Key facts
| Retrieval | Hybrid keyword plus vector search over your own index |
| Embeddings | plugsky-embed and plugsky-embed-multilingual via /v1/embeddings (live) |
| Generation | Cited answers through /v1/chat/completions with JSON mode (live) |
| Models | 30+ models, including plugsky-longctx for multi-document synthesis |
| Access model | ACL metadata stored per chunk and applied as a pre-filter |
| Residency | Region-locked planes plus VPC, on-prem and air-gapped options |
| Free tier | plugsky-micro and plugsky-lite on the free plan, no card |
| Roadmap endpoints | Connector-style files and batch endpoints are coming soon |
TL;DR
- One retrieval layer across SharePoint, Confluence, Drive and ticketing beats per-app search.
- Store ACL metadata on every chunk and filter at query time, not after generation.
- Hybrid retrieval catches exact identifiers that vector similarity alone misses.
- Answers must cite sources with links back to the live document and its version.
- Keep the whole stack inside a region-locked plane when policy requires it.
How it works, step by step
- Inventory candidate sources and pick two connectors for the first release — usually a wiki plus a document store.
- Define a canonical chunk schema: source system, document ID, version, URL, section, last-modified date and access groups.
- Parse and chunk documents, embedding each chunk with plugsky-embed (or plugsky-embed-multilingual) and writing vectors plus schema fields.
- Build a retrieval service that resolves the caller's groups and applies ACL and freshness filters before ranking.
- Combine keyword and vector scores, then take the top passages into a chat call that must answer only from them.
- Return an answer with inline citations linking to the live documents, plus a fallback list of raw results.
- Track deflection, citation accuracy and zero-result queries, and expand connectors only when the first two sources hold up.
Original data
Try it yourself
Open the RAG architecture builder →
One retrieval layer across many sources
Enterprise search fails when every tool has its own search box. RAG fixes that by normalising sources into a single chunk schema and a single ranking path. Each connector owns ingestion and change detection; the retrieval layer owns ranking; the generation layer owns synthesis and citations. Keeping these responsibilities separate lets you add a source without touching the answer prompt.
Normalise aggressively on fields you will filter on: source system, document ID, URL, section heading, version and access groups. If a connector cannot report changes, fall back to scheduled re-crawls and mark staleness in metadata so the ranking step can demote old copies.
Permission-aware retrieval
The core security rule is that filtering happens before the passages reach the model. Resolve the caller's identity and group membership in your service, translate that into an ACL filter on the vector query, and only then retrieve. Never retrieve broadly and ask a prompt to hide documents — the context window is not an access control.
- Groups, not users: store group identifiers per chunk and intersect them with the caller's memberships.
- Versioning: include document version and modified date so stale chunks can be excluded or demoted.
- Audit: log which chunks were retrieved for which caller, so access reviews can replay any answer.
Answer quality, citations and rollout
Search answers earn trust through citations. Request a structured response — a short answer plus a sources array drawn from the retrieved chunk IDs — and render each source with its title, section and a deep link. When the top passages disagree, instruct the model to present both and let the user decide.
Roll out in stages: shadow mode against real queries, then a pilot group, then general availability. Measure relevance, citation accuracy and zero-result rate, and review the queries that failed. For teams with residency obligations, the same architecture runs in a region-locked plane or fully on-prem, since only your own services hold document stores and filters.
Honest comparison
| Capability | Plugsky RAG search | Per-app search | Building in-house |
|---|---|---|---|
| Coverage | One index across sources you connect | Siloed per application | One index you build and operate |
| Permissions | ACL pre-filter on every query | App-specific, inconsistent | You implement the model |
| Embeddings | plugsky-embed and plugsky-embed-multilingual (live) | Usually keyword only | Self-hosted embedding service |
| Citations | JSON mode with source arrays and deep links | Raw result lists | You design the format |
| Residency | Region-locked planes, VPC, on-prem, air-gapped | Vendor-dependent | Wherever you deploy |
Frequently asked questions
Which sources can I connect?
Any source you can export or query — SharePoint, Confluence, Drive, wikis, ticketing and file shares. Connectors are your code; Plugsky supplies the live embedding and chat endpoints.
How do you keep permissions correct?
Resolve the caller's groups in your service, store the same group identifiers on every chunk, and apply them as a hard filter before ranking. Never rely on prompting to hide documents.
Should I use vector search only?
No. Combine keyword and vector scores: embeddings handle paraphrase and intent, while keyword matching catches exact IDs, clause numbers and product codes.
Does Plugsky host my index?
No. Your content and vectors stay in your infrastructure. Only the passages you retrieve are sent as prompt context, and retention is configurable.
How fresh can results be?
As fresh as your connectors. Index on change events where available, schedule re-crawls otherwise, and store version metadata so stale chunks can be demoted.
Can multilingual content be searched together?
Yes. plugsky-embed-multilingual embeds multiple languages into a shared space, so a question in one language can retrieve documents in another.
Can it run fully inside our network?
Yes. Plugsky supports VPC, on-prem and air-gapped deployment, and region-locked cloud planes for residency-bound content.