A document chatbot is secure when it reliably delivers on four fronts: it only shows users the content they are authorized to see, it answers based on the current version of a document, every answer can be traced back to its source, and deleted or expired content also disappears from its answers. In addition, there is the framework in which all of this runs: where the documents are processed and whether they reach an external language model. Whether a provider adheres to this can be verified prior to launch with a few simple tests.

What Makes a Document Chatbot Secure

Permissions. A manual for service partners is not a document for end customers; a dealer price list is not meant for customer service. The chatbot must be able to adopt the access rights from the source or map its own. A search across all documents that is filtered afterwards is not sufficient for this purpose.

Versions. A device from 2018 requires a different set of instructions than the current model. If a new version replaces an old one, the old one must no longer provide answers.

Provenance. Every answer should show which document and which exact passage it originates from. Without provenance, no one can verify whether it is accurate.

Deletion. A document that is removed must disappear from the index and therefore from all future answers. For conversation histories, a retention period applies that is defined by the company.

The risks that arise when a language model is connected to enterprise knowledge are described in the article on generative AI and corporate knowledge.

A Document's Journey Through the Chatbot

1. Connecting. The document comes from a source, such as SharePoint, Confluence, a website, or as a standalone file. This is where it is decided whether the permissions are carried over from the source.

2. Processing. The text is parsed and made searchable, utilizing optical character recognition (OCR) for scans and images. The content remains within the company's dedicated environment at the provider.

3. Approving. Someone within the company determines which sources the chatbot is allowed to use and for whom. Without this step, the chatbot will answer questions using documents that were never intended for that purpose.

4. Updating. If the document changes at the source, the new version must replace the old one. How quickly this happens should be stipulated in the contract.

5. Answering. When a question is asked, the chatbot locates the relevant passages and formulates the response from them. This step reveals whether an external language model is involved and whether the response includes its source.

6. Deleting. If the document is removed or a retention period expires, the content disappears from the index. Conversation histories follow the configured deletion period.

How Mercury.ai Protects Documents

The Mercury.ai Knowledge Hub connects documents from SharePoint, Confluence, websites, and files, including Word, Excel, CSV, PDF, and images via optical character recognition. The frequency of source updates depends on the package and specific requirements, up to near real-time. Knowledge content can be technically filtered so that information only appears under defined conditions, such as for a specific permission level or use case. Every response is traceable back to its source.

Mercury.ai hosts the language models itself, based on licensed Mistral models. Documents and queries are not sent to any external AI provider and are not used for training. Processing takes place exclusively on AWS in Frankfurt, encrypted with TLS 1.3 and AES-256, and upon request with a customer-managed key. Roles govern who approves sources and reviews conversations, while an audit log records every change. Dedicated protection mechanisms safeguard against prompt injection and knowledge base tampering, and generative responses can be disabled for topics involving critical factual accuracy. Details can be found in the Security Paper on the EU AI Act and on the Security and Privacy page.

Five Tests Before Go-Live

You can conduct these tests yourself in a staging environment using real documents and actual roles.

1. Unauthorized access. As a user without access rights, ask for content from a restricted document. Expected result: no answer derived from this document, not even paraphrased.

2. Outdated version. Replace a document with a new version containing a modified value, and ask about it. Expected result: the new value, citing the new version as the source.

3. Provenance. Ask a question whose answer is located in exactly one document. Expected result: the answer with a reference to that document.

4. Injected instruction. Create a test document that contains an instruction directed at the chatbot, such as listing all prices. Expected result: the chatbot treats the sentence purely as content and does not execute the instruction.

5. Deleted document. Remove a document and ask for its content. Expected result: no further answers from this document, and instead a clarifying question or human handover.

If a chatbot passes all five tests, you have verified its most critical capabilities firsthand. Document your results; they form part of the compliance records outlined in the article on the EU AI Act in Chatbot Operations.

Would you like to test your document chatbot this way? Get in touch with us.