How to Choose a Canadian Agency for Secure RAG on Internal Documents

What Secure RAG Actually Means

Secure RAG on internal documents is not a demo problem. It is a procurement decision, and the agency you pick determines whether your assistant respects your access controls or quietly becomes a data-leak incident.

Retrieval-augmented generation lets a language model answer questions by pulling passages from your indexed documents instead of relying on its training data. The “secure” half is non-negotiable: the model must never return content a user could not already open themselves.

That guarantee needs two things working together. First, early-binding indexing, where permissions are imported at crawl time rather than enforced at query time. Second, a retrieval layer that filters on the caller’s identity before a single passage reaches the prompt. Most generic AI demos skip both. Most production incidents trace back to one of them failing.

The stakes are ordinary breach stakes. According to IBM’s 2024 Cost of a Data Breach report, the average breach reached USD $4.88 million in 2024, the highest on record. For a Canadian enterprise, an assistant that surfaces confidential HR, legal, or financial documents to the wrong employee carries the same regulatory exposure as any other breach under PIPEDA and Quebec’s Law 25.

Why Canadian Enterprises Want Canadian Secure RAG Agencies

Geography matters here for three reasons that vendor sales teams tend to understate.

Data residency. Quebec’s Law 25 and Canada’s PIPEDA require you to document where personal information goes and who processes it. If your pipeline sends document chunks to a model hosted outside Canada, your privacy officer has to sign off. An agency that has already mapped this for enterprise clients saves weeks of legal review.

Bilingual document corpora. A French-Canadian HR policy and an English job description are not the same document in two languages. Relevance tuning, chunking strategy, and passage retrieval all behave differently across EN and FR content. An agency that writes French natively catches those gaps before your pilot ends. One that runs French through a translation layer discovers them afterward.

Time zone and delivery speed. Mundane, but real. A Quebec enterprise running a short readiness audit needs a team that answers at 9 AM EST, not 6 PM CET.

Five Questions to Ask a Canadian Secure RAG Agency

1. Do they index permissions at crawl time or enforce them at query time?

Early binding means the index knows, at document level, who can read what. Query-time enforcement means the system checks permissions after retrieval, just before returning results.

The functional difference sounds small. The security difference is not. A query-time model can return passage metadata — titles, scores, source paths — for documents the user cannot open. An early-binding model removes those documents from the result set before retrieval even runs.

Ask specifically: show me how permissions from our SharePoint groups reach the search index. A credible answer names the identity provider, the refresh interval, and how nested groups get expanded. A vague answer about “role-based access” does not qualify.

2. Which source systems can they index, and at what permission granularity?

Most enterprise RAG projects fail at the connector layer, not the model layer. SharePoint, ServiceNow, Confluence, file shares, and Google Drive each enforce access differently. Site-level permissions behave nothing like per-record ACLs in ServiceNow.

Therefore, ask for connectors the agency has shipped to production, not ones they support in theory. “We can index SharePoint” means little without “at item-level permission, with security identity refresh every four hours.”

3. What is their LLM hosting model, and where does your content go?

Three architectures are common:

For regulated industries — financial services, public sector, healthcare — the question is not which model is smarter. It is which hosting model your legal team approves before the pilot ends. An agency that has delivered in regulated Canadian environments has answered this already. One that has not will meet the constraint at the worst possible moment.

4. Can they handle a bilingual corpus, not just multilingual content?

Handling EN and FR is not the same as handling bilingual. A bilingual corpus has documents that cross-reference each other between languages, employees who search in both, and institutional vocabulary that differs across the two. A Quebec public-sector body carries acronyms no English tokenizer resolves correctly.

Test it explicitly. During the pilot, run the same query in both languages and measure recall separately. If FR recall sits at 60% of EN recall, the “bilingual” claim needs qualifying.

5. What does their security review look like?

A credible agency hands you the questions their enterprise clients ask before go-live — not a sales sheet. Real questions about contractor access, offboarding propagation time, group expansion validation, content processing regions, and provider retention policies.

If they have never been through a security review, you are the first. That is fine for an experiment. It is not fine for a production assistant your employees will trust.

Coveo as a Technical Foundation for Secure RAG

Coveo’s Digital Workplace comes up consistently in Canadian enterprise conversations because it was designed for exactly this: unified, permission-aware search across enterprise sources, with a passage retrieval layer built for generative answering.

Its early-binding security model covers SharePoint, ServiceNow, Salesforce, Confluence, and file shares with document-level ACLs. Coveo Passage Retrieval chunks indexed content into passages, runs a two-stage retrieval against the permission-filtered set, and feeds only authorized passages to the prompt. Coveo also documents that its Relevance Generative Answering model is stateless and does not retain enterprise content after the call.

That said, Coveo is not the only valid foundation. Azure OpenAI on Your Data, Amazon Bedrock Knowledge Bases, and open-source stacks over a vector store are all legitimate in the right context. The right foundation depends on your existing vendor relationships, your security posture, and what your agency can actually ship — not on what demos best. Our Coveo practice covers this work directly.

ai12z: Purpose-Built for Enterprise Document AI

ai12z is a platform built for enterprise AI assistants over internal content. Where Coveo is a search platform that extends into generative answering, ai12z is an assistant platform that extends into search.

The distinction matters for implementation. ai12z ships faster when the primary goal is the conversational assistant. Coveo ships better when the organization already runs enterprise search that the RAG layer should extend rather than replace.

Sengo holds official implementation partnerships with both Coveo and ai12z. Consequently, we can recommend the right fit per project instead of defaulting to one vendor. For Canadian enterprises whose use case is primarily workplace knowledge retrieval, the honest answer on platform is usually: start with what your team already manages.

What a Secure RAG Readiness Audit Covers

Before committing to a multi-quarter build, a structured readiness audit tells you what you are actually dealing with. Ours covers:

• Source inventory. Every system holding documents employees ask about, mapped to its permission model and change-propagation speed.
• Identity provider audit. Active Directory, Entra ID, or other identity sources; group expansion behaviour; stale-group risk.
• Bilingual corpus assessment. Document distribution by language, vocabulary overlap, and gaps in FR indexing coverage.
• Hosting and residency map. Where chunks go, which model processes them, and what the provider’s retention policy actually says.
• Pilot scope recommendation. The two or three use cases carrying the most value with the least permission complexity.

The point is to replace a month-long discovery engagement with a short, focused diagnosis. You can also review our broader work on enabling teams with AI for how this fits a wider programme.

The Honest Answer on Timeline and Cost

A secure RAG proof-of-concept across three to five internal sources, with proper permission modelling, runs roughly six to ten weeks from kickoff to something your security team can evaluate. Not two weeks. The gap is almost always permissions: source inventory, identity provider configuration, and refresh-interval testing take longer than the retrieval and prompt work.

A full production system covering all enterprise sources, with monitoring, automated permission-sync testing, and a user-facing interface, typically runs four to six months. Teams that skip the readiness audit tend to discover their permission complexity in week eight rather than week two.

Pricing varies by agency and scope. As a market range, expect implementation partners to quote roughly $50K-$150K CAD for a well-scoped proof-of-concept, depending on connector count, identity provider complexity, and whether LLM hosting is managed or self-hosted. Platform licensing sits on top of that.

In short, the cheapest path is rarely the shortest one. An agency proposing a three-week demo without asking about your permission model is not being efficient. They are skipping the hard part. If you want to compare platforms first, our guide to enterprise search software for bilingual organizations is the place to start.