AI governance: control and evidence for every AI answer.
With RAGSuite you decide who sees which knowledge, which language model answers and how long data is kept. Every action is in the audit log. This covers AI Search, AI Assistant and AI Connectors, in RAGSuite Engine in Germany and in Enterprise on your own servers. So IT, data protection and the works council can approve AI.
Full governance in RAGSuite Engine and Enterprise · the basics in every plan
Without governance, AI stays a pilot.
Staff use private AI accounts with company data, nobody knows where data is processed, and when the works council or internal audit asks, there is no evidence. RAGSuite turns those questions into settings in the platform.
- Private accounts with company data
- Everyone sees everything, or nothing
- No record of who asked what
- Unclear how long data is kept
- Roles, teams and project access
- Each team sees only its own sources
- Full audit log with export
- Deletion periods with receipts
What you control in RAGSuite.
Access
Organisations, teams, roles and project access. Sign-in with Google, two-factor sign-in, session timeout.
Audit log
Event type, user, project, action and severity. Complete, filterable, exportable.
Retention
Storage can be switched off, deletion periods with receipts, rules per source, compliance exports.
Models and quality
Model choice per project, model comparison and query tracing. A source on every answer.
Roles, teams and sign-in: who may do what?
The Community Edition has two roles, admin and member, and sign-in with email and password. In RAGSuite Engine and in Enterprise you set up organisation, teams and roles and share projects selectively. Google sign-in is added on top.
Access rights from source systems such as SharePoint are not carried over automatically; you separate content by project.
The audit log: who did what, and when?
The audit log records every action with event type, user, project, action and severity. The Community Edition shows the last 15 days. In RAGSuite Engine and in Enterprise the log is complete, can be filtered and exported for internal audit, data protection and supervisors.
| Time | User | Action |
|---|---|---|
| 24 Sep 09:14 | a.weber | Source added |
| 24 Sep 08:52 | a.weber | Role changed |
| 23 Sep 17:30 | p.neumann | Model switched |
| 23 Sep 11:05 | a.weber | Retention changed |
| 22 Sep 16:48 | l.hoffmann | Sign-in |
| 22 Sep 10:12 | a.weber | Export created |
Store, delete, prove.
Conversation storage can be switched off for chat and search separately. Automatic deletion periods remove old history, with receipts. In RAGSuite Engine and in Enterprise, retention rules per source and compliance exports are added.
Where does your data go? You decide.
In RAGSuite Engine, documents, search index and history live in a data centre in Germany. Self-hosted, everything stays on your servers, with a local model, nothing leaves your network at all. If you use an external language model, only the question and the matching passages go to that provider. You set this per project. Here is what that looks like self-hosted:
Nothing leaves the building. Works with no internet connection (air-gapped).
Data leaving: noneOnly the question and the matching passages go to the provider you chose, with your own key.
Data leaving: question + passages → EU providerOnly the question and the matching passages go to that provider. Your documents stay with you.
Data leaving: question + passages → model providerRAGSuite itself never sends data to us. No phone-home, no telemetry. Compare models →
Set up governance in four steps.
In RAGSuite, projects are the boundary for knowledge. Each project has its own sources, settings and widgets. That ensures a team only gets answers from content it is allowed to see.
Define the cut
One project per team or confidentiality level, such as “All staff”, “HR”, “Management”.
Assign sources
Only the libraries, spaces and files that all users of the project may see.
Grant access
Assign teams and roles to the project, in RAGSuite Engine and Enterprise.
Review
Ask test questions and check in the audit log who accesses what.
What each team needs to approve AI.
Roles, sign-in with Google, audit log, running on your own servers and no phone-home.
DPA, DPIA template, deletion periods and data location in Germany.
Clear rules on who sees what, and an AI usage policy template.
Audit export, a source on every answer and the Trust Center documents.
What is in which plan?
| Feature | Community | RAGSuite Engine | Enterprise |
|---|---|---|---|
| 2FA, sessions, sign-in notifications | ✓ | ✓ | ✓ |
| System status | ✓ | ✓ (run by RAGSuite) | ✓ |
| Roles | admin and member | roles, teams, project access | roles, teams, project access |
| Sign-in | email and password | ||
| Audit log | last 15 days | full, filters, export | full, filters, export |
| Storage off, deletion periods | ✓ | ✓ | ✓ |
| Retention per source, compliance exports | – | ✓ | ✓ |
| Model comparison, query tracing, advanced analytics | – | ✓ | ✓ |
| Hosting | You | RAGSuite, data centre in Germany | You or a dedicated instance |
| White-label, air-gapped | – | – | by agreement |
| Support | Community | Email DE/EN | Email DE/EN, SLA by agreement |
Questions about AI governance.
What does AI governance mean?
AI governance is the set of rules and evidence a company uses to run AI under control: who has access, which data is used, which language model answers, and how that is documented. In RAGSuite, these rules are settings in the platform.
What governance is in the free Community Edition?
The basics: two-factor sign-in, session management, admin and member roles, storage that can be switched off, deletion periods and a 15-day audit log. Organisations, teams and project access, sign-in with Google, the full audit log and retention rules per source come with RAGSuite Engine and Enterprise.
Does RAGSuite support single sign-on?
In RAGSuite Engine and Enterprise, users sign in with their Google account. We only name further directory connections once they are available. Ask us about the current status for your environment.
Does RAGSuite help with the EU AI Act?
RAGSuite provides building blocks for it: the audit log, a source on every answer and control over which model answers. The duties under the AI Act stay with your company. Our EU AI Act guide shows what applies now.
Are permissions from SharePoint or Confluence carried over?
Not automatically, today. Separate content by project: each project has its own sources and settings. In RAGSuite Engine and Enterprise you also decide which teams can access which project.
Show your review team the governance live.
We show roles, the audit log and deletion periods on a setup like yours, or you test it yourself in RAGSuite Engine.