Where do you stand? › Route 3 · Vendors & stack
I know which systems I need — who supplies them?
Pick the components you have to put in place. For each one you get the build-vs-buy reading and the market layer that supplies it, with the same scored recommendations and confidence the full analysis uses. Nothing is stored; the selection lives in the URL.
Target market(s)European UnionUnited States (federal)change
Legally-driven components are flagged when their requiring regulation sits outside your selected markets.
density
Step 1 of 2 — pick your components1 selected
Document Intelligence Engine
Step 2 of 2 — the vendor & stack view
1 of 1 selected components are covered by 2 market layers.
Named vendors are community-maintained, disputable examples — not an endorsement. The stable object is the market layer. Compare with the reference stack for your regulatory profile →
Build or buy, per component (1)
Document Intelligence Engine buy (products exist)
A Grounding, Retrieval & Agent Memory / Agentic Applications & Copilots product can carry this; the buyer's duties stay with you.
Agentic Applications & Copilots — covers 1 of your components
Covers: Document Intelligence Engine. This layer supplies 4 components in the graph.
Confidence: moderate (67/100)
Community-maintained examples
GitHub Copilot · Microsoft 365 Copilot · Perplexity Enterprise · Cursor · Dropzone AI · Devin (Cognition) · Vanta · Fin (Intercom) · SAP
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| GitHub Copilot | developer copilot | Code completion and agent modes inside the IDE and repository workflow. Typical: software engineering, code review. | not checked | SOC 2 (claimed)enterprise data-handling commitments (claimed) |
| Microsoft 365 Copilot | productivity copilot | Assistant across mail, documents and meetings inheriting existing tenant permissions. Typical: knowledge work, meeting summaries. | not checked | ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning |
| Perplexity Enterprise | research assistant | Cited web and internal search with source attribution per answer. Typical: market research, citation-backed search. | not checked | SOC 2 (claimed)enterprise data-handling commitments (claimed) |
| Cursor | developer copilot | AI-native editor with repository-wide agent edits. Typical: software engineering, refactoring. | not checked | SOC 2 (claimed)privacy-mode option (claimed) |
| Dropzone AI | security operations agent | Autonomous triage of security alerts with written investigation records. Typical: SOC triage, incident write-ups. | not checked | SOC 2 (claimed) |
| Devin (Cognition) | autonomous software agent | Long-running software agent taking tickets to pull requests. Typical: software engineering, backlog automation. | not checked | vendor-stated security posture |
| Vanta | compliance automation | Continuous control monitoring and evidence collection across frameworks. Typical: evidence automation, audit readiness. | not checked | SOC 2 (claimed)ISO 27001/42001 evidence workflows (claimed) |
| Fin (Intercom) | customer-service agent | Resolution-priced support agent answering from your help content. Typical: customer support, deflection. | not checked | SOC 2 (claimed)GDPR-positioned |
| SAP | embedded enterprise AI | AI features and agents embedded in ERP, HR and procurement suites, governed through the vendor's own AI platform layer. Typical: embedded HR AI, procurement automation, finance automation. | SaaS (vendor cloud) | ISO/IEC 42001 certification claim (claimed)EU AI Act readiness positioning |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Select on
Permission model and identity scoping; audit log export; tenant data-handling and retention terms; deployer-duty support (disclosure, oversight, incident reporting); outcome pricing vs seat pricing.
Why this confidence
- 1 in-scope component of this use case is supplied by this layer (Document Intelligence Engine) — a direct supplied_by path in the graph.
- The catalog use-case match is strong, so the component set this layer was derived from is reliable.
- High-risk tier: this layer carries mandatory Chapter III duties, so some tooling in it is non-optional.
- 9 community-maintained example vendors recorded on the layer node.
- Selection metrics for this layer are documented, so the shortlist can be compared objectively.
- Only 1 of 4 components this layer supplies are in your scope — evaluate a narrow subset of its capabilities.
Alternatives
- Grounding, Retrieval & Agent Memory — confidence moderate (66/100, -1 vs. this layer); overlapping coverage, no additional selected component
Grounding, Retrieval & Agent Memory — covers 1 of your components
Covers: Document Intelligence Engine. This layer supplies 8 components in the graph.
Confidence: moderate (66/100)
Community-maintained examples
Docling · LlamaParse · Amazon Textract · Diffbot · Firecrawl · Voyage AI · Nomic · Pinecone · Weaviate · Qdrant · Milvus · pgvector · Letta (MemGPT) · Mem0 · Zep · Cognee
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Docling | document parser | Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines. | self-hostable | EU sovereignty positioning |
| LlamaParse | document parser | Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction. | not checked | SOC 2 (claimed) |
| Amazon Textract | document parser | OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing. | not checked | SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed) |
| Diffbot | web/knowledge extraction | Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution. | not checked | vendor-stated security posture |
| Firecrawl | web/knowledge extraction | Crawling and clean markdown extraction for grounding on public sources. Typical: regulatory monitoring, public-source grounding. | not checked | vendor-stated security posture |
| Voyage AI | embeddings | Domain-tuned embedding models including legal and finance variants. Typical: retrieval quality, domain RAG. | not checked | vendor-stated security posture |
| Nomic | embeddings | Open embedding models with local inference and dataset visualisation. Typical: on-prem retrieval, dataset inspection. | self-hostable | |
| Pinecone | vector database | Managed serverless vector search with namespace isolation. Typical: tenant-isolated RAG, semantic search. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed) |
| Weaviate | vector database | Vector database available managed or self-hosted with hybrid search. Typical: hybrid retrieval, self-hosted RAG. | open source | SOC 2 (claimed) |
| Qdrant | vector database | Open-source vector store with payload filtering and on-prem deployment. Typical: air-gapped RAG, filtered retrieval. | open source | GDPR-positioned |
| Milvus | vector database | Open-source vector database for very large collections. Typical: large-scale retrieval. | open source | |
| pgvector | vector database | Postgres extension keeping vectors under the same RBAC, backup and retention regime as records. Typical: record-bound retrieval, small-scale RAG. | self-hostable | record-retention alignment (claimed) |
| Letta (MemGPT) | agent memory store | Persistent agent memory with explicit memory blocks and editing. Typical: long-running agents, personalisation. | self-hostable | |
| Mem0 | agent memory store | Memory layer extracting durable facts from agent conversations. Typical: personalised agents, support copilots. | not checked | vendor-stated security posture |
| Zep | agent memory store | Temporal knowledge-graph memory with fact validity intervals. Typical: auditable memory, long-running agents. | not checked | GDPR-positionedbitemporal record positioning |
| Cognee | agent memory store | Open-source memory/knowledge pipeline building graphs from agent interactions. Typical: knowledge accumulation, research agents. | self-hostable |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Select on
Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.
Why this confidence
- 1 in-scope component of this use case is supplied by this layer (Document Intelligence Engine) — a direct supplied_by path in the graph.
- The catalog use-case match is strong, so the component set this layer was derived from is reliable.
- High-risk tier: this layer carries mandatory Chapter III duties, so some tooling in it is non-optional.
- 16 community-maintained example vendors recorded on the layer node.
- Selection metrics for this layer are documented, so the shortlist can be compared objectively.
- Only 1 of 8 components this layer supplies are in your scope — evaluate a narrow subset of its capabilities.
Alternatives
- Agentic Applications & Copilots — confidence moderate (67/100, +1 vs. this layer); overlapping coverage, no additional selected component