Your Documents, Your AI's Knowledge

One of the biggest limitations of general-purpose AI is that it doesn’t know anything about your organization. Ask ChatGPT about your internal policies, your treatment protocols, or your compliance procedures, and you’ll get generic answers that may be dangerously wrong in a clinical context. Retrieval-Augmented Generation, or RAG, solves this by letting the AI search through your actual documents before answering. But most RAG implementations treat every document as equally accessible to every user, which is a non-starter in healthcare where access controls on clinical, financial, and administrative documents are a regulatory requirement.

Fortaleza AI’s RAG pipeline was built with access control as a first-class feature, not an afterthought. Every document ingested into the system is tagged with an access group — such as “public,” “executive,” “clinical,” or “finance” — and those tags are enforced at query time through metadata filtering. When a user asks a question, the system only retrieves document chunks that match the user’s assigned access groups, ensuring that a billing department employee never sees clinical trial data and a nurse can’t accidentally surface executive compensation documents. The access group architecture is stored in the system with a dedicated section, and documents can be re-tagged without re-ingestion through a single API call or an administrative user interface.

The ingestion pipeline itself is designed for enterprise workflows with three complementary paths. On server startup, a directory scanner walks your configured document path, computes SHA-256 hashes for every file, compares them against the document registry, and only processes files that are new or changed. This means you can point the system at a network share containing thousands of documents and restarts take seconds, not hours. The second path handles chat uploads: when a user attaches a file during a conversation, the system answers their immediate question and simultaneously ingests the content into the system for future queries. The third path is an API for programmatic ingestion from CI/CD pipelines, document management systems, or batch processes.

We support over twenty file formats including PDF, DOCX, XLSX, CSV, Markdown, and common code files. Documents are chunked using configurable parameters, embedded using open source models running locally, and stored in the internal system. The entire pipeline — parsing, chunking, embedding, and storage — runs on your infrastructure with zero external API calls. The document registry tracks ingestion metadata including file hashes, chunk counts, timestamps, and access groups, giving administrators complete visibility into what’s in the knowledge base.

For healthcare organizations, the combination of local RAG with role-based access control is transformative. Clinical staff can query treatment protocols and drug interaction databases knowing the AI’s answers are grounded in your organization’s approved documentation, not internet training data. Compliance teams can search through policy documents without risk of cross-contaminating sensitive information. And because every document’s provenance is tracked in the registry, you can demonstrate to auditors exactly which documents informed each AI response. Fortaleza AI turns your organization’s institutional knowledge into a secure, searchable AI capability.