How Kep’s Retrieval Works: Ownership-First, Model-Last

That’s the entire point.

The Security Model: No Trust in the Black Box

Kep’s retrieval-augmented generation (RAG) follows one non-negotiable rule: ownership determines accessibility before the LLM even sees the query.

Here’s what doesn’t happen:

• No “Hey ChatGPT, please only use documents User A is allowed to see”
• No “We trust the model to filter sensitive content”
• No “The answer sounds correct, so the permissions must be right”

Instead, the SQL query powering retrieval is filtered by ownership at the query level.

This is load-bearing. The model receives only documents the current user explicitly owns or has been shared—no judgement call, no post-filtering. If you don’t have access, the LLM never even knows the document existed.

Why This Matters for Regulated Industries

Three scenarios where model-trust fails catastrophically:

1. Inadvertent training data leakage – An LLM API provider’s logs retain the full context window, including documents the model “decided” not to use. Kep’s approach: those documents never leave the Mac Studio.
2. Hallucinated citations – A model inventing fake sources is annoying in a consumer chatbot. In a regulated firm, it’s a serious risk. Kep forces every answer to cite only documents the user could manually open from the UI.
3. Role confusion – Personal notes versus client-facing material must be firewalled at the infrastructure layer, not by hoping the AI “understands” the difference.

The Mechanics: Flask, SQLite, and One Very Strict WHERE Clause

Kep’s RAG flow follows the same ownership filter at every step.

1. Upload – A document is stored with its owner.
2. Query – A question triggers retrieval filtered by ownership and any explicitly shared access.
3. Response – Every generated answer includes a citation to its source document.

The API tests assert that one user’s private documents remain structurally unreachable to another.

What’s Deliberately Missing

Retrieval is hybrid: vector similarity search over embeddings plus a keyword-match fallback for exact terms such as contract numbers and names; results are ordered by vector distance. There is no reciprocal rank fusion and no re-ranker. What is distinctive is the order: the permission filter runs first, so distances are only ever computed over chunks of documents the user owns or that were explicitly shared with them.

Why? Because regulated professionals don’t search vaguely. Semantic search helps when you don’t know exactly what you’re looking for. Kep optimises for precision, not recall.

Local-Only Isn’t Just About the LLM

The cloud avoidance extends beyond model calls:

1. No usage telemetry – ratings, documents, questions and answers never leave the machine.
2. One-file backups – A client’s own local backup is a straight file copy.
3. FileVault enforcement – The installer refuses to continue unless FileVault is on.

The Compliance You Don’t Need

We could slap “GDPR-compliant!” or “SOC 2 certified!” on the landing page. But those are claims about processes, not technical realities.

Kep’s security comes from:

• Not having data to leak (nothing in the cloud)
• Not having logs to subpoena (no central logging)
• Not having a per-seat pricing model (so no incentive to track individual users)

The most compliant system is the one that—by design—can’t violate confidentiality in the first place.

—

Kep isn’t a “secure AI”—it’s an AI that structurally can’t be insecure. The Mac Studio isn’t a hosting choice; it’s the physical manifestation of the rule “your data doesn’t leave this room.” That’s what regulated industries actually need—not more checkboxes, but fewer failure modes.*