It is Friday, 6 pm. A regulator's email lands with two questions.
Which version of the vendor management policy applied on 14 March? And which of your active contracts carry a 30-day termination clause? The reply is due Monday.
The one person who could have answered both from memory resigned in April.
The answers exist. They are simply scattered — a SharePoint library, an HR portal, three email threads and a folder called "Final_v7". Contracts sit in shared drives named after people who have left.
Under that pressure, staff do what feels fastest: they paste confidential clauses into a public chatbot and hope the answer is right.
This guide explains what a private, cited retrieval engine is, how one is built over your contracts, policies and verified documents, and how it changes audit and compliance work. It draws on Company Brain, the private retrieval engine Splashgain runs over its own knowledge, and on DocuExprt, which verifies the documents that make such an engine trustworthy.
Table of Contents
- What Is a Private AI Knowledge Base?
- Private Knowledge Base vs Public Chatbot
- What Company Brain Actually Does
- Why Verified Documents Matter More Than Model Choice
- Six Compliance Use Cases, One Scenario Each
- Guardrails That Make Auditors Comfortable
- How It Is Implemented in Six Weeks
- Proof at Scale
- Key Takeaways
- Frequently Asked Questions
What Is a Private AI Knowledge Base?
A private AI knowledge base is a self-hosted system that indexes your own documents and answers questions only from them.
The language model never browses the internet and never draws on training data to fill gaps. It reads passages retrieved from your corpus and composes an answer from those passages alone.
The technique behind it is retrieval-augmented generation (RAG). In plain language: find the relevant passages first, then answer, and show the passages you used.
It is closer to a diligent paralegal than to a chatbot. The paralegal pulls the right pages, marks the paragraph, and only then writes the note.
How a Cited Answer Is Produced (RAG)
Retrieval-augmented generation: find the passages first, then answer, then show the passages used.
Two more terms matter for a compliance buyer.
A citation means every answer carries its source: the document name, the page or section, and the version or effective date.
A vector store is the searchable index of your documents. It converts each passage into a numeric fingerprint, so the engine finds "termination on 30 days' notice" even when a contract says "either party may exit on one month's written notice".
Private Knowledge Base vs Public Chatbot
Public chatbots are excellent general assistants. They are the wrong tool for a compliance question about your contracts.
❌ Public Chatbot
- Data: pasted text goes to the provider's servers
- Coverage: sees one snippet at a time
- Citations: rarely cites, often invents sources
- Audit: no query log for your auditors
- Access: one login sees everything pasted
- Cost: per seat, per month, every user
✅ Private Knowledge Base
- Data: stays in your VPC or CERT-IN stack
- Coverage: full indexed corpus, kept fresh
- Citations: document, section and version, every time
- Audit: full log — user, question, sources, timestamp
- Access: mirrors your existing permissions
- Cost: flat platform fee, unlimited users
Here is the same comparison through the questions a CISO actually asks.
| Question a CISO asks | Public chatbot | Private AI knowledge base (Company Brain) |
|---|---|---|
| Where does the pasted text go? | To the provider's servers, under their terms | Stays in your VPC or the CERT-IN stack; data never trains a public model |
| Can it see our contracts and policies? | Only what a user pastes, one snippet at a time | Yes, the full indexed corpus, refreshed as documents change |
| Does it cite the source? | Rarely, and often invents one | Every answer carries document, section and version |
| Does it log who asked what? | Not for your auditors | Full query audit log: user, question, sources shown, timestamp |
| Does it respect our access controls? | No, one login sees everything it is given | Per-user access mirrored from your existing permissions |
| What does it cost at scale? | Per seat, per month, multiplied by every user | Flat platform fee, unlimited internal users, no per-seat cost |
The last row matters. Per-seat pricing discourages rollout to the people who need answers most: branch compliance staff, plant HR, junior auditors.
A flat fee lets a 400-person function query the same corpus.
See a cited answer come out of your own policy folder. In a ten-day Readiness Sprint we index one policy folder and a sample of contracts, then answer your team's questions live, with sources.
Book a Free DemoWhat Company Brain Actually Does
Company Brain is the private retrieval engine in Splashgain's AI Agents portfolio.
It indexes documents, tickets, contracts and wikis, answers from that index, and attaches a source to every answer.
Self-Hosted Vector Store
Your index lives on your infrastructure, never a vendor cloud
Full Query Audit Log
Who asked what, when, and which sources were shown
Role-Based Access
Plant HR and general counsel get different answers to the same question
24x7 Monitored
Runs alongside 35+ agents across two cloud regions
Two lines from the pack state the business case. "When someone resigns, their knowledge stays." And: "New joiners stop interrupting your senior people."
Both are compliance outcomes. The April resignation in the opening scene is a knowledge-loss event, and it happens in every function every year.
Splashgain runs Company Brain over its own sales, customer-support and product knowledge. Its teams query it daily, and its sales agents are grounded in it rather than in a generic model.
Why Verified Documents Matter More Than Model Choice
A knowledge base is only as trustworthy as what goes into it.
If the vendor folder holds a forged Drug Licence, or a GST certificate for a registration cancelled two years ago, the engine will retrieve it faithfully and cite it precisely.
This is where document verification and retrieval meet. Documents that pass through DocuExprt arrive as structured, verified records rather than loose scans.
Fields are extracted with 99%+ OCR accuracy across 20+ languages, including handwriting. PAN, GSTIN, CIN, DIN, FSSAI, Udyam and licence numbers are checked live against 30+ government APIs.
Tamper detection, digital-signature validation and QR checks flag altered files. Every check is written to an audit trail; the AI document verification guide explains each layer.
Feed that output into Company Brain and the questions change. They stop being "find me the file" and become "answer this from the facts".
| Source document | What DocuExprt extracts and verifies | What the Brain can then answer |
|---|---|---|
| Distributor Drug Licence | Licence number, holder, state, validity dates; tamper check | "Show all distributors whose Drug Licence expires before December" |
| Vendor GST certificate | GSTIN, legal name, status via GST API | "Which vendor agreements were signed with a GSTIN that is now cancelled?" |
| Vendor incorporation documents | CIN, DIN of directors, registered office | "List vendors where a director also appears on our restricted-party list" |
| Signed contract PDF | Parties, effective date, term, digital signature validity | "Which active contracts carry a 30-day termination clause?" |
| KYC pack (PAN, Aadhaar-consented, bank proof) | Field match across documents, account name match | "Which onboarded parties have a bank account name that differs from the PAN name?" |
| Compliance declarations and undertakings | Signatory, date, declared jurisdictions | "Which distributors declared operations in a state where their licence is silent?" |
The pharma example is real. DocuExprt onboards distributors for one of the world's four largest pharma companies across all Indian states, 13 to 15 mandatory documents each.
A state-wise rule engine and a real-time compliance dashboard sit on top. A retrieval engine over that verified corpus turns a quarter-end scramble into a query.
The hidden costs of manual document processing explains what the scramble costs today.
Six Compliance Use Cases, One Scenario Each
🔖 1. Policy version Q&A with effective dates
A regional compliance officer asks what the gifts-and-hospitality limit for a government official was in February this year.
The engine returns the limit and cites Policy GH-04 version 3.2, effective 1 January to 31 March. It notes that version 3.3 raised the disclosure threshold from 1 April.
Nobody has to open seven PDFs to work out which was live.
📑 2. Contract clause retrieval across hundreds of agreements
Legal ops needs every agreement with an indemnity cap below 12 months' fees, and every data-processing addendum that still names the old sub-processor.
Across 600 contracts, the engine returns clause text and page numbers in under a minute.
Human review of the shortlist takes an afternoon rather than the three weeks a full read would need.
📁 3. Audit and regulator query response with an evidence bundle
Back to Friday at 6 pm. The regulator's two questions become two queries.
The engine returns the vendor policy version live on 14 March, the list of contracts with a 30-day termination clause, and the source pages for each.
The compliance head reviews, approves and sends an evidence bundle on Monday morning. Nothing left the building without a human decision.
🎓 4. Onboarding new compliance staff
A new analyst spends the first month asking senior colleagues where things are.
With a cited knowledge base, the analyst asks the engine first and a senior only when judgement is needed. The seniors get their afternoons back.
🏛 5. RTI and complaint responses for public bodies and universities
A university RTI cell receives 40 requests a month, most asking what a circular, ordinance or fee notification said on a given date.
A retrieval engine over the ordinance archive answers each with the exact clause and issue date. The cell drafts responses in hours, and the registrar approves them with sources attached.
Grievance cells and public-sector legal desks work the same way.
🛡 6. DPDP readiness
The Digital Personal Data Protection Rules were notified on 13 November 2025. Full compliance becomes enforceable on 13 May 2027, with security logs retained for one year.
Most organisations cannot yet answer "where does personal data sit, and how long do we keep it?" A knowledge base over policies, DPAs, retention schedules and system inventories can.
Ask which processes hold Aadhaar images beyond the retention period and it returns the schedule, the owner and the source.
Time to Answer an Audit Query: Manual Search vs Cited Retrieval
Time-to-answer for audit queries is the usual success metric: it moves from days to minutes and is easy to measure before and after.
Guardrails That Make Auditors Comfortable
The Reserve Bank of India's Master Direction on IT Governance expects regulated entities to keep evidenced control, logging and access management over automated systems.
A retrieval engine used for compliance work should meet that bar. These are the guardrails a buyer should insist on, and the ones Company Brain ships with.
- ✅ Answers only from indexed sources. If the source is absent, the answer is "I don't know, no indexed document covers this". No invented clauses.
- ✅ Draft-and-approve by default. Anything that leaves the building is a draft until a named person approves it.
- ✅ Per-user access mirrored from your permissions. A user cannot retrieve a document they could not open in the source system.
- ✅ Full query audit log. The log is itself audit evidence and meets the DPDP one-year security-log requirement.
- ✅ Retention rules. When a source document is deleted under policy, its passages leave the index.
- ✅ On your infrastructure. VPC, private cloud or the CERT-IN stack. No confidential text passes to a public model.
- ✅ No lock-in. Standard containers keep running if the engagement ends. On the Agent Partner tier, source code and IP transfer to you.
How It Is Implemented in Six Weeks
Splashgain deploys Company Brain the way it deploys every agent: Discover, Prioritise, Build, Deploy, Operate.
Corpus map + metric
2-3 outcomes, never 20
Index + 50 real questions
Logging, permissions, training
SLA + monthly metric
| Phase | What happens | Compliance-specific output |
|---|---|---|
| Discover (week 1) | Two workshops; name the metric | Corpus map: where policies, contracts and verified documents actually live |
| Prioritise (week 2) | Shortlist 2-3 outcomes, never twenty | First corpus chosen; access model agreed with IT and legal |
| Build (weeks 3-4) | Two-week sprint on real data in a sandbox | Index built; 50 real questions from your team answered with citations |
| Deploy (week 5) | Monitoring, logging, rollback, named owner, training | Query audit log live; permissions mirrored; users trained |
| Operate (week 6 onward) | Run under SLA, report the metric monthly, or hand over | Time-to-answer for audit queries reported monthly |
For teams that want proof before commitment, the Agent Readiness Sprint is the entry point: fixed fee, ten working days, credited against deployment.
It delivers process and data discovery, a prioritised roadmap, an ROI model from your own volumes, an executive readout, and one working prototype on your data.
For a compliance team the prototype is concrete: 200 contracts and your policy folder indexed and queried in front of your team, with citations, on day ten.
Qualification is strict: a named process owner, a process that runs at least weekly, documents reachable by API, database or file share, and someone who can state the cost of getting it wrong.
If any answer is no, you hear it at the end of week one, not at the end of a contract.
Proof at Scale
Retrieval quality depends on the corpus. Corpus quality depends on verification at volume, and that is where the DocuExprt record matters.
The document scrutiny guide describes the checks behind those numbers.
The organisation behind both products is CERT-IN certified and ISO 27001 certified. It serves 500+ customers in 17+ countries and runs 35+ AI agents in its own production, including the Company Brain its own teams query every day.
Those are the credentials a CISO checks before a single contract is indexed. Full platform capabilities are listed on the features page.
Key Takeaways
- A private AI knowledge base answers only from your own indexed documents, on your infrastructure, with a source attached to every answer.
- RAG means find the passages first, then answer, then show the passages. It is a citation discipline, not a chatbot trick.
- Public chatbots send text to a provider, cannot see your corpus, rarely cite, do not log for your auditors and charge per seat. A private engine reverses all five.
- Company Brain is Splashgain's private retrieval engine: self-hosted vector store, full query audit log, role-based access, deployed in your VPC or the CERT-IN stack.
- Retrieval scales bad inputs. DocuExprt-verified documents (99%+ OCR, 30+ government API checks, tamper and signature validation) give the engine a corpus of facts, not scans.
- Six compliance uses: policy versions, contract clause retrieval, regulator evidence bundles, staff onboarding, RTI responses, DPDP data mapping ahead of 13 May 2027.
- Guardrails to insist on: answers only from sources, "I don't know" when absent, draft-and-approve, mirrored permissions, query audit log, retention rules, no lock-in.
- Start small: 500 to 5,000 documents, one owner, one metric. A ten-day Readiness Sprint proves it on your own policy folder and 200 contracts.
Frequently Asked Questions
What is a private AI knowledge base for compliance teams?
It is a self-hosted retrieval system that indexes your policies, contracts and verified documents and answers questions only from that index. Each answer cites the document, section and version it came from. It runs in your VPC or a certified private stack, logs every query, and respects your existing access controls. It never sends confidential text to a public model.
How is retrieval-augmented generation different from asking a public chatbot?
A public chatbot answers from its training data and whatever you paste, and it may invent a clause or a citation. Retrieval-augmented generation first searches your own documents for relevant passages, then composes an answer from those passages only, and shows them. If no passage covers the question, it says so instead of guessing.
Can the engine really say "I don't know"?
Yes, and it should. Company Brain is configured to answer only from indexed sources. When no source covers a question, the response states that no indexed document addresses it. For a compliance team this is a feature: a wrong answer with a confident tone is more dangerous than an honest gap that sends a human to the archive.
How do DocuExprt-verified documents improve a knowledge base?
DocuExprt extracts fields with 99%+ OCR accuracy in 20+ languages, verifies PAN, GSTIN, CIN, licences and more against 30+ government APIs, and flags tampered files. The output is a structured, verified corpus. The engine can then answer questions such as which distributor licences expire this quarter, or which contracts were signed with a GSTIN that is now cancelled.
How long does deployment take and what does it cost?
Six weeks from first conversation to a live engine, following Discover, Prioritise, Build, Deploy and Operate. Pricing is a flat platform fee with unlimited internal users and no per-seat charge, priced against a metric such as time-to-answer for audit queries. A fixed-fee ten-day Readiness Sprint, credited against deployment, delivers a working prototype on your own documents first.
Closing: The Answer Should Carry Its Source
Compliance work is answering questions with evidence, on a deadline, without leaking the evidence.
A private retrieval engine over contracts, policies and verified documents does exactly that. It finds the passage, cites the version, logs the query and stays inside your infrastructure.
When the person who knew everything resigns, the knowledge stays.
Over the next two years, DPDP enforcement, tighter IT governance expectations and the sheer volume of vendor and contract documents will push every compliance function towards this model.
The teams that start with a small, verified corpus and one measurable metric will get there with the least disruption.
Or explore the Company Brain pack and the Agent Readiness Sprint.