From knowledge sprawl to a unified knowledge base, compliant by design.

The brief

A 30-engineer business unit inside an adtech company, more than 50 people once you count every role. Their institutional knowledge existed but was scattered across Confluence, Jira and Git, with no single place to ask where something was or how it worked. People lost time hunting for answers, or interrupted colleagues to find things that were already written down somewhere. As the unit grows that tax only compounds, and knowledge quietly leaks out of the business.

The build

We pitched it, then built it. In a few days we shipped a self-hosted knowledge base, spent about two weeks testing, then rolled it out to the whole unit.

• Two ways in and an editor reach: a web app, a Mattermost chat integration and exposure into coding agents, so the same knowledge is reachable where people already work.
• Straight retrieval over Confluence, Jira and Git, reindexed every 15 minutes so answers track the current docs rather than a stale snapshot.
• Answered by an external model, Haiku, made safe to use by a compliance layer we built ourselves: an LLM proxy with guardrails that protects company information in prompts and retrieved context.
• Compliance layer over a local model: rather than stand up on-prem inference, we built the guardrails to a bar we trusted, so external models could be used safely without the cost and constraints of self-hosting.
• A deliberate data boundary: the index covers public, non-restricted content only, since retrieval does not yet honour per-source permissions. Built and configured solo, then handed to the cloud team under a clear RACI.

The result

• Shipped fast and safely: a few days to build, about two weeks of testing, then live, with every query running through the compliance layer from the first one.
• Met people where they already work, built into Mattermost and into coding agents, rather than a separate place they have to remember to visit.
• Positive reception across the 50 plus users in its first weeks.
• Honest caveat: the signal so far is enthusiasm, not measured value, because knowledge-base usage is not yet tracked.

Debrief

You do not need self-hosted inference to be safe. By building the guardrail and proxy controls ourselves to a bar we trusted, we could use external models and still ship a compliant-by-design internal product in days. The lesson rhymes with build versus buy: with the right setup, a capable operator builds in days what you would otherwise buy or live without, even when the product is internal.

The binding constraint also moved. With compliance built in and the adoption surfaces solved, the hard part is no longer proving value or enforcing use, it is content quality: what you feed the index. Duplicates, stale pages and low-signal docs degrade retrieval, and the instinct to capture everything pulls against answer quality. That is the next problem to solve, alongside per-source permissions and real usage measurement.