3 posts on GDPR.
The end-to-end architecture of a privacy-preserving RAG at SAP Labs: preprocessing, HNSW retrieval, metadata pre-filter, PII redaction, generation, audit trail.
Scrubbing PII at index time destroys recall on any query naming a public entity. Move it downstream. How DeBERTa, HNSW, and a cross-encoder fit under 2s p95.
The multilingual model was the obvious pick and it lost by six F1 points on Bundesdatenschutzgesetz entities. Tokenizer coverage beat parameter breadth on German.
