DocsGPT is an internal knowledge assistant for government teams that runs on government infrastructure with local inference, answers from approved documents with citations, and restricts what each user can retrieve. No data leaves the network. The UK Department for Work and Pensions deployed an internal knowledge assistant of this kind on government infrastructure, with local inference.
Last updated:
Five stages: approved policy, guidance and legislation are ingested and embedded locally; retrieval is limited to sources the user's team may see; a locally served model writes an answer with title and page citations; staff feedback and every exchange land in the audit log the department exports to its own monitoring.
Compliance
Compliance rules are strict and differ by department: many require no external API calls and fully on-premises processing; all require every processing location to be declared before the service goes live.
Classification
Documents sit at several classification levels, so access has to be enforced when a document is retrieved for an answer, not only in the interface that shows it.
Scale
A departmental assistant must be available to a large workforce, at scale and around the clock, on infrastructure the department already operates.
Workflow 01
Ingestion of 30+ formats and a SharePoint connector bring policy, guidance and legislation into one knowledge base. Hybrid retrieval (BM25 + vector) finds the passage; the answer cites title and page so a caseworker can open the source.
30+ formats · SharePoint connector · hybrid retrieval · citations (title, page)
Workflow 02
Teams and workspaces scope which sources an agent may search; users sign in through the department's IdP with OIDC and group allowlists; SCIM deprovisioning revokes sessions immediately; roles limit what each person can administer. An assistant retrieves only from sources shared to its user's team.
Teams & workspaces · OIDC SSO with group allowlists · SCIM · RBAC
Built for the client · query-level access enforcement across several classification levels, for the DWP.
Workflow 03
Models are served inside the department with vLLM, Ollama or llama.cpp; embeddings are computed locally; the vector store is self-hosted. Kubernetes manifests deploy the stack, and OpenTelemetry exports traces and metrics to the department's monitoring.
vLLM · Ollama · llama.cpp · local embeddings · Kubernetes manifests · OpenTelemetry
Workflow 04
Guardrails check for PII, banned terms and prompt injection on the way in and out. The audit table exports to the department's SIEM; conversation logs and analytics show who asked what, which sources were used and what it cost.
Guardrails (PII, banned terms, prompt injection) · audit export to SIEM · conversation logs · analytics
Guardrails & Human-in-the-loop →Admin, Security & Analytics →
Procurement posture: how DocsGPT and Arc53 answer the requirements that recur in UK public-sector tenders.
| Position | How it is met | |
|---|---|---|
| WCAG 2.2 AA | Audit and remediation committed within a first project | Independent WCAG 2.2 AA audit and full A/AA remediation scoped into the project; the report is delivered to the department |
| DPIA support and data-flow documentation | Provided | Arc53 supplies the data-flow description and supports the department's DPIA before deployment |
| No training of foundation models on client data | Native | Self-hosted models see no third party; where a cloud endpoint is chosen, the provider is contracted not to train on the data |
| UK hosting or on-premises | Both | On the department's own infrastructure, or a UK single-tenant managed instance in a declared region |
| Exit plan | Provided | Open-format export of documents, agents (YAML) and logs; documented decommissioning; MIT-licensed code the department may keep running |
| Certifications | Posture plus programme | No certification held today. Security programme: GitHub Secure Open Source Fund, public threat model, SBOM, CodeQL, coordinated disclosure — see Security |
Statuses as of 2026-09-11.
Results from named deployments, with the source.
Government infrastructure, local inference
UK Department for Work and Pensions: an internal knowledge assistant on government infrastructure, with local inference.
Source: DWP
On-premises is the usual posture here: strict data residency.
Departments run DocsGPT on their own Kubernetes or servers with a local model — the posture the DWP deployment uses. Where a department accepts it, a UK single-tenant managed instance is the second option, with Arc53 operating the instance in a declared region. Cloud endpoints, where chosen, are contracted no-training, and every sub-processor and its region is published in the DPA.
Documentation
Scope, measure, then decide.
Scope one team and one corpus
Policy or guidance for a single team; the document owners write 20–30 test questions with the expected answers and sources.
DPIA support and data-flow documentation
Arc53 provides the data-flow description and supports the department's DPIA before anything is deployed.
Deploy on the department's infrastructure
Or a UK single-tenant managed instance; SSO through the department IdP; a locally served model.
Ingest and benchmark
Run the test set against the assistant and iterate until source assertions pass.
docsgpt-cli bench
Pilot for about three months
Measure citation click-through and answer acceptance with the team.
Decision on rollout
With the pilot's evidence, the department decides scope and posture for wider use.
The DWP deployment began with a scoped first project of this shape on government infrastructure with local inference. See pricing for how on-premises and managed work is priced.
A 30-minute demo on your use case, or a free on-premises review with an engineer.