Features

A self-hosted RAG stack designed for regulated EU workloads.

I3K RAG Enterprise runs 100% locally inside your perimeter. The Community engine is one Rust binary that starts its own vector store and inference engine — no external dependencies, no US cloud, and nothing to orchestrate.

The stack

Every component is open-source, runs locally and can be audited end to end. No black boxes, no hidden network calls.

Rust + axum API

REST surface on :8000. JWT auth, user management, query orchestration — all in the binary.

React + Vite frontend

Served by the engine from its own directory. Same port, no separate process to run.

Qdrant vector store

1024 dimensions, cosine distance. Started by the engine; role filtering applied at the storage layer.

eullm inference

A separate process the engine starts and keeps up to date. Detects an NVIDIA GPU at startup and uses it.

SQLite through sqlx

Users, documents, conversations. Single file, backed up together with the vector snapshot.

pdfium + Tesseract

Rasterising and OCR, loaded at runtime from a bundled path rather than linked at compile time.

The RAG pipeline

Four steps, end to end, all inside one process tree on your machine. No third-party agent framework and no middleware in the request path.

01
Ingest
Upload from the web UI or the REST API. PDF, DOCX, XLSX, HTML, TXT, Markdown and CSV. Scanned pages are detected automatically and passed through OCR in Italian and English.
Tika · OCR
02
Embed & store
Text is split into overlapping chunks and embedded with BAAI/bge-m3 (1024 dimensions, 100+ languages), running in-process. Vectors go into Qdrant with the metadata used for role-based filtering.
bge-m3 · Qdrant
03
Retrieve
The question is embedded the same way and answered from the closest passages. Relevance threshold and top-K are configurable, and role filtering is applied here — a query never reaches the model with passages the caller may not see.
I3K orchestrator
04
Generate
The passages go to the local language model, which streams an answer token by token with each source shown. The model runs on your hardware. Zero external calls.
EuLLM · Mistral 7B

Powered by EuLLM

I3K RAG Enterprise ships with EuLLM as the recommended generation backend. Open-source LLM inference engine built in the EU. No US cloud dependencies in your AI stack — and full transparency on weights, training and governance.

Visit eullm.eu View on GitHub

EuLLM

Default inference engine — EU-trained foundation models

www.eullm.eu

Supported models

Defaults that work out of the box. Swap any model via the setup flow.

Role	Default	Notes
Embedding model	BAAI/bge-m3	1024 dimensions, 100+ languages, computed in-process through Candle.
Inference engine	eullm	Started and kept up to date by the engine. GPU-aware at startup. eullm.eu
Chat model	Fetched on first run	Pinned in the release manifest and sha256-verified before use.
OCR	Tesseract (ita + eng)	Applied automatically to pages that yield too little text.

Document formats

Scanned pages need no special handling: when a page yields too little text it is rasterised and passed through OCR in Italian and English.

PDF (with OCR)
DOCX
XLSX
CSV
HTML
TXT
Markdown

Structured extraction

Pro only

Beyond retrieval, the Pro edition ships a structured extraction engine: given a target schema (JSON, table columns, named fields), the engine pulls typed values out of unstructured documents with provenance back to the source chunk. Useful for contract analytics, KYC pipelines and regulatory reporting.

JSON-Schema as the contract between extraction request and result
Citation back to the source chunk for every extracted field
Confidence scores and rejection thresholds tunable per field
Batch and streaming modes

Backup & restore (built in)

A scheduled daily archive holds the application database and a vector-store snapshot taken together, so a restore brings the pair back consistent rather than as two mismatched halves. Restore runs over the live install from the admin endpoint. No add-on, no extra licence.

In the archive

SQLite application database
Qdrant snapshot, taken at the same moment
Uploaded source documents

How it behaves

Scheduled daily, no downtime
Local files under BACKUP__DIR
Nothing uploaded anywhere — point your own backup tooling at that directory

Off-site destinations (Pro)

S3-compatible
WebDAV / Nextcloud
SFTP
FTP
Backblaze B2

Community writes the archive to local disk, which does not survive the loss of the host that produced it. The Pro edition adds scheduled copies to storage you already run, with retention policies and selective restore — pick an EU-resident destination and the sovereignty argument stays intact while the copy leaves the building.

Deployment topologies

Extract the tarball and run the binary. Linux x86_64, Linux ARM64 or 64-bit Windows.

Single host

The normal case. One binary, one port; it starts the vector store and inference engine itself.

Air-gapped

After the first run no network is needed. Stage the data directory on a connected machine, then move it across.

Behind a proxy

The engine speaks plain HTTP; terminate TLS on the reverse proxy your organisation already runs.

Install

installbash

mkdir i3k-rag-engine
tar -xzf i3k-rag-engine-linux-x86_64.tar.gz -C i3k-rag-engine
cd i3k-rag-engine

echo 'AUTH__JWT_SECRET=change-this-to-a-long-random-string' > .env
./i3k-rag-engine

Compliance & security

GDPR and the EU AI Act are first-class engineering requirements, not a marketing checkbox. AGPL-3.0 source means everything is auditable.

JWT authentication with role-based access (User, Super User, Admin)
GDPR Art. 32 controls: TLS in front, password hashing (bcrypt), session expiration
Audit trail at application level
Right-to-erasure: per-document and per-user deletion
Data residency enforced: no outbound calls in the request path
AGPL-3.0 source — full transparency, full auditability

Ready to run RAG on your own infrastructure?

Start with the open-source Community edition, or talk to us about Pro with structured extraction, SSO, audit log and SLA.

Star on GitHub Book a call