How it works
The on-premises stack
All on one machine inside the customer network. Only the services listed below expose a port.
| Service | What it does | Exposed |
|---|---|---|
| app | Chat, login, administration panel, browser API | Port 443 on the customer network |
| worker | Indexing, source scans, deep research, migrations | Internal API on 127.0.0.1 only |
| postgres | Postgres 17 with pgvector: users, indexed documents, vectors, conversations | Internal Docker network only |
| llm | vLLM, the only inference engine | Internal Docker network only |
| embed | Qwen3 Embedding served by vLLM, 1024 dimensions | Internal Docker network only |
| rerank | Qwen3 Reranker served by vLLM | Internal Docker network only |
| docling | docling-serve: text, tables and OCR from PDF, Office, scans | Internal Docker network only |
| updater | Signed updates, database copies, certificate, licence | System service, outbound connections only |
One question, step by step
Search always runs before the first model call: no turn wasted deciding whether to search.
- The question goes straight into hybrid search: vectors (HNSW index, cosine distance) and text (italian and simple indexes) in parallel, each with the permission filter inside the query.
- The two lists are fused by reciprocal rank, the top 40 passages go to the reranker and the best 8 enter the model context, each with document, heading path and pages.
- Then the agent works with tools: cerca_documenti, leggi_documento, elenca_cartella, the enabled MCP servers and the user personal sources, within 8 steps and a token budget.
- For broad questions it delegates to subagents: same user and same permissions, read-only tools, one level, 90 seconds, a semaphore across the instance. The main model only receives the summaries.
- The answer streams with citations on the exact passage. The passage opens only if the file permission is still valid at that moment.
Permissions
The model only sees what the user could already open. A deny always wins and when in doubt the file is invisible: any error while reading permissions removes it from the index.
| Source | Permissions |
|---|---|
| Windows network shares or NAS | Two layers that intersect: share permissions (per source) and NTFS ACLs of the file (per document). Both are required. |
| SharePoint, OneDrive, Teams | Item permissions from Graph; "anyone in the organisation" links become the "whole company" principal. |
| Upload collections | Groups chosen by the administrator. |
| Chat attachment | That user only, that conversation only. |
Local or external model
The agent loop and the tools are the same: what changes is where the compute runs.
Local (default)
vLLM on the customer machine. No document passage leaves the network.
External endpoint
OpenRouter or any OpenAI- or Anthropic-compatible endpoint. Document passages leave the network: the administrator sees it in writing and the bill is in the customer name.
App only, no GPU
App, worker, Postgres and docling on premises on a VM or a mini PC. We do not host instances.
Transparency (AI Act, art. 50)
Who does what under the European regulation on artificial intelligence.
borc is the provider of the AI system: it places it on the market under its own name, and art. 50(1) requires that people know they are talking to an AI. That is why the notice sits in the chat and stays visible.
The customer is the deployer: it uses the system under its own authority, following the instructions for use. Declared intended use: assistant on company documents. Using it for decisions on hiring, employee evaluation or credit would make it high-risk and is excluded by the contract. The training required by art. 4 is part of the service.