GDPR-compliant RAG boilerplate. Self-hosted, Python-only, and built to be customized.
Any VPS with Docker in any EU datacenter. One
docker compose up and five containers start:
app, worker, Redis, ChromaDB, and Ollama. No Kubernetes,
no managed services, no surprise bills. Use a cloud LLM
API for chat or point to your own GPU server.
PDF, DOCX, PPTX, XLSX, CSV, HTML, TXT, Markdown. Smart OCR routing detects text-based PDFs and skips the heavy extraction pipeline - 20× faster than running everything through OCR. Scanned documents still get full layout-aware extraction. Chunks preserve page numbers, section headings, and content types into retrieval. A Redis worker queue processes everything in the background.
Ollama for fully local inference. EU-hosted cloud APIs: Mistral, Scaleway, OVHcloud, IONOS - all EU-headquartered, none subject to the US CLOUD Act. Any OpenAI-compatible endpoint works out of the box. Strict EU Mode blocks non-compliant providers before data leaves your server. Switch models per conversation from the chat UI.
BM25 keyword search fused with vector similarity using Reciprocal Rank Fusion. Pure vector search misses exact terms - product codes, legal references, technical identifiers - because embeddings blur them into semantic neighbours. EuroRAG runs both in parallel so 'Article 17' returns Article 17. Each user gets an isolated search index - no cross-user data leakage, even through keyword queries.
Deletion cascades across database, vectors, search index, and disk - no orphaned personal data in any storage layer. Audit logging tracks 22 action types. Users export their data as JSON or ZIP. Configurable retention with automatic cleanup. Consent enforcement on registration with withdrawal support.
SSRF protection across all connectors. Per-endpoint rate limits (auth: 5/min, chat: 20/min, upload: 10/min). File content validation with libmagic, not just extension checking. Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options. MaxBodySize middleware prevents memory exhaustion. Path traversal prevention on all file operations.
Full /v1/chat/completions and
/v1/embeddings endpoints. Point any existing
library - Python openai, LangChain, LlamaIndex
- at EuroRAG by changing the base URL. SSE streaming in the
built-in chat UI.
Add API routes, override templates, swap vector stores or
embedding providers, hook into the RAG pipeline at 9 event
points - all from a custom/ directory that
survives when you pull core updates. No merge conflicts.
FastAPI + Jinja2 + HTMX. One language from API routes to page templates. No React build pipeline, no Node.js runtime, no separate frontend deployment. Your Python developer owns everything.