RAG SOP Assistant: AI-Powered Q&A System for Corporate Standard Operating Procedure Documents

1. Introduction

Standard Operating Procedures (SOPs) form the backbone of organizational knowledge management. These documents codify critical business processes—from emergency response protocols to staff training procedures, technology usage guidelines, and equipment maintenance workflows. However, in practice, SOP documents are frequently lengthy, distributed across multiple files, and written in formal procedural language that makes rapid information retrieval challenging for employees who need quick, actionable answers.

The traditional approach to SOP consultation involves manual document search: employees must identify the correct document, navigate to the relevant section, and interpret the procedural language in context. This process is time-consuming, error-prone, and particularly problematic during high-pressure situations where quick access to emergency procedures is critical. Keyword-based search tools offer incremental improvement but fail to capture semantic meaning—a search for "what to do during a fire" will not match a section titled "Emergency Evacuation Protocol."

RAG SOP Assistant addresses these limitations by combining semantic search with large language model (LLM) generation. The system enables employees to ask questions in natural, conversational language and receive contextually accurate answers with explicit source attribution to the originating SOP document. The key contributions of this work are:

• A complete RAG pipeline for SOP documents with intelligent sentence-boundary-aware text chunking, multilingual semantic embeddings, and vector similarity search.
• An enterprise-ready implementation with thread-safe operations, XSS prevention, input validation, and automatic document indexing at startup.
• A three-tab Gradio web interface providing Q&A chat, document upload management, and database administration in a single application.
• Source attribution for every generated answer, enabling employees to verify AI responses against the original SOP documents.

2. Related Work

Retrieval-Augmented Generation (Lewis et al., 2020) introduced the paradigm of combining document retrieval with neural text generation, demonstrating significant improvements over purely parametric models on knowledge-intensive tasks. The RAG approach addresses the fundamental limitation of LLMs—that their knowledge is frozen at training time—by grounding generation in retrieved evidence from an external knowledge base.

Vector databases such as ChromaDB (Trychroma, 2023), Pinecone, and Qdrant have emerged as purpose-built storage systems for embedding-based retrieval, offering efficient approximate nearest neighbor (ANN) search over high-dimensional vector spaces. ChromaDB distinguishes itself through its lightweight, embeddable design that supports both in-memory and persistent storage modes, making it suitable for applications ranging from prototypes to production deployments.

Multilingual embedding models, particularly the E5 family (Wang et al., 2022), have demonstrated strong cross-lingual semantic similarity performance. The E5-Small variant used in this work provides 384-dimensional embeddings with support for 100+ languages, balancing retrieval quality with computational efficiency—a critical consideration for deployments on resource-constrained hardware such as Hugging Face Spaces.

Prior work on document Q&A systems has largely focused on general-purpose applications. RAG SOP Assistant specializes in the corporate SOP domain, where documents follow structured procedural formats and answers must be traceable to authoritative sources—requirements that demand careful attention to chunking strategy, source preservation, and answer grounding.

3. System Architecture

RAG SOP Assistant follows a modular pipeline architecture comprising four stages: document ingestion, text chunking and embedding, vector storage, and retrieval-augmented generation. Each stage is designed for reliability, thread safety, and enterprise deployment.

3.1 RAG Pipeline Overview

3.2 Document Ingestion

The system supports three document formats commonly used for SOPs in Indonesian corporate environments:

Upon upload, files are validated against size limits (50MB maximum) and format whitelist. The extraction process is wrapped in comprehensive error handling with sanitized error messages that never expose internal paths or API credentials.

3.3 Intelligent Text Chunking

Text chunking is a critical determinant of RAG system quality. Chunks that are too large dilute the semantic signal; chunks that are too small lose contextual coherence. RAG SOP Assistant implements a sentence-boundary-aware chunking strategy with the following parameters:

The chunking algorithm first attempts to split text at natural sentence boundaries (periods, exclamation marks, question marks, newlines). If no suitable boundary is found within the target window, it falls back to character-based splitting. This approach is particularly important for SOP documents, where procedural steps often span multiple sentences and should not be split mid-instruction.

3.4 Embedding Generation

Each text chunk is converted to a 384-dimensional vector using the intfloat/multilingual-e5-small embedding model from the sentence-transformers library. The E5-Small model was selected for three reasons:

• Multilingual support: Native handling of Indonesian-language SOP documents without translation preprocessing.
• Computational efficiency: The small variant (~134M parameters, ~470MB) runs efficiently on CPU-only environments such as Hugging Face Spaces.
• Semantic quality: Despite its compact size, E5-Small achieves competitive retrieval accuracy on multilingual benchmarks, making it suitable for the SOP Q&A domain.

3.5 Vector Storage with ChromaDB

Embeddings are stored in a ChromaDB persistent collection configured with cosine similarity as the distance metric. Each chunk is stored with associated metadata:

collection.add(
    ids=[md5_hash(f"{filename}_chunk_{index}")],
    embeddings=[embedding_vector],
    documents=[chunk_text],
    metadatas=[{"source": filename, "chunk_index": index}]
)

The use of MD5-based chunk IDs enables idempotent insertion—re-uploading the same document does not create duplicate entries. The PersistentClient stores data at ./chroma_db, ensuring that the vector index survives application restarts.

3.6 Retrieval and Generation

At query time, the user's question is embedded using the same E5-Small model and searched against the ChromaDB collection using cosine similarity. The top-5 most similar chunks are retrieved along with their source metadata. These chunks are assembled into a structured context block and passed to DeepSeek-V3 with the following LLM configuration:

The system prompt explicitly instructs the LLM to answer only based on the provided context, preventing hallucination of procedures not present in the indexed SOPs. Every generated answer includes source attribution identifying the originating document.

4. Security Model

Enterprise SOP systems handle sensitive operational procedures that require appropriate security measures. RAG SOP Assistant implements multiple security layers:

4.1 Input Validation and Sanitization

• XSS prevention: All user inputs and uploaded filenames are sanitized using html.escape() before any processing or display, preventing cross-site scripting attacks.
• Question length limit: User questions are capped at 1,000 characters, preventing resource exhaustion from excessively long inputs.
• File size limit: Uploaded documents are limited to 50MB, with server-side validation before processing begins.
• Format whitelist: Only PDF, DOCX, and TXT files are accepted; all other formats are rejected at the upload boundary.

4.2 API Key Protection

The DeepSeek API key is stored as an environment variable (Hugging Face Secrets for cloud deployment, DEEPSEEK_API_KEY for local). The key is never logged, included in error messages, or exposed through the web interface. Error sanitization ensures that API-related failures return generic error messages to the user.

4.3 Thread Safety

The application uses a global threading.Lock to protect ChromaDB collection initialization, ensuring safe concurrent access in multi-user environments. The get_collection() function implements lazy initialization with thread-safe locking, preventing race conditions during the first query after startup.

5. Implementation Details

5.1 Technology Stack

5.2 User Interface

The Gradio-based interface is organized into three functional tabs:

• Q&A Chat Tab: A conversational interface where users type natural language questions about SOPs and receive AI-generated answers with source attribution. Pre-loaded example questions demonstrate the system's capabilities.
• Upload Documents Tab: A multi-file upload area supporting drag-and-drop for PDF, DOCX, and TXT files. Displays real-time processing results including files processed, chunks created, and total database size.
• Database Management Tab: Administrative tools for viewing database statistics (total chunks, document count), listing all indexed documents, refreshing statistics, and clearing the entire database when needed.

The interface features custom CSS with the Plus Jakarta Sans font, a teal/blue gradient header, rounded corners, hover effects, and responsive layout for mobile and desktop usage.

5.3 Auto-Indexing at Startup

The system includes five default SOP documents covering company procedures, staff training, technology usage, storage and maintenance, and emergency protocols. These documents are automatically indexed when the application starts, providing immediate Q&A capability without requiring manual upload. The auto-indexing process checks for existing entries to avoid duplicate indexing on subsequent restarts.

6. Deployment Options

6.1 Hugging Face Spaces (Recommended)

The recommended deployment path provides zero-configuration cloud hosting:

1. Fork the Hugging Face Space at romizone/RAG-SOP
2. Add DEEPSEEK_API_KEY to Space Secrets
3. The Space auto-builds in 3–5 minutes, including embedding model download

Recommended hardware: CPU Basic (2 vCPU, 16GB RAM). The E5-Small embedding model (~470MB) loads at startup and requires approximately 30–60 seconds for initialization.

6.2 Local Development

git clone https://github.com/romizone/RAGSOP.git
cd RAGSOP
pip install -r requirements.txt
export DEEPSEEK_API_KEY="your-api-key-here"
python app.py

The application launches at http://localhost:7860 with full functionality including auto-indexing of default SOP documents.

7. Performance Characteristics

8. Use Cases

RAG SOP Assistant is designed for enterprise environments where rapid access to procedural knowledge is critical:

• Human Resources & People Operations: Employee onboarding, leave policies, benefits administration, disciplinary procedures, and workplace conduct guidelines.
• Operations & Facilities: Warehouse safety protocols, equipment handling procedures, quality control checklists, and maintenance schedules.
• Finance & Procurement: Purchase approval workflows, expense reimbursement policies, vendor management procedures, and budget allocation guidelines.
• Compliance & Audit: Regulatory compliance procedures, audit preparation checklists, data protection protocols, and reporting requirements.
• Emergency Response: Crisis management procedures, evacuation protocols, incident reporting workflows, and business continuity plans.
• Training & Development: Quick reference for trainees, procedure refreshers, knowledge assessment, and certification requirements.

9. Project Structure

RAGSOP/
├── app.py                              # Main Gradio application (~30 KB)
├── requirements.txt                    # Python dependencies
├── README.md                           # Comprehensive documentation
├── .gitignore                          # Git ignore rules
└── SOP/                                # Default SOP documents
    ├── Kumpulan_SOP_Perusahaan.pdf     # Company SOP Collection
    ├── Pelatihan staf_8.pdf            # Staff Training Procedures
    ├── Penggunaan teknologi_7.pdf      # Technology Usage Guidelines
    ├── Penyimpanan dan pemeliharaan_4.pdf  # Storage & Maintenance
    └── SOP darurat_5.pdf               # Emergency Procedures

10. Conclusion and Future Work

RAG SOP Assistant demonstrates that Retrieval-Augmented Generation provides an effective approach to transforming static corporate SOP documents into dynamic, conversational knowledge bases. The combination of multilingual semantic embeddings, sentence-boundary-aware chunking, and context-grounded LLM generation enables accurate, source-attributed answers that employees can verify against original documents.

The system's enterprise-ready implementation—with thread-safe operations, XSS prevention, input validation, and automatic document indexing—addresses the practical requirements of organizational deployment. The three-tab Gradio interface provides a complete workflow from document upload through database management to conversational Q&A, all accessible through a web browser without local installation.

Future directions include:

• Multi-model support with configurable LLM backends (GPT-4o, Claude, Llama) for organizations with different AI provider requirements.
• Role-based access control enabling department-specific SOP collections with restricted visibility.
• Hybrid retrieval combining dense vector search with BM25 sparse retrieval for improved recall on keyword-heavy queries.
• Answer confidence scoring using retrieval similarity thresholds to flag low-confidence answers that may require manual verification.
• Incremental indexing with automatic detection of updated SOP documents and selective re-embedding of changed sections.
• Audit logging for compliance environments that require tracking of which SOPs were consulted and by whom.

The complete source code is available at https://github.com/romizone/RAGSOP and a live demo is accessible at https://huggingface.co/spaces/romizone/RAG-SOP.

References