I3K RAG Enterprise vs Onyx: An Honest Open-Source Comparison
A side-by-side look at two open-source RAG platforms — features, deployment, licensing, sovereignty — written by people who actually use both.
If you're shopping for an open-source Retrieval-Augmented Generation platform in 2026, the two names that come up most often are Onyx and I3K RAG Enterprise. There are others — Verba, Quivr, Haystack as a library — but Onyx and I3K RAG Enterprise are the two projects that explicitly target enterprise deployments out of the box.
We build I3K RAG Enterprise. We've also run Onyx on production data, both on behalf of clients and as part of our own evaluation work. This post is an attempt to give you the comparison we wish someone had given us when we were evaluating, including the parts where Onyx genuinely wins.
If you spot something wrong, tell us and we'll fix it.
Where the projects come from
The two projects come from different starting points, and that shapes the trade-offs.
Onyx (formerly Danswer) is a US-originated open-source RAG platform that gained traction around 2023 as a "ChatGPT for your company". It has a strong focus on connectors — Slack, Confluence, Google Drive, Notion — and on getting a working assistant in front of users quickly.
I3K RAG Enterprise is built by I3K Technologies in Milan. It started as a sovereignty-first internal tool for EU-regulated customers, and was open-sourced once the architecture stabilised. The focus is on running entirely inside the customer's perimeter, on compliance tooling, and on multilingual retrieval as a first-class concern.
The two projects pick deliberately different open-source licenses. Onyx is MIT. I3K RAG Enterprise is AGPL-3.0 — a copyleft license that protects the project from being repackaged as a closed SaaS product by a third party, while leaving you completely free to self-host, modify, and use it commercially inside your own organisation. That is a real, substantive difference and we'll come back to it.
Architecture: connector-first vs sovereignty-first
The clearest architectural difference between the two is what each project treats as the centre of gravity.
Onyx is connector-first
Onyx's strongest asset is its connector library. Out of the box it can ingest from a long list of SaaS sources, handle authentication, and incremental sync. If your knowledge lives in Notion and Confluence and Slack, Onyx will be talking to it within an afternoon. The retrieval layer is a relatively conventional pipeline backed (depending on configuration) by Vespa or Postgres with pgvector.
I3K RAG Enterprise is sovereignty-first
We designed the platform around a single hard constraint: nothing leaves the customer's perimeter. The stack reflects that choice end-to-end:
- FastAPI backend, React + Vite frontend.
- Qdrant as the vector store, with RBAC filtering pushed down into the query so role boundaries are enforced at retrieval time.
- Ollama as the local LLM server, with Qwen3:14b-q4_K_M as the default model and Mistral 7B Q4 as a lighter alternative.
- BAAI/bge-m3 as the embedding model — multilingual out of the box, with strong quality across 29 languages.
- I3K in-house retrieval orchestrator (Python, no third-party agent framework) (ingest → embed → retrieve → generate).
- Apache Tika + Tesseract OCR for document parsing, including scanned PDFs.
- JWT auth + RBAC with three built-in roles.
- Multi-GPU support: NVIDIA CUDA, AMD ROCm, or CPU-only.
- Integrated backup via rclone, with 70+ storage providers supported.
- One-command setup, typically running in around an hour on standard hardware.
The ingestion side is deliberately simpler than Onyx's. We support the file system, S3-compatible object storage, and standard document formats through Tika — but we are not trying to match Onyx connector for connector. If you need a Slack connector today, Onyx will get you there faster.
For organisations that want EU-sovereign inference without running the GPUs themselves, we recommend EuLLM as a hosted option.
Feature comparison
| Capability | I3K RAG Enterprise | Onyx |
|---|---|---|
| Open-source license | AGPL-3.0 | MIT |
| Self-hostable | Yes | Yes |
| Air-gapped / 100% local deployment | Default | Possible, less documented |
| Vector store | Qdrant (RBAC filtering built in) | Vespa or Postgres + pgvector |
| LLM serving | Ollama (Qwen3:14b-q4_K_M default) | Configurable |
| Embedding model (default) | BAAI/bge-m3 — 29 languages native | English-first defaults |
| OCR / scanned documents | Apache Tika + Tesseract built in | Not built in |
| Multi-GPU support | NVIDIA CUDA / AMD ROCm / CPU | NVIDIA-focused |
| Integrated backup | rclone, 70+ providers | Not built in |
| Connector library | File / S3 / Tika-based ingestion | Extensive (Slack, Notion, GDrive…) |
| Setup | One command, ~1 hour | Multi-step |
| EU-resident development team | Yes (Milan) | No |
| GDPR / EU AI Act tooling | First-class | DIY |
| Auth & RBAC | JWT + 3 roles built in | Built in; SSO in Enterprise |
The rows where Onyx wins are real: the connector library, the conversational UI, and the size of the community are all genuine advantages today.
The rows where I3K RAG Enterprise wins matter most if data sovereignty, multilingual quality, deployment topology and operational completeness (backup, OCR, multi-GPU) are non-negotiable.
Deployment
Both projects support Docker Compose for evaluation and Kubernetes for production.
Onyx distributes a Helm chart and has good documentation for typical SaaS-on-Kubernetes deployments. Air-gapped installation is possible but feels like swimming upstream: many defaults assume outbound network access (image pulls from public registries, telemetry, model downloads).
I3K RAG Enterprise is designed for fully local, 100% offline deployment as the default case. Models are served locally by Ollama, embeddings run locally via bge-m3, and there are no outbound calls in normal operation. The one-command installer brings up the full stack — Qdrant, Ollama, FastAPI, the React frontend, Tika, Tesseract — in around an hour.
If you are deploying inside a corporate network with proxy restrictions, or in a regulated environment where outbound traffic is denied by policy, our experience is that I3K RAG Enterprise will give you fewer surprises.
Licensing — and why AGPL matters
Both projects are usable under their open-source license without any commercial contract. The licenses themselves are different in a way worth understanding.
Onyx: MIT for the core. MIT is maximally permissive — anyone can take the code and ship a closed-source commercial product on top of it, with no obligation to contribute changes back.
I3K RAG Enterprise: AGPL-3.0 for the whole platform. AGPL is a strong copyleft license: you can self-host, modify, and use the platform commercially inside your own organisation without restriction. What AGPL prevents is a third party taking the code, wrapping it in a hosted SaaS, and keeping their modifications private. That is a deliberate choice on our part — it protects the project and the community from the most common open-source-to-closed-source extraction pattern.
If you are an enterprise self-hosting the platform, AGPL imposes no practical burden on you that MIT wouldn't. If you intend to resell I3K RAG Enterprise as a hosted service, talk to us about a commercial license.
Multilingual and OCR — where the stack choices show
Two stack choices deserve highlighting because they tend to be invisible until you hit them.
bge-m3 for embeddings: bge-m3 is natively multilingual across 29 languages, and the quality on non-English corpora is meaningfully better than English-first defaults. If your corpus is in Italian, French, German, Spanish, or any mix of EU languages, you'll feel this from the first query.
Tika + Tesseract for ingestion: a large share of real enterprise documents — especially in healthcare, legal, and public sector — are scanned PDFs. Without OCR, those documents are effectively invisible to retrieval. We ship Tika and Tesseract in the default stack so this case works out of the box.
When you should pick Onyx
We genuinely think Onyx is the better choice if:
- Most of your knowledge lives in SaaS tools (Slack, Confluence, Notion, Google Drive) and you need connectors out of the box.
- You are an English-only or English-mostly organization and multilingual quality is not a constraint.
- You value the conversational UI and the larger community momentum around Onyx.
- You want the fastest path from zero to a working internal assistant in an English-language US-centric stack.
When you should pick I3K RAG Enterprise
We think I3K RAG Enterprise is the better choice if:
- You operate in an EU regulated industry — legal, healthcare, finance, public sector — and data residency is a hard requirement.
- You need a real story for the EU AI Act, not just GDPR.
- Your corpus is multilingual or non-English-dominant.
- You need to deploy fully local / air-gapped, with no outbound calls.
- You need OCR for scanned documents as a first-class capability.
- You want integrated backup to your existing storage (S3, Azure Blob, GCS, B2, local NAS, and the 60+ other rclone targets) as part of the platform, not a script you write later.
- The AGPL-3.0 license aligns with how you think about open source — and you appreciate the protection it gives against SaaS-wrapping by third parties.
When neither is the right answer
Honest disclosure: there are situations where neither project is what you want.
If you're a startup with twenty documents and a chatbot prototype, a Postgres table plus pgvector plus a short script will get you further than either platform. If you're a hyperscaler with custom ASICs and a research team, you almost certainly have an internal stack already.
Pick a platform when the operational concerns — multi-tenant scoping, RBAC, backup, deployment topology, lifecycle of models and indexes — start to feel like more work than the retrieval itself.
How to choose, concretely
Run both on your own data for two weeks. We mean that literally — not a demo, not a vendor benchmark, your own corpus and your own evaluation queries.
Measure four things: retrieval quality on your queries, end-to-end latency at your concurrency, operational cost (people-time included), and compliance gap (what's missing that you'd have to build yourself). Then pick the one that wins on the dimensions you actually care about.
We think the answer is I3K RAG Enterprise more often than not for EU regulated workloads, multilingual corpora, and teams that want everything — inference, retrieval, OCR, backup — running inside their own perimeter. That's the bet behind the project. But the evaluation should be yours, not ours.