Secure retrieval (RAG) design

What it is for

Retrieval-augmented generation gives a model access to your documents. If the retrieval layer does not carry the permissions of the systems those documents came from, the model becomes a way around them: an employee asks a question and receives an answer built from files they could never open.

The 2025 OWASP list names this class of problem directly, as LLM08 Vector and Embedding Weaknesses and LLM02 Sensitive Information Disclosure.^⁠[1]

What we look at

• How access rights travel from the source system into the index, and whether they are checked at query time.
• Ingestion: who and what can add documents, and whether a planted document can steer answers or instructions.
• Tenant isolation in shared indexes, caches and embeddings.
• What leaks through embeddings, citations, snippets and logs.
• Deletion: whether a document removed at the source is removed from the index and its caches.

What you receive

A retrieval design that enforces permissions, the results of poisoning tests against your ingestion path, and a tenant isolation review with findings mapped under the TriOngle Method.

How it runs

Design review first, then targeted tests in a test environment you provide, with test evidence kept on EU servers only. Where personal data is in the index, we flag what your data protection impact assessment needs to cover; G1 EU AI Act, ISO/IEC 42001 and GDPR readiness, one report can produce it.