I3K RAG Enterprise vs Onyx: An Honest Open-Source Comparison

If you're shopping for an open-source Retrieval-Augmented Generation platform in 2026, the two names that come up most often are Onyx and I3K RAG Enterprise. There are others — Verba, Quivr, Haystack as a library — but Onyx and I3K RAG Enterprise are the two projects that explicitly target enterprise deployments out of the box.

We build I3K RAG Enterprise. We've also run Onyx on production data, both on behalf of clients and as part of our own evaluation work. This post is an attempt to give you the comparison we wish someone had given us when we were evaluating, including the parts where Onyx genuinely wins.

If you spot something wrong, tell us and we'll fix it.

Where the projects come from

The two projects come from different starting points, and that shapes the trade-offs.

Onyx (formerly Danswer) is a US-originated open-source RAG platform that gained traction around 2023 as a "ChatGPT for your company". It has a strong focus on connectors — Slack, Confluence, Google Drive, Notion — and on getting a working assistant in front of users quickly.

I3K RAG Enterprise is built by I3K Technologies in Milan. It started as a sovereignty-first internal tool for EU-regulated customers, and was open-sourced once the architecture stabilised. The focus is on running entirely inside the customer's perimeter, on compliance tooling, and on multilingual retrieval as a first-class concern.

The two projects pick deliberately different open-source licenses. Onyx is MIT. I3K RAG Enterprise is AGPL-3.0 — a copyleft license that protects the project from being repackaged as a closed SaaS product by a third party, while leaving you completely free to self-host, modify, and use it commercially inside your own organisation. That is a real, substantive difference and we'll come back to it.

Architecture: connector-first vs sovereignty-first

The clearest architectural difference between the two is what each project treats as the centre of gravity.

Onyx is connector-first

Onyx's strongest asset is its connector library. Out of the box it can ingest from a long list of SaaS sources, handle authentication, and incremental sync. If your knowledge lives in Notion and Confluence and Slack, Onyx will be talking to it within an afternoon. The retrieval layer is a relatively conventional pipeline backed (depending on configuration) by Vespa or Postgres with pgvector.

I3K RAG Enterprise is sovereignty-first

We designed the platform around a single hard constraint: nothing leaves the customer's perimeter. The stack reflects that choice end-to-end:

• One Rust binary — no Docker, no Compose, no Java. It starts its own vector database and inference engine.
• Qdrant as the vector store, with role filtering pushed down into the query so boundaries are enforced at retrieval time.
• eullm as the local inference engine, started and kept up to date by the binary and GPU-aware at startup.
• BAAI/bge-m3 as the embedding model — 1024 dimensions, multilingual across 100+ languages, computed in-process through Candle.
• A retrieval pipeline in the binary (ingest → embed → retrieve → generate), with no third-party agent framework in the path.
• pdfium + Tesseract OCR for scanned pages, applied automatically when a page yields too little text.
• JWT auth + roles with three built-in levels.
• GPU when present: an NVIDIA GPU is detected and used automatically; otherwise it runs on CPU.
• Consistent backups: a daily archive holding the application database and a vector snapshot taken together, restorable over the running install.
• Verified components: everything fetched on first run is checked against a pinned sha256, and after that no network is needed at all.

The ingestion side is deliberately simpler than Onyx's. We support the file system and standard document formats — PDF, DOCX, XLSX, HTML, TXT, Markdown and CSV — but we are not trying to match Onyx connector for connector. If you need a Slack connector today, Onyx will get you there faster.

For organisations that want EU-sovereign inference without running the GPUs themselves, we recommend EuLLM as a hosted option.

Feature comparison

Capability	I3K RAG Enterprise	Onyx
Open-source license	AGPL-3.0	MIT
Self-hostable	Yes	Yes
Air-gapped / 100% local deployment	Default	Possible, less documented
Vector store	Qdrant (RBAC filtering built in)	Vespa or Postgres + pgvector
LLM serving	eullm, started by the binary	Configurable
Embedding model (default)	BAAI/bge-m3 — 100+ languages native	English-first defaults
OCR / scanned documents	pdfium + Tesseract built in	Not built in
GPU	NVIDIA detected automatically, else CPU	NVIDIA-focused
Integrated backup	Daily consistent archive + restore	Not built in
Connector library	File-based ingestion, 7 formats	Extensive (Slack, Notion, GDrive…)
Setup	Extract a tarball, run one binary	Multi-step
EU-resident development team	Yes (Milan)	No
GDPR / EU AI Act tooling	First-class	DIY
Auth & RBAC	JWT + 3 roles built in	Built in; SSO in Enterprise

The rows where Onyx wins are real: the connector library, the conversational UI, and the size of the community are all genuine advantages today.

The rows where I3K RAG Enterprise wins matter most if data sovereignty, multilingual quality, deployment topology and operational completeness (backup, OCR, multi-GPU) are non-negotiable.

Deployment

Both projects support Docker Compose for evaluation and Kubernetes for production.

Onyx distributes a Helm chart and has good documentation for typical SaaS-on-Kubernetes deployments. Air-gapped installation is possible but feels like swimming upstream: many defaults assume outbound network access (image pulls from public registries, telemetry, model downloads).

I3K RAG Enterprise is designed for fully local, 100% offline deployment as the default case. The model is served locally by eullm, embeddings run in-process via bge-m3, and there are no outbound calls in normal operation. There is no installer to run: extract the tarball and start the binary, which fetches and sha256-verifies its own components on the first run and needs no network after that.

If you are deploying inside a corporate network with proxy restrictions, or in a regulated environment where outbound traffic is denied by policy, our experience is that I3K RAG Enterprise will give you fewer surprises.

Licensing — and why AGPL matters

Both projects are usable under their open-source license without any commercial contract. The licenses themselves are different in a way worth understanding.

Onyx: MIT for the core. MIT is maximally permissive — anyone can take the code and ship a closed-source commercial product on top of it, with no obligation to contribute changes back.

I3K RAG Enterprise: AGPL-3.0 for the whole platform. AGPL is a strong copyleft license: you can self-host, modify, and use the platform commercially inside your own organisation without restriction. What AGPL prevents is a third party taking the code, wrapping it in a hosted SaaS, and keeping their modifications private. That is a deliberate choice on our part — it protects the project and the community from the most common open-source-to-closed-source extraction pattern.

If you are an enterprise self-hosting the platform, AGPL imposes no practical burden on you that MIT wouldn't. If you intend to resell I3K RAG Enterprise as a hosted service, talk to us about a commercial license.

Multilingual and OCR — where the stack choices show

Two stack choices deserve highlighting because they tend to be invisible until you hit them.

bge-m3 for embeddings: bge-m3 is natively multilingual across 100+ languages, and the quality on non-English corpora is meaningfully better than English-first defaults. If your corpus is in Italian, French, German, Spanish, or any mix of EU languages, you'll feel this from the first query.

Tika + Tesseract for ingestion: a large share of real enterprise documents — especially in healthcare, legal, and public sector — are scanned PDFs. Without OCR, those documents are effectively invisible to retrieval. We ship Tika and Tesseract in the default stack so this case works out of the box.

When you should pick Onyx

We genuinely think Onyx is the better choice if:

• Most of your knowledge lives in SaaS tools (Slack, Confluence, Notion, Google Drive) and you need connectors out of the box.
• You are an English-only or English-mostly organization and multilingual quality is not a constraint.
• You value the conversational UI and the larger community momentum around Onyx.
• You want the fastest path from zero to a working internal assistant in an English-language US-centric stack.

When you should pick I3K RAG Enterprise

We think I3K RAG Enterprise is the better choice if:

• You operate in an EU regulated industry — legal, healthcare, finance, public sector — and data residency is a hard requirement.
• You need a real story for the EU AI Act, not just GDPR.
• Your corpus is multilingual or non-English-dominant.
• You need to deploy fully local / air-gapped, with no outbound calls.
• You need OCR for scanned documents as a first-class capability.
• You want a backup that restores as a consistent whole — application database and vector snapshot taken together — as part of the platform, not a script you write later.
• The AGPL-3.0 license aligns with how you think about open source — and you appreciate the protection it gives against SaaS-wrapping by third parties.

When neither is the right answer

Honest disclosure: there are situations where neither project is what you want.

If you're a startup with twenty documents and a chatbot prototype, a Postgres table plus pgvector plus a short script will get you further than either platform. If you're a hyperscaler with custom ASICs and a research team, you almost certainly have an internal stack already.

Pick a platform when the operational concerns — multi-tenant scoping, RBAC, backup, deployment topology, lifecycle of models and indexes — start to feel like more work than the retrieval itself.

How to choose, concretely

Run both on your own data for two weeks. We mean that literally — not a demo, not a vendor benchmark, your own corpus and your own evaluation queries.

Measure four things: retrieval quality on your queries, end-to-end latency at your concurrency, operational cost (people-time included), and compliance gap (what's missing that you'd have to build yourself). Then pick the one that wins on the dimensions you actually care about.

We think the answer is I3K RAG Enterprise more often than not for EU regulated workloads, multilingual corpora, and teams that want everything — inference, retrieval, OCR, backup — running inside their own perimeter. That's the bet behind the project. But the evaluation should be yours, not ours.

---