Tenant isolation down to the document fragment

Notary Copilot answers citizens' questions from official legal documents: powers of attorney, property sale contracts, property registration, notarial declarations and certifications, the notary licence and general notarial procedures. Every answer shows its sources, and the assistant says clearly that it gives orientation, not legal advice.

There are two kinds of knowledge. A shared national legal corpus, and each office's own documents, forms and fees. Documents are ingested from PDF and web pages, split into fragments and indexed for retrieval in ChromaDB. Isolation is enforced at the level of every fragment the AI can retrieve: a question asked in one office can only match the shared corpus and that office's own fragments. The check happens when fragments are retrieved, before anything reaches the language model, so one notary's documents can never appear in another notary's answers.

Access is closed by design. There is no public registration. Accounts are created by an administrator, and each tablet is linked to its office with its own device token. Each office configures its assistant's name, voice and greeting, and sees the history of questions asked.

Voice runs as real-time speech-to-speech over WebRTC, with live captions on screen. The assistant answers in under a second and can be interrupted naturally. If voice is not possible, because the room is noisy or the microphone is refused, there is a typed-question fallback. As in every product we build, API keys for AI services stay on the server. The browser only gets short-lived, limited tokens.