Ask your documents, get an answer with the page it came from

The assistant does two jobs. First it finds. Your documents are split into passages, each passage is turned into a numeric representation of its meaning, and those are stored in a search index next to the plain text. When someone asks a question, the system searches by meaning and by exact keywords, because contract numbers and clause references need exact matches while policy questions need meaning. Second it writes. The best passages are given to a language model with an instruction to answer only from them and to cite them.

Most of the quality comes from the finding step, not the model. How you split a document, whether tables survive, how headings travel with their paragraphs and how duplicates are handled decide whether the right passage is even offered. Microsoft's and AWS's own documentation describe the same pattern, and we use their managed search services or open-source stores depending on where your data must live. We show you the retrieved passages during testing so you can see why an answer was good or bad.

Arabic needs care at ingestion. The same word can appear with different forms of alef, with or without diacritics, or with a stretched letter, and a naive index treats them as different. Scanned contracts and stamped letters have no text layer at all, so they go through OCR first and we flag low-confidence pages for a human check. Mixed Arabic and English tables and right-to-left numbering can break chunking, so we test on your real files and not on clean samples.

Access rules are the part that decides whether a security team lets it near real data. We carry each document's permissions into the index and filter results per user before generation, so restricted content never enters the prompt. For quality, we build an evaluation set together with your subject experts: real questions, the expected source for each, and cases where the right answer is that nothing was found. Every change to chunking, prompts or models is scored against it. Without that set, nobody can say whether version two is better than version one.

Document sets often contain personal data, commercial terms or material your own policies keep inside the country. Under the Personal Data Protection Law, you need a lawful basis, retention rules and a way to handle access and deletion requests, and the assistant's logs and stored questions count as data too. We set log retention, mask sensitive fields where we can, and record who asked what for audit.

Where the data sits is a decision, not a default. Some firms are comfortable with a hosted model API for low-risk material. Others need the index and the model on infrastructure in the Kingdom, which we cover in our in-Kingdom hosting work, and some sectors have their own rules that your compliance team must confirm. A focused pilot on one document collection usually takes six to ten weeks. Adding more sources, more departments and a self-hosted model extends that to three to five months. The OWASP list of risks for language-model applications, including prompt injection through documents, shapes our testing.