Grounded assistant inside a government boundary
Deployed fully on-tenancy inside a government security boundary: P95 answer latency 2.1 seconds, groundedness score 0.94 on the golden set, and zero data egress findings at review.
Capability · Epcotec
Grounded AI that cites its sources.
RAG, assistants, productivity suite connectors, eval harnesses, cost controls. Delivered by named senior engineers, fixed scope, staging from week one.
Epcotec builds AI systems that hold up in production. We connect large language models to your real data: documents, databases, tickets, phone systems. Retrieval cites its sources, evaluation suites catch regressions before users do, and running costs are agreed in advance. Typical work is a retrieval-augmented assistant over a knowledge base, a copilot inside an existing product, or document pipelines that extract structured facts from untrusted input. Every engagement is delivered by named senior engineers in two-week sprints, staged from week one, with the model-routing and prompt code handed over as your property. The stack is deliberately boring where it can be: pinned model versions, version-controlled prompts, monitored retrieval. Clients are Australian and Canadian businesses that need AI capability shipped inside a fixed budget, usually starting with a scope review and a written estimate after your free scope review.
What we deliver
The AI work we deliver.
Grounded retrieval assistants, deployed on-tenancy
RAG assistants deployed inside your tenancy with citation-grade answers, permission inheritance from your existing access control, and complete audit trails for every answer served.
Enterprise connectors with delta sync and ACL mapping
Go and TypeScript connectors for document stores, CRM and intranet systems, with delta sync, ACL mapping and resumable backfills that keep the index faithful to source permissions.
Evaluation harnesses as release gates
Golden sets, groundedness scoring and regression suites wired into CI, so every prompt, model or index change is measured against a fixed quality bar before release.
Cost controls and model routing
Routing tiers, caching and token budgets that cut inference spend without cutting answer quality, with per-team cost attribution so budgets are visible to engineering and finance.
Document intelligence pipelines
Python classification, extraction and normalisation pipelines at millions of pages scale, with human-in-the-loop gates where confidence is low and provenance retained for every downstream field.
AI receptionist agents
Front-of-house agents that answer routine enquiries, qualify requests and hand off cleanly to people, with transcripts, escalation rules and quality metrics reviewed weekly.
LLM-era security review
Prompt injection testing, data egress checks and tenant isolation review, producing a signed findings report your security team and auditors can accept.
Rough time estimate
Window: 4-10 weeks
Team: 1 AI engineer + 1 platform engineer
Complexity: M-L
Indicative only. A fixed price follows a free scope review.
Get a fixed quoteDelivery process
The sprint rhythm.
Week 0-1 · Discovery & fixed-scope SOW
A working session on your data, permissions and boundaries. We map sources, egress rules and success criteria, then sign a fixed-scope statement of work with the evaluation bar written in.
Week 1-3 · Data characterisation & on-tenancy build
We profile corpus shape, freshness and access control, then build the first assistant and connectors on-tenancy, on pgvector hybrid search, with permissions inherited from source systems.
Week 1-4 · Weekly demos, staging from week one
You watch working software every week on staging from week one. Demos are on your data, in your environment, against the agreed scenarios.
Week 3-8 · Eval harness wired to CI
Golden sets and groundedness scoring run in CI as a release gate. Every prompt, index or model change must clear the bar before it ships.
Week 8-10 · Handover & 30 days support
Runbooks, dashboards and cost controls are handed over with a walkthrough for your engineers, followed by 30 days of support while your team takes ownership.
Benchmark deliveries
AI work, delivered.
Document intelligence at 2.4 million pages
A pipeline processing 2.4 million pages with human-in-the-loop gates at low confidence, provenance retained per field, and throughput tuned so review queues stayed within agreed service levels.
Enterprise connectors at 1.2 million objects
Go delta sync connectors indexing 1.2 million objects with ACL mapping faithful to source permissions, delta sync keeping the index current, and the compliance review passed first pass.
More evidence in the delivery history and the complete 756-engagement register.
Standards & compliance
Governed AI, from prompt to production.
Operations and deliverables conform to the cross-cutting standards below, and AI work is governed end to end: model and prompt data are registered, evaluated and overseen by named engineers under AI management aligned with ISO/IEC 42001.
ISO/IEC 27001-aligned information security management
Operations and deliverables run under a documented management system aligned with ISO/IEC 27001:2022. The controls shape scoping, review, change management and evidence capture on every engagement.
Australia: Governs every Australian engagement, including hosting decisions and data residency.
Canada: Governs every Canadian engagement, including hosting decisions and data residency.
ISO 9001-aligned quality management
Quality management aligned with ISO 9001 governs scoping, review gates, acceptance criteria and handover, so every deliverable passes the same documented checks.
Australia: Applies to delivery for Australian clients across all service lines.
Canada: Applies to delivery for Canadian clients across all service lines.
Privacy Act 1988 and Australian Privacy Principles
Personal information handled in Australian engagements is processed in line with the Australian Privacy Principles, with access controls and data-handling rules carried through every environment.
Australia: Applies to all Australian engagements and to data processed on behalf of Australian clients.
PIPEDA and provincial privacy law
Personal information handled in Canadian engagements is processed in line with PIPEDA and applicable provincial law, including Quebec Law 25 where relevant.
Canada: Applies to all Canadian engagements, with Quebec Law 25 obligations observed where data or operations touch Quebec.
SOC 2-aligned controls
SOC 2-aligned controls are embedded in delivery: change management, access control, monitoring and evidence capture run on every engagement.
Australia: Evidence packs are available to Australian clients under NDA.
Canada: Evidence packs are available to Canadian clients under NDA.
ISO/IEC 42001-aligned AI management
AI work runs under management aligned with ISO/IEC 42001: registered AI use, documented evaluation, and human oversight of merges and releases.
Australia: Model, prompt and evaluation data are handled under the Australian Privacy Principles.
Canada: Model, prompt and evaluation data are handled under PIPEDA and, where applicable, Quebec Law 25.
References to standards describe alignment. Certification is claimed only where an accredited certificate is published on this page.
FAQ
Questions we hear first.
Where does our data actually stay?
Everything runs on-tenancy: models, indexes and logs inside your boundary. No corpus, query or answer leaves your environment, and we evidence this in a signed security review.
Which models do you use?
Open-weight models run in your environment where residency demands it, hosted models where they do not. We route per query by cost and risk, and you stay free to swap models.
How do answers inherit permissions?
Connectors map source ACLs into the index, and retrieval filters by the asking user at query time. Users see only what they could open in the source system, verified by test sets.
How do you control cost?
Tiered routing sends routine queries to cheaper models, caching absorbs repeated questions, and token budgets cap worst cases. Per-team dashboards show spend, and the eval harness proves quality did not drop.