Multi-Tenant Private Document AI

ZettaBrain Teams is a self-hosted, multi-tenant RAG server. Each team in your organisation gets its own isolated document library, users authenticate via Active Directory, and every answer is cryptographically signed — all running on your own infrastructure with no cloud, no API keys, and no data egress.

What It Does

ZettaBrain Teams ingests documents per team and lets each team query their own documents through a shared web interface. The admin panel manages users, teams, licensing, and AD integration. Every answer is signed with an Ed25519 key and logged to a tamper-evident audit trail that can be verified at any time.

Key Features

Quick Links

• Quick Install
• Teams & Users
• Model Governance
• Hybrid Model Support
• Active Directory setup
• ZettaBrain Verified
• Licensing & Plans
• CLI commands
• PyPI — zettabrain-teams

Quick Install

One-line installer for ZettaBrain Teams. Downloads and configures everything automatically — Python, pipx, zettabrain-teams, Ollama, and embedding models.

Ubuntu Red Hat Linux macOS Windows

curl -fsSL https://zettabrain.app/install-teams.sh | sudo bash

zettabrain-teams             # starts at http://0.0.0.0:7861

curl -fsSL https://zettabrain.app/install-teams.sh | sudo bash

zettabrain-teams

curl -fsSL https://zettabrain.app/install-teams.sh | bash

zettabrain-teams

pipx install zettabrain-teams
zettabrain-teams             # starts at http://0.0.0.0:7861

What the installer does

• Detects your OS and installs system dependencies (Python 3.9+, pipx)
• Installs zettabrain-teams via pipx with automatic PATH configuration
• Installs and starts Ollama as a background service
• Downloads the nomic-embed-text embedding model (~275 MB)
• Runs the setup wizard for storage paths and LLM model selection
• Creates /opt/zettabrain-teams/ with config and data directories
• All commands available immediately — no manual PATH setup needed

After install

zettabrain-teams              # start server at :7861
# Open http://your-server:7861 — log in with admin / admin

First-Time Setup

After installing the package, run the setup wizard as root to configure Ollama and models, then complete admin setup in the web interface.

1. Run the Setup Wizard

sudo zettabrain-teams-setup
# Options:
sudo zettabrain-teams-setup --port 7861 --llm llama3.1:8b --embed nomic-embed-text
sudo zettabrain-teams-setup --no-systemd   # skip service registration

2. Start the Server

zettabrain-teams              # starts at :7861
zettabrain-teams --port 8080  # custom port
zettabrain-teams --reload     # dev mode

Open http://your-server:7861 in a browser.

3. First Login & Admin Setup

1. Log in with admin / P@ssword! — you will be prompted to change the password on first login
2. Go to Admin → Teams to create your first team and assign a document folder
3. Add users to the team, or configure Active Directory under Admin → Settings → LDAP
4. Trigger a document ingest from the team page to build the vector store

Teams & Users

Every document query is scoped to the querying user's team. Teams have their own document folders, vector stores, and BM25 indexes — completely isolated from other teams.

Creating a Team

1. Go to Admin → Teams → Create Team
2. Enter a team name (used as the slug for storage paths)
3. Set the document folder path on the server (e.g. /data/finance)
4. Add members — local users or imported AD accounts
5. Click Ingest Documents to index the folder

User Roles

Document Isolation

Each team's documents are stored in a separate ChromaDB collection at /opt/zettabrain-teams/chromadb/{team-slug}/. The BM25 index is also per-team — IDF statistics are computed within each team's corpus only, with no cross-team statistical leakage.

Model Governance

Most organizations get two bad options: force one model on everyone, or let it be a free-for-all where nobody tracks the keys, cost, or compliance exposure. ZettaBrain Teams adds an actual workflow.

How It Works

A team manager requests the model stack their team needs, with a written justification. An admin approves it, or rejects with a reason. Both sides get notified in real time.

Request Workflow

1. Manager submits a request — From the team dashboard, a manager selects the desired generation model (e.g., claude-sonnet-4.6, gpt-4, or llama3.1:8b) and embedding model (nomic-embed-text, text-embedding-3-large, etc.)
2. Justification required — A text field captures why: workload requirements, performance constraints, compliance needs
3. Admin review — Request appears in Admin → Model Requests with full context: team, current config, requested config, justification
4. Approve or reject — Admin can approve (model stack becomes available to the team), or reject with a message explaining why
5. Real-time notification — Manager sees status update immediately on the team dashboard

Approved Model Stack

Once approved, the manager can assign it to their team and switch between any previously approved configuration whenever the workload changes.

Central Control, Delegated Autonomy

Central control where it has to live: keys, cost, compliance. Delegated autonomy where it helps, because managers know their workload better than IT does.

Configuration

Go to Admin → Settings → Models to configure available models and API keys. Only admins can add or remove model options from the pool.

Hybrid Model Support

Local models keep your data private. Frontier models give the sharpest answers. Most RAG tools make you pick one. ZettaBrain Teams doesn't.

Mix Local and Cloud

Every team runs its own hybrid stack: mix Ollama running locally, OpenAI, and Claude however the workload demands.

Independent Model Selection

Your generation model and your embedding model are configured separately. Keep embeddings fully local — meaning your documents never leave the box — while routing generation to Claude or GPT for answer quality. Or run one team entirely offline while another uses a frontier model.

Privacy Modes

Example Configurations

• Finance Team — Fully local (llama3.1:8b + nomic-embed-text) for compliance and air-gapped operation
• Research Team — Hybrid privacy-first (claude-sonnet-4.6 + nomic-embed-text) for best answers while keeping source documents local
• Product Team — Fully cloud (gpt-4 + text-embedding-3-large) for maximum speed and answer quality

Installation

pipx install zettabrain-teams

Configure hybrid models via Admin → Settings → Models. Add your OpenAI and Anthropic API keys, then teams can request access through the Model Governance workflow.

Active Directory / LDAP

ZettaBrain Teams supports Microsoft Active Directory via LDAP. Users authenticate with their AD credentials, and AD accounts can be imported directly into teams.

Configuration

Go to Admin → Settings → Active Directory and fill in:

Quick Fill

Use the Quick Fill from Domain helper — enter your domain (e.g. acme.com) and it pre-fills the LDAP URL, Base DN, and AD-specific defaults automatically.

Test the Connection

Click Test AD Connection before saving. The test probes your settings and tries fallback filters automatically if users aren't found, then suggests the working filter and base DN.

How Authentication Works

1. User submits username + password on the login page
2. Local admin account is checked first (protects access if AD is down)
3. Service account binds to AD and searches for the user by sAMAccountName
4. Optional: group membership is verified
5. User re-binds with their own credentials to verify the password
6. Account is auto-provisioned locally on first successful AD login

Importing AD Users into Teams

When AD is enabled, each team card shows an Import from Active Directory section. Search for an AD user by name or username and import them directly into the team with one click.

Audit Log

Every chat query is logged with the user, team, query text, response preview, confidence score, duration, and chunks used — plus a cryptographic Ed25519 provenance signature so the answer bundle can be independently verified at any time.

Accessing the Log

Go to Admin → Audit Log. Use the date range presets (1 day, 3 days, 1 week, 1 month) or pick a custom range with the date pickers.

CSV Export

Click Export CSV to download the currently filtered log — ready for Excel, Splunk, or your SIEM.

Provenance Verification

Each log row includes a Verify button. Clicking it calls GET /api/admin/audit/{id}/verify and opens a detail panel showing:

• SHA-256 hash of the original query
• SHA-256 hashes of every context chunk used
• SHA-256 hash of the answer
• Ed25519 signature hex and server public key
• Canonical JSON payload that was signed
• Download Verification Report — exports a self-contained JSON file for offline or third-party verification

The server's Ed25519 public key is available at GET /api/admin/keys/public for out-of-band verification without accessing the admin panel.

Log Fields

ZettaBrain Verified

Every answer produced by ZettaBrain Teams is cryptographically signed with an Ed25519 key held by the server. This makes the entire answer bundle — query, context chunks, and response — tamper-evident and independently verifiable.

How It Works

1. When the LLM returns an answer, ZettaBrain computes a SHA-256 hash of the query, of each context chunk, and of the answer text
2. These hashes are assembled into a canonical JSON payload and signed with the server's Ed25519 private key
3. The signature and all hashes are stored alongside the audit log entry in the database
4. Any admin can click Verify on any log row to re-derive the canonical payload and confirm the signature still matches — proving the stored answer has not been altered

What Is Signed

Out-of-Band Verification

The server's Ed25519 public key never changes and is exposed at:

GET /api/admin/keys/public
# Returns: { "public_key_hex": "45262b...", "algorithm": "Ed25519" }

A compliance team or external auditor can retrieve this key once, then verify any downloaded report independently using standard Ed25519 libraries — no access to the ZettaBrain server required.

Out-of-Scope Detection

When a query falls outside a team's document library, ZettaBrain returns a fixed message ("This question is outside the scope of this team's document library.") with a confidence of 0.0 and an empty sources list. The provenance signature is still computed and stored over this clean response, so the absence of an answer is itself auditable.

Licensing & Plans

ZettaBrain Teams ships with a built-in 90-day free trial. After the trial, a license file activates the server without any internet connection — suitable for air-gapped environments.

Trial Period

• 90 days of full functionality from the first server start — no credit card, no feature limits
• A warning banner appears in the admin dashboard when fewer than 14 days remain
• The server exits cleanly on expiry with a message pointing to sales@zettabrain.io

License Plans

Contact sales@zettabrain.io to purchase. You receive a .lic file by email.

Activating a License

Option A — Admin UI

1. Go to Admin → License
2. Paste the license key string or click Upload .lic file
3. Click Activate License — the status panel updates immediately

Option B — File on disk (air-gapped)

cp your_license.lic /opt/zettabrain-teams/data/license.lic
# Restart the server to pick it up
systemctl restart zettabrain-teams

Seat Enforcement

User and team creation are blocked at the plan limit with a clear error message. To add more seats, upload an upgraded license — no restart required.

CLI Commands

Document ingestion

Triggered from the admin web panel (Admin → Teams → Ingest), or via the REST API:

curl -X POST http://localhost:7861/api/teams/{team_id}/ingest \
  -H "Authorization: Bearer <token>"

Configuration

Settings via environment variables or /opt/zettabrain-teams/teams.env. Most settings are also configurable through Admin → Settings in the web interface.

System Requirements

Multi-team note: Allocate an additional ~1–2 GB RAM per active team's vector store on top of the base Ollama model footprint.

Diagnostics

systemctl status zettabrain-teams
journalctl -u zettabrain-teams -f
curl http://localhost:7861/api/health
curl http://localhost:11434
ollama list

Uninstall

Linux / macOS

sudo systemctl disable --now zettabrain-teams 2>/dev/null || true
pipx uninstall zettabrain-teams
sudo rm -rf /opt/zettabrain-teams

Windows

pip uninstall zettabrain-teams