C0.1About these reviews
Provenance. The X-Ray reviews were supplied by Trilivy.AI. They were produced in July 2026 by AI-assisted analysis of the platform's source code and documentation. They are a vendor-provided self-assessment, not an independent audit. We treat them as a map of what to check, and section C0.4 lists the checks.
Each review grades its subsystem against enterprise production software, not against a demo or proof of concept. The grade scale used:
| Grade | Meaning |
|---|---|
| A+ | Nothing material left to build; would ship as a commercial product |
| A | Production-grade; remaining work is configuration and tuning |
| A- | Production-capable with the owners in place, or one or two gaps to close |
| B | Works; needs engineering before production load |
| C | Prototype / demonstration |
C0.2Scorecard
| Page | What it covers | Grade |
|---|---|---|
| C1 · Ecosystem | The whole platform: six subsystems, integration, security, documentation, operations | A- · 8.8 |
| C2 · RAG engine | Ingestion (40 formats, web, email, SQL, code) and two-stage retrieval with citations | A · 9.4 |
| C3 · Chatbot (BOTY) | Full-screen app and website widget; streaming, history, guardrails, personas | A- · 8.8 |
| C4 · Agents, MCP & API | Tool-using agent, MCP connectors to vendor platforms, REST API | A- · 8.7 |
| C5 · Add-ons | Content Studio, Course Maker, mobile apps, Talk to a Person; learning companions | Bonus · not graded |
| C6 · Open source | Source ownership, reverse engineering, technology transfer, building with coding agents | Not graded |
Subsystem grades from the ecosystem review
| Subsystem | Score | Headline strength |
|---|---|---|
| RAG retrieval & ingestion engine | 9.4 (A) | Grounded, typed retrieval; fail-explicit; LLM-agnostic |
| Bot / Chatbot | 8.8 (A-) | Orchestrator, streaming, history and summarization |
| Content Studio (document factory) | 8.7 (A-) | Author-Revise-Format pipeline grounded on the corpus |
| Agents, API & MCP | 8.7 (A-) | Tool registry, REST endpoints, MCP connectors |
| Platform & multi-tenant provisioning | 8.6 (A-) | One isolated instance per company; portable export |
| LMS learning & authoring | 8.5 (A-) | Generates courses and assessments; feeds the corpus |
C0.3What the reviews conclude
Strengths
- One governed knowledge corpus feeds everything. Chatbot, documents, training and API answer from the same source, so they do not disagree.
- Grounded answers with citations. Every answer shows the passage it came from, which makes errors traceable and fixable at the source.
- Governance in the data. Department, category and confidentiality are indexed columns on every chunk. Access scope is resolved server-side from the caller's token.
- Fail-explicit engineering. No silent fallbacks: missing data raises a visible error instead of a guess.
- Model-independent. The LLM sits behind one component and can be swapped by configuration, including to a self-hosted model.
- Standard, open stack. PostgreSQL + pgvector, MySQL, Python/FastAPI, web UI/UX scripts, Flutter. No proprietary data format and no license server.
- Full source-code transfer and 111 technical documents (~318,000 words).
Conditions the vendor itself sets
- Not recommended for enterprise-wide production without a thorough evaluation by our own technical team.
- Requires an AI Data Expert on our side (mandatory), and either an external certified system integrator or our own IT team able to stand up, customize and maintain the platform.
- Mission-critical use requires extensive testing, monitoring and disaster-recovery validation.
- Compliance-heavy industries require industry-specific validation (HIPAA, SOC 2, GDPR and similar).
- High-scale production requires load testing against our expected volumes and concurrency.
Our reading: [tech_reading]
C0.4Verification checklist
Each claim below comes with a test from the reviews. We run them on the dedicated server Trilivy provisions; most take minutes. Results so far: – confirmed.
| # | Test | Result |
|---|---|---|
| Grounding and answer quality | ||
| 1 | Ingest a folder of our documents, ask a question we know the answer to, and confirm the citation points to the right document. | [v1] |
| 2 | Ask the same internal question of a general assistant and of Trilivy. One should cite our document. | [v2] |
| 3 | Turn the knowledge attachment off and on in the chatbot and compare answers. | [v3] |
| 4 | Open the prompt inspector and debug payload; confirm which passages were retrieved and how they were ranked. | [v4] |
| 5 | Ask a curated Q&A question and confirm the verbatim, deterministic answer. | [v5] |
| Security and governance | ||
| 6 | Confirm department / category / confidentiality filters run as SQL predicates in the vector search. | [v6] |
| 7 | Call the API with a token that has no knowledge scope; confirm it is refused, not treated as empty. | [v7] |
| 8 | Ingest an Outlook archive sample; confirm email addresses, keys, tokens and passwords are redacted. | [v8] |
| 9 | Confirm secrets are loaded from the database config table, not code or environment files. | [v9] |
| 10 | Confirm one instance cannot reach another instance's tables. | [v10] |
| Architecture and lock-in | ||
| 11 | Confirm the LLM boundary is a single component and switch provider by configuration. | [v11] |
| 12 | Read any delivered source file; confirm nothing is compiled or obfuscated. | [v12] |
| 13 | Produce an instance export bundle (code + instance + MySQL dump + RAG export). | [v13] |
| 14 | Stop the MCP server and confirm the rest of the platform keeps serving. | [v14] |
| Operations and scale | ||
| 15 | Check both health endpoints (gateway, and MCP protocol handshake). | [v15] |
| 16 | Raise ingestion worker count by configuration and re-measure throughput. | [v16] |
| 17 | Load test at our expected concurrency: [load_users]. | [v17] |
| 18 | Run a backup and restore of one knowledge table. | [v18] |
C0.5Our requirements, to resolve before production
| Requirement | Our position · status |
|---|---|
| Hosting and data residency | [req_hosting] |
| Approved AI model providers, and where prompts are processed | [req_models] |
| Identity and single sign-on | [req_sso] |
| Regulatory framework ([regulation]) | [req_regulation] |
| Logging, audit retention | [req_audit] |
| Backup, recovery objectives (RPO / RTO) | [req_rpo] |
| Integrations needed after the pilot | [req_integrations] |
Technical recommendation: [tech_reco]