v1.0.0
13 July 2026
Added
- Core RAG engine: Hybrid search combining BM25 keyword matching with vector similarity via Reciprocal Rank Fusion (RRF). Per-user BM25 indexes for GDPR data isolation.
- OpenAI-compatible API: Drop-in endpoints at
/v1/chat/completions,/v1/embeddings, and/v1/modelsso existing tools and libraries work without changes. - Streaming chat UI with citations: Server-sent events (SSE) streaming responses with inline source citations linking back to original documents (page numbers, section headings, table markers).
- Document ingestion via IBM Docling: Upload PDF, DOCX, PPTX, XLSX, CSV, HTML, TXT, and Markdown. Table-aware extraction, OCR for scanned documents (auto-detects text-based PDFs to skip OCR for 20–50× speedup), and structure-preserving chunking via Docling's HybridChunker.
- Async document processing: Redis + ARQ worker queue with 2 concurrent workers (sized for Hetzner CX22). Stuck-document recovery runs automatically on startup and via daily scheduler.
- User authentication & session management: Cookie-based sessions, registration, login, password reset, consent tracking (GDPR Art. 7), and admin bootstrap via
ADMIN_EMAIL. - Security hardening: SSRF protection (private IP blocklist on all connectors), per-endpoint rate limits (auth 5/min, chat 20/min, upload 10/min), file content validation via libmagic (not just extensions), security headers middleware, and max-body-size guard.
- Per-provider data residency tracking: Every LLM/embedding provider tagged with HQ region and GDPR-compliance flag.
STRICT_EU_MODE=trueblocks non-EU providers at request level. - Docker Compose deployment: Single-command stack: app, worker, Redis, Ollama, ChromaDB. PostgreSQL + pgvector variant available.
- Data-source connectors (Professional tier): Local folder (incremental mtime sync), web crawler (sitemap + robots.txt + rate limiting), Nextcloud (WebDAV + Activity API), and database (async SQLAlchemy, multi-table sync).
- GDPR compliance dashboard (Professional tier): 11 live verification checks with evidence: consent enforcement, consent withdrawal, data export (Art. 15), rectification (Art. 16), erasure cascade (Art. 17), portability (Art. 20), audit logging (Art. 5(2)), EU data residency, retention enforcement, soft-delete purge, and data-source compliance.
- Admin panel (Professional tier): User management, audit log viewer, runtime model control (allow/deny models in chat dropdown), dynamic settings editor, and compliance report export.
- Audit logging: All data operations logged with metadata (never query text). Exportable as JSON.
- Configurable data retention: Per-user or global retention with automated daily enforcement and 30-day grace period before hard deletion.
- User data export: GDPR Art. 15/20 compliant JSON or ZIP export of all user data (profile, chats, documents, sources, chunks, audit logs).