The AI may go online — your company knowledge may not

“If the AI is allowed onto the internet, data protection is finished.” The objection comes up in almost every conversation, and it is a fair one. A search query is information about you: what is on your mind, which topic you are checking, which name you are looking up. Send it to somebody else's service and you have handed exactly that over.

SouveraLotse now has web research all the same. The work was not in the searching — that part is technically easy. It was in the separation.

Three modes that exclude one another

The chat now has three areas, and every single message belongs to exactly one of them:

• Knowledge base — the answer comes from your documents, with sources. No internet.
• Free chat — the language model answers from what it has learned. Neither your documents nor the internet.
• Web research — the model may search the web. Your documents stay out of it.

There is no hybrid. That is not a matter of usability but the basis for everything else: where two paths never touch, nothing can flow from one into the other.

Five commitments that counted as acceptance criteria

These five points were conditions in the specification, not wishes. Without them the feature would not have been built.

1. The modes exclude one another per message. A question in research mode triggers no search in your documents. No group, document or knowledge-base content is placed into the context.
2. Only your question leaves the building. What goes to the search engine is the query formed from your current input — never a document passage, never a system instruction, never another user's data.
3. The conversation history cannot leak. Switching modes mid-conversation could leave document text further up the history. Each area therefore keeps its own history: a research conversation contains no knowledge-base message, by data model.
4. Nothing flows back. Web results are not written into the document index, not embedded and not stored as a knowledge source. They live only in the one answer they were fetched for.
5. The network is separated too. The search service is the only component in the system with a connection to the outside. Document storage, processing and the remaining services have no route to the internet — so the two paths do not touch even at network level.

Our own search engine instead of somebody's API

Searching runs through a self-hosted search engine on your own infrastructure. It bundles public search services without building a profile of you: no accounts, no recognition, no history at a provider.

That is the difference from a purchased search API. There, every query would be attributable to a contract account — and therefore to your company.

Deliberately small

The first stage does exactly one thing: search, and answer from the result descriptions. Whole pages are not fetched, there are no clickable citations yet as there are in the knowledge base, and there is no second round of searching. That will come, but later.

We would rather build a small feature whose limits we can state than a large one whose behaviour we can no longer survey. For a feature that could move data outwards, that is not a matter of taste.

Off by default

Web research is switched off as delivered — and completely so: the search service is not even started, the button does not appear in the interface, and even a hand-crafted request is rejected.

Turning it on is a deliberate decision by the operator, not the manufacturer's default. Anyone who chooses local AI because nothing should leave the building should not have to switch something off first.