak waiting to happen. We enforce access controls at retrieval time and test specifically for leakage — can user A get an answer sourced from a document only user B should see? That test is part of every RAG delivery.

Tell us what knowledge should be searchable — the sources, who may see what, and the questions people need answered. We will scope a RAG system grounded in your content.

Related services

What Is RAG?

Retrieval-augmented generation means retrieving relevant material from your own content and giving it to the model as context, so the answer is grounded in your documents rather than in the model’s training data. It is how an assistant answers questions about your policies, your contracts and your products, with citations.

The retrieval half is where the quality lives. Most disappointing RAG deployments are not model problems — they are retrieval problems. If the right passage is not retrieved, no model can produce the right answer.

RAG or Fine-Tuning?

They solve different problems and are frequently confused. RAG supplies knowledge: facts that change, that must be cited, or that are specific to your organization. Fine-tuning shapes behaviour: tone, format, adherence to a particular style of response.

If the requirement is “answer questions about our documents”, that is RAG. Fine-tuning a model on a document set to teach it facts is an expensive way to get an unciteable, stale answer that cannot be updated when the document changes.

Why Do RAG Systems Give Poor Answers?

  • Bad chunking. Splitting documents at arbitrary lengths severs tables, clauses and context. Chunking should follow document structure.
  • Retrieval that misses. Pure vector similarity struggles with exact terms — part numbers, clause references, product codes. Hybrid keyword-plus-vector retrieval usually beats either alone.
  • Stale or duplicated sources. Three versions of a policy in the index means the model may cite the wrong one. Source hygiene is most of the work.
  • No permission filtering. Retrieval must respect who is asking. An index that ignores permissions will answer questions the asker was never entitled to ask.
  • No evaluation. Without a test set of real questions and known-good answers, quality is a matter of opinion and regressions go unnoticed.

What Does a RAG Project Involve?

Establishing which sources are authoritative and who owns them; building ingestion that respects document structure and keeps the index current as content changes; implementing retrieval with permission filtering; designing answers that cite their sources so users can verify; and building an evaluation set before launch rather than after complaints.

The unglamorous part — deciding which of the four copies of a policy is the real one — is usually the part that determines whether people trust the system.

Related: enterprise search and answer agents · document intelligence · evaluations.