Tenderlens

Public tender packs are long, structured documents full of reference codes, deadlines and conditions. Bid teams need precise answers with the exact source, and they need the system to stay correct when a notice is amended. Generic chatbots split documents arbitrarily, miss exact codes that vector search alone cannot match, and answer confidently even when the information is not there.

Tenderlens was built to show a client, step by step, how a dependable RAG system handles this: from extraction and chunking through storage and hybrid retrieval to grounded answers and version updates, all on a standard PostgreSQL database.

Documents are uploaded through a Next.js interface and processed by an ARQ worker on Redis. PyMuPDF extracts text, with Tesseract OCR at 300 dpi for scanned pages in English and Italian. Headings are detected from relative font size and boldness to build a section tree, and the language of each document is detected so full-text search uses the right configuration. The chunker emits one chunk per section up to 800 tokens, merging very short sections and splitting long ones only at paragraph or sentence boundaries, and embeds each chunk together with its section path.

Every chunk is one row in PostgreSQL 16: text, tender, document type, date, version, organisation, the pgvector embedding and a tsvector, indexed with HNSW for cosine similarity, GIN for full text, trigram for reference codes and B-tree for filters. A single SQL query runs vector search, keyword search and an exact-code match, then fuses them with Reciprocal Rank Fusion (k = 60). Answers come from OpenAI, Claude or Ollama behind one provider interface, returned as JSON with citations and a confidence level; a validator rejects any citation that does not point to a retrieved passage.

Each chunk carries a content hash, so a new document version reuses embeddings for unchanged chunks and only re-embeds what changed, while old chunks are kept as history. Access keys map to organisations; every request sets a restricted Postgres role and organisation ID for the transaction so Row-Level Security hides other organisations' rows, and each organisation's model API keys are encrypted with pgcrypto. The API runs on Ubuntu on Oracle Cloud with Docker Compose, and the frontend on Vercel.