Ask your documents.
Nothing leaves the vault.

Encrypted document storage and retrieval-augmented Q&A built for banks and regulated institutions — envelope encryption at rest, phishing-resistant MFA, and inference that runs entirely on self-hosted, open-weight models.

ENVELOPE ENCRYPTION WEBAUTHN / TOTP SELF-HOSTED INFERENCE APPEND-ONLY AUDIT LOG BUILT WITH CLAUDE CODE

See it in action

The actual UI — documents and Q&A, side by side

Mockup of the real screens, same design system as the running app. Filenames and answers below are fictional demo data, not a real deployment.

secrag — localhost:8000

Your documents

Q3_2026_Treasury_Report.pdfDelete
2.4 MBactiveAug 21, 2026
Vendor_Agreement_Acme_Corp.pdfDelete
860 KBactiveAug 22, 2026
AML_Policy_v4.pdfDelete
1.1 MBactiveAug 24, 2026

Ask your documents

What was our Q3 travel & entertainment spend?
Q3 2026 T&E spend was €184,300, up 6% quarter-over-quarter — driven mainly by the Frankfurt client-onboarding push in September.
📄 Q3_2026_Treasury_Report.pdf · p. 12

Three features, built in sequence

Everything an employee needs, nothing a compliance team should worry about

Each feature shipped with its own written spec, implementation plan, data model, and API contract before a line of code was written — the full artifacts are in specs/ in the repo.

🔒

Encrypted ingestion

Upload a PDF → antivirus scan → envelope encryption with a fresh per-document key wrapped by Vault Transit → encrypted blob on disk. Nothing document-derived is ever stored, or logged, in plaintext.

Read spec.md →
🔑

Auth & MFA

Admin-provisioned accounts, password + phishing-resistant MFA (WebAuthn passkeys preferred, TOTP fallback), step-up re-authentication before sensitive actions, lockout, and admin-mediated password reset.

Read spec.md →
💬

Document Query (RAG)

Ask a plain-language question; the system retrieves your own relevant chunks and grounds a locally-generated, streamed answer in them — with page-level citations naming exactly where each fact came from.

Read spec.md →

How this was built

Built with Claude Code, spec-driven end to end

Every feature followed spec-kit's workflow inside Claude Code — a written spec and an implementation plan (checked against this project's own constitution) existed before any code did. Nothing here is a prompt-and-pray prototype.

3spec-driven features
57commits
4days, spec to shipped
0mocked security paths
01

spec.md

User stories, requirements, explicit non-goals — agreed before any plan existed.

02

plan.md

Architecture, data model, API contract, checked against the project constitution.

03

tasks.md

A dependency-ordered breakdown, each task small enough to verify on its own.

04

Implementation

Live-verified against the real Postgres/Vault/ClamAV/Ollama stack — not just a code read-through.

Architecture

Self-hosted, end to end

Document-touching inference — embedding and generation both — runs on Ollama, on infrastructure the project controls. No document content, extracted text, or embedding ever crosses a third-party API boundary.

Client
Browser
no framework, no build step
App container
FastAPI · REST + SSE
Auth & MFA
Ingestion pipeline
RAG pipeline
Stateful services
PostgreSQL
least-privilege role
Vault Transit
key wrapping
ClamAV
Encrypted blobs
Self-hosted inference
Ollama
nomic-embed-text + qwen2.5

Security & compliance posture

Governed by an explicit constitution

Every feature is checked against a written project constitution before implementation — not aspirational guidelines, structural constraints the schema and code enforce.

Zero plaintext at restEnvelope encryption covers documents and every derived artifact — extracted text, embeddings, conversation history.
Phishing-resistant MFAWebAuthn/passkeys preferred, TOTP the accepted fallback; step-up re-auth gates destructive actions.
Least privilege by schemaThe app's runtime DB role has no UPDATE/DELETE on the audit table — revoked at the database level, not just convention.
Fail closedA Vault or inference outage returns a 503 — never a silent fallback or a degraded plaintext path.
Audit everythingEvery document read, AI query, and admin action is a tamper-evident, append-only log entry.
Owner-scoped retrievalChunks, embeddings, and citations never cross an owner boundary — even under a bug in ranking.

Tech stack

No framework theatre

A deliberately small surface — one backend, one Postgres database, static frontend files with no build step.

Python 3.12 FastAPI SQLAlchemy 2.0 Alembic PostgreSQL 16 HashiCorp Vault ClamAV Ollama Argon2id WebAuthn / FIDO2 TOTP Server-Sent Events Vanilla JS Docker Compose Traefik (optional)