RAG deployment data flows: six processing layers, transfers and operating ownership
Record recipients, processing locations, retention and access from source documents to query logs. Components are coupled; sensitivity, on-premises hosting, VPCs, de-identification and certification labels do not independently establish processing permission.
By
Tenten AI Research Team
AI Infrastructure
Published
Updated
Read time
4 min
Map RAG data flows before choosing component locations. Documents, chunks, vectors, queries, retrieved passages, outputs and logs may reach different services. One local layer does not establish local processing everywhere.
This guide reviews components and permissions. Use the hosting/full-cost comparison for operating proposals.
Connect the six layers
Embedding services may receive chunks; generation services may receive queries and retrieved text; logs may retain inputs or outputs. Placement decisions are coupled, not independent switches.
| Layer | Possible content | Transfers and responsibilities to inspect |
|---|---|---|
| Source documents | Files, attachments, sources and versions | Acquisition, export, backup, support access and permitted use |
| Chunking/preprocessing | Extracted text, images, labels and intermediate files | Processing recipients, temporary storage and deletion |
| Vectors/index | Embeddings, identifiers, sources and access metadata | Storage, search, backup and permission changes |
| Embedding model | Document or query text | Processor, location, retention and purpose |
| Generation model | Queries, passages, prompts and outputs | Permitted transfers, terms, responses and failure behavior |
| Logs/observability | Operations, errors, inputs/outputs or other records | Necessary content, sensitive-data controls, access, retention and export |
Record source, destination, actual processor, location, content, purpose and retention for each transfer. Include administration, support, backup and monitoring, not only the main database.
Establish actual external-processing permission
Identify applicable conditions, contracts and responsible roles for the data and purpose. Sensitivity requires assessment, not an automatic local-model mandate. Public collections can still receive restricted queries, mixed attachments or logs.
The FSC outsourcing regulation, amended April 13, 2026, sets conditions and oversight for covered institutions' offshore/cloud outsourcing. Check institution, work, data and provisions rather than extending it to every financial/medical dataset or inferring permission for this transfer.
Under Taiwan's PDPA, establish purpose, personal/medical-data conditions, recipients and safeguards. De-identified snippets, network isolation and certification labels do not replace that assessment.
NIST's cloud definition separates service controls and deployment models. Private cloud can be third-party operated off-site. A VPC does not prove no third-party processing; local equipment can call external APIs.
Assess information exposure in vectors
The original EMNLP 2023 research demonstrates reconstruction and personal-information risks for scoped models and data. It supports protecting embeddings and investigating exposure, not a universal inversion rate or a result for a client or current system.
Removing names, storing vectors or encrypting data does not alone establish anonymity. Assess content, access, recipients and reconstruction risks without treating absolute non-invertibility as a universal legal test supplied by these sources.
Turn four areas into tests and operations
| Area | Agree before building | Inspectable operating evidence |
|---|---|---|
| Data/processing permission | Allowed content, recipients, purposes and retention | Actual flows and handling of forbidden transfers |
| User/service authority | Visible sources, actions, changes and revocation | Denied access, role changes and source withdrawal |
| Performance/failure | Task needs, main path and acceptable limits | Retrieval, models, networks, queues and failures |
| Operations/recovery | Updates, incidents, backups, takeover and stopping owners | Exercises, versions, issues and corrections |
For a hypothetical approved-manual query, suppose some passages must not reach an external service. Inspect actual retrieval, prompts and logs beyond successful answers. Test revoked access, removed sources, service failures and wrong routing. This is a design to validate, not an existing automatic security feature.
Retain necessary log content with controlled sensitive inputs/outputs. Traceability does not mean unlimited storage. Establish access, deletion and legitimate incident-investigation needs.
Decide components and operating ownership
Bring approved flows, controls, dependencies and unresolved questions to the existing RAG knowledge-system scope. Assign acceptance evidence and owners, revisiting affected work after version or provider-term changes. Audit, daily use, answer quality and operating acceptance are separate assessments; hosting labels do not complete them.
Summarize this page with AI
Related posts
Start with one workflow.
Agree on the next step.
Leave your contact details and question type. We will follow up by email to understand the work and discuss scope.