Put AI on your records
without opening the vault.
haystak is on-premise software that indexes your file shares, databases, and cloud folders where they already are, and enforces one set of permissions on every way in: people in the portal, AI agents over MCP, analysts over SQL, and your own applications over REST. Every record, count, and passage is trimmed to the person asking.
Four ways in. One set of permissions.
People, AI, analysts, and your own apps reach the same corpus through the same RBAC engine, authenticated and fail-closed. No surface is a backdoor.
Search
Full-text and structured search across every indexed source, with results trimmed to roles, groups, and inherited scopes.
- facets, near-duplicates, tags
- saved reports + defensible sampling
- ask, with the records shown
MCP & ML tools
Two ways to put AI on the corpus: MCP tools for agents, and a RAG/ML API for retrieval and enrichment, both permission-trimmed to the caller.
- MCP · agent-native
- RAG · embeddings
- fail-closed
SQL endpoint
Speaks the SQL Server wire protocol (TDS). Point Power BI, Excel, or SSMS at the corpus and query it in T-SQL.
- files & records as tables
- INFORMATION_SCHEMA · sys.*
- permission-trimmed at the wire
REST API
Every capability over HTTP, documented in an OpenAPI spec with a built-in Swagger UI. Wire the engine into anything you build.
- OpenAPI + Swagger UI
- search · aggregate · render · ML
- same auth & scope
An assistant is only as safe as what it can retrieve.
Most AI projects that reach security review stop there, and the model is rarely the reason. The reason is the layer underneath: what the assistant is allowed to read on someone's behalf.
The index sees everything
Most search and retrieval indexes are built with full access and filtered on the way out. Whatever the filter misses, the assistant can say out loud.
Every surface copies the rules
The search screen, the API, the reporting connector, and the agent each carry their own permission logic, and each copy drifts from the others.
Agents are the newest door
An agent asking for a person must never see more than that person could. That includes counts and totals, which leak just as surely as documents.
haystak runs one permission check, in the engine that does the retrieval, before anything is returned, for every way in.
Your data lives everywhere. We index it in place.
No migration, no upload, no egress. Collectors run at the edge (on-prem or in the cloud), authenticate, read, and index. Nothing moves.
Index in place
Native connectors read sources where they are. One backend-agnostic engine unifies files, databases, and cloud into a single corpus.
Read, never write
Source files are never modified. Everything haystak derives (text, metadata, tags) is stored separately and append-only. Originals stay intact.
Any system, any platform
One engine over any of five backends, on macOS, Windows, or Linux. Never locked in. Elasticsearch and OpenSearch recommended for scale.
One engine. Your choice of backend.
The same haystak engine runs on Elasticsearch, OpenSearch, PostgreSQL, MariaDB, or MongoDB; you're never locked to one store. For production search at scale, Elasticsearch and OpenSearch are the recommended backends. Host it on macOS, Windows, or Linux.
A corpus that understands structure, content, and provenance.
Every fact keeps its origin: the source it came from, the file or row it lives in, and who entered it.
One query, files and databases
Files, cloud folders, and database rows in one result set, trimmed to each user's grants.
Joins across sources
A database row and the file it points at come back in one result, joined on the values they share.
Content is first-class
Extracted text is a searchable entity: query by what a file says, tag specific passages.
Render at ingest
Thumbnails, page previews, and video poster + scrub sprites, content-addressed.
Real product. Real corpus.
Short clips of the product running against a synthetic test corpus: people search and analyst queries. Click any one to play.
Made for work you have to account for later.
Access is bounded by scope and enforced by role. The audit trail is append-only, so no one can quietly rewrite it. Identity comes from your own directory or single sign-on (SAML 2.0, LDAP, Active Directory, Open Directory, or FreeIPA), and every query, view, and write records who did it, when, and under what permission.
- Scope-level RBAC: access bounded to projects, campaigns, incidents, or any scope you define.
- Tamper-evident audit: every entry cryptographically chained to the one before it; alteration or deletion is detectable, not just logged.
- Directory identity: SAML 2.0 single sign-on, LDAP, Active Directory, Open Directory, or FreeIPA, with local break-glass.
- Purpose-based access: a declared reason for a request narrows what's returned, beyond role and grants alone.
- Fail-closed: deny by default across REST, search, MCP, and SQL.
- Provenance & C2PA: every value tagged by origin; Content Credentials validated at ingest.
The same core, shaped for the work.
Scopes, RBAC, audit, render, ML, and the MCP/SQL surfaces are shared primitives. Products differ in curation and UI; the engine underneath is the same.
haystak Assets Beta
Asset management on the engine: schemaless tagging, content-first search, near-duplicate detection, renditions, and rich-media preview. Provenance-aware, your assets where they live. In early access today.
Build your own
Everything is reachable over REST, MCP, and SQL, with key building blocks open-sourced. Backend-agnostic, horizontally scalable, namespace-isolated: build a vertical on the same corpus and primitives.
Put AI on your records, on your own hardware.
A focused walkthrough: on-prem, read-only, indexed in place, permission-trimmed end to end.