Where data is stored
All data lives wherever you install Ragen. Storage is not the complete picture, though: whether document content is transmitted to a third party during processing depends on how you configure the model backend. There is no telemetry channel to the vendor. OpenTelemetry support exists, but it is inert until you pointOTEL_EXPORTER_OTLP_ENDPOINT at a collector you run yourself.
What leaves your network
Every model call goes where your configuration points it — directly to a provider, or through a proxy you also run (Model gateway). What leaves your network depends on the destination, not on which path reaches it:
Two things to know before assuming full isolation:
Document parsing falls back to an off-site service.
DOCUMENT_PARSER=docling (the default) parses documents on your own hardware. If Docling fails, the worker falls back to loaders that may send PDFs to an external model. Set DOCLING_STRICT=1 to fail the ingest instead of falling back. For a deployment that must not transmit documents, this variable is not optional.
A fully air-gapped deployment takes deliberate work. The architecture supports it, but running a capable model on your own hardware requires GPU capacity and careful configuration of every service.
No analytics or vendor tracking
The application reports nothing to the vendor. There is no tag manager, no product analytics, and no usage ping in the Ragen app.Earlier builds of Ragen included a Google Tag Manager container that loaded on every page of a self-hosted install. This has been fully removed. If you’re running an older build, upgrade — there is nothing to configure to opt out in the current version.
Training
Your documents are not used to train or fine-tune any model, and not used to improve the product. Ragen has no training pipeline. If you route to a commercial API, that provider’s own terms govern what they do with prompts. Enterprise tiers of major providers typically offer zero-retention terms — confirm the terms for your specific plan.Access control
Ragen enforces two independent role hierarchies: platform-level (installation administrators) and organisation-level (owner / admin / member). On top of that, per-folder and per-file permissions can be granted to individual users or teams. The critical detail for any RAG product: permissions are enforced at retrieval, not only in the UI. Every indexed chunk carries anaccessible_by list in its vector-store payload. Non-admin queries apply that list as a filter before the vector search runs. Content a user cannot access cannot appear in an answer or a citation.
The common failure mode in other RAG systems is a permission filter on the file list while retrieval searches the whole corpus — the user never sees the document, but receives an answer synthesised from it. Test your own roles before going to production.
Tenant isolation is enforced separately. Each organisation gets its own Qdrant collection, and a guard logs any query that touches a tenant-scoped collection without its organisation filter applied.
Audit and security event logging
Ragen maintains two separate logs. Audit log — records who did what and when, including before-and-after state: document uploads and deletions, permission and role changes, API key creation and revocation. Security event log — covers 21 event types across three severity levels (info, warn, critical) with a handling status. Events include failed logins, brute-force attempts, attempted cross-organisation access, detected prompt manipulation, detected personal data, and rate-limit breaches. Each entry includes the IP address, user agent, and a request identifier.
Neither log has a retention policy or automatic deletion. Rows accumulate in Postgres until you remove them. Both tables hold personal data (IP addresses, user agents, user IDs), so defining and enforcing a retention schedule is your responsibility.
Direct export to a SIEM is not yet built. Both logs are queryable in Postgres and through the admin panel. Shipping them to Splunk or Sentinel today means reading those tables or the application’s structured logs.
PII detection
Personal data detection via Microsoft Presidio — including Polish recognisers for PESEL, NIP, REGON, ID card numbers and IBAN, which validate checksums rather than only matching a shape — is available and off unless configured. SetPRESIDIO_ANALYZER_URL and PRESIDIO_ANONYMIZER_URL, and start the two containers with docker compose --profile pii up -d. Chat fails closed if the analyzer is unreachable, and each organisation chooses what happens to the original. Full detail: PII masking.