Skip to content
AskVault Docs
Try Free →

How to build an internal knowledge-base chatbot

Written by Joseph Russo, Principal Architect, Networks and Tech, AskVault · Reviewed by Allison Chan
Last updated: · 6 min read

What an internal KB bot actually does

An internal knowledge-base chatbot is a search-and-Q&A interface trained on your company's private documents. It answers in plain English with citations to the source so employees can verify. Concretely, it replaces three time-wasting habits:

  1. "Where's the doc for...?" Slack messages to colleagues asking for a link. The bot finds the doc, quotes the relevant paragraph, links to it.
  2. "What's our policy on...?" Questions to HR or finance about expense limits, PTO, security policy. The bot quotes the policy doc.
  3. "How do I...?" Onboarding-type questions about internal tooling, deploy processes, request workflows. The bot walks the user through the steps from the relevant runbook.

The win is asymmetric: every employee asks the bot, the bot answers from canonical docs, you stop interrupting subject-matter experts to look up things that are already written down.

Why this is harder than it sounds

Three problems most teams run into when they try to DIY this:

  1. Content is everywhere. Confluence, Notion, Google Drive, Slack threads, Zendesk help articles, a few Markdown files in GitHub. A useful bot has to read all of them.
  2. Access control matters. HR documents shouldn't surface to engineering. Finance policy shouldn't surface to interns. The bot needs to know who's asking.
  3. Hallucinations are a fireable offense in internal context. If the bot invents an answer about your PTO policy and an employee acts on it, that's a real problem. Source citations and refusal-to-answer fallbacks aren't nice-to-haves.

AskVault handles all three.

The four ingestion sources that matter most

Most companies have content scattered across these four systems:

  • Confluence. Long-form team docs, design specs, postmortems, onboarding guides. Connect via the Confluence integration in Knowledge > Add Source > Confluence. You connect with an API token and import up to 500 pages at a time, optionally from one space. It's a one-time import; run it again to refresh.
  • Notion. Modern teams have moved here. Connect Notion and import up to 100 shared pages at a time; each page's top-level text is imported, and sub-pages are imported separately.
  • Google Drive. PDFs, DOCX, slide decks, spreadsheets. Paste a file's share link to import that file; one link imports one file. Useful for HR policy folders, legal contract repositories, and onboarding decks.
  • Slack. Historical discussions in #engineering, #hr-faqs, etc. AskVault can index channel history (read-only) so the bot can answer "how did we resolve this incident last time?" with citations.

Three more for completeness: Zendesk for customer-facing help articles you want internal teams to be able to search, GitHub for README files and internal documentation in repos, and direct file uploads for one-off PDFs and DOCX files that aren't in any system. Plus manual snippets and Q&A pairs for tribal knowledge that never made it into a doc.

Setup, step by step

This is the minimal path to a working internal KB bot:

  1. Create a workspace. Name it something like "Internal Helpdesk".
  2. Connect ingestion sources. Start with whichever holds most of your content. Notion connects on every plan, Jira from Growth; Confluence, Google Drive, Slack history, Zendesk help centre and GitHub need Business. Files and web pages can be added on any plan.
  3. Run the initial index. Indexing time depends on how much content you add.
  4. Set up identity verification. Under Channels > Web widget, open the Identity verification tab and copy the workspace HMAC secret. Use it in your SSO middleware to sign each employee's user_id before passing it to the widget.
  5. Set sensitive sources to Internal. HR and finance policies get Audience internal; everything else stays public. Set it per source under Knowledge > [select] > Settings. internal keeps a source out of retrieval on public channels: it is not a per-department permission model, so anything only a handful of people may see belongs in a separate workspace.
  6. Deploy the widget. Embed it on your internal portal, your company wiki home page, or wherever employees land first. Or use the Slack channel and let employees DM the bot directly.

That's the whole setup. To keep the bot current, see keeping knowledge up to date: imports are refreshed by running them again.

Sizing the bot to your company

Size the plan to your content and tools, not your headcount.

  • A small policy set, website widget only. Free (5 MB) or Starter ($39/mo, 15 MB, 2 workspaces). Uploads, web pages and Notion; no Slack, Jira or other integrations.
  • A team that lives in Slack or Notion. Growth ($99/mo, 40 MB, 5 workspaces). Adds the Slack bot, the other messaging channels, Jira imports, AI skills and a brand-free widget.
  • Several departments, Confluence or Google Drive. Business ($249/mo, 100 MB, 15 workspaces). Adds Confluence, Google Drive, Slack history, Zendesk and GitHub imports.
  • 2,000+ docs, strict compliance, dedicated infra. Enterprise. Custom contract terms. No BAA is offered, so keep HIPAA-covered content (PHI) out.

The content-volume number matters more than employee headcount. A large company with a short handbook can fit a small plan; a small firm with years of case files may need Business. Where your content lives also matters, because the Confluence and Google Drive connectors start at Business.

Compliance and access control

Three controls matter most for an internal knowledge bot.

  • Identity verification (HMAC). Every chat turn carries a signed token proving who's asking. Without it, a claimed user_id can be forged by anyone with DevTools open. Always enable HMAC verification before going live.
  • Audience per source. A source set to internal is dropped from the candidate chunks on every public channel before the model sees it, so the bot can't quote it there. There are only two values, public and internal: no per-role scoping.
  • Audit log. Every state-changing action (workspace edits, document deletes, conversation rebroadcasts) is recorded with the acting user and timestamp. Retained 365 days.

Combined: you can prove to legal who saw what and when.

Common use cases

These four patterns suit an internal bot well.

  • IT helpdesk. "How do I reset my VPN password?", "Which laptop do I order?", "How do I request access to AWS?" Bot answers from the IT runbook + onboarding deck.
  • HR self-service. "What's our parental leave policy?", "How do I update my emergency contact?", "Where do I file an expense?" Bot quotes the relevant policy doc.
  • Engineering onboarding. "How do I deploy to staging?", "Where's the docs for our payments service?", "Who owns the customer-success table?" Bot pulls from internal wiki + GitHub READMEs.
  • Customer-success enablement. Internal-only bot indexed on every customer-facing help article + product docs. CS reps query it during live calls instead of switching tabs.

Deploy via Slack

For most internal teams, the right channel isn't a website widget. It's Slack. AskVault's Slack integration deploys the bot as a Slack app:

  • Direct messages. Employees DM the bot directly with a question. The bot replies in-thread with citations.
  • @-mentions in channels. Mention the bot in #engineering and it answers in-channel. Useful for "anyone know how X works?" questions that would otherwise need a human.

Slack setup is a one-click OAuth flow under Channels > Slack. Required scopes: chat:write, app_mentions:read, channels:read, users:read. Content scoping is the same everywhere: a source set to internal is excluded from retrieval on public channels, and there is no per-user or per-group scoping on top of it.

FAQ

How do I keep the bot's knowledge fresh?

Re-run each import when its content changes. Confluence, Notion, GitHub and Google Drive imports are one-time: running them again updates changed pages and leaves unchanged ones alone. For crawled sites, use Resync in the Knowledge page. Imports don't sync automatically. For crawled sites, paid plans can set an automatic re-crawl schedule, but until automatic re-crawl is on for your account a scheduled check may not re-read a changed page, so keep using Resync to be sure (details).

Can employees flag a wrong answer?

Yes. Every response has a thumbs-up / thumbs-down. Down-votes fire the conversation.feedback webhook so you can investigate and update the source doc. Bad answers are usually a content problem (the source is outdated or unclear), not a bot problem.

Does this replace our human HR or IT team?

No. It answers the questions your docs already cover. Situational questions, judgment calls and sensitive matters still go to people, who now spend less time on the easy ones.

How do I handle confidential content that even logged-in employees shouldn't see?

Don't put it in the bot's knowledge base. The audience tag system is strong but it's not a substitute for not-ingesting-in-the-first-place. If a document should be visible to only 3 people, keep it in a private vault, not in a shared knowledge base.

Can I get usage analytics?

Yes. Under Analytics in the dashboard: top questions, unanswered queries, response time, satisfaction scores, peak hours, knowledge coverage. CSV export on Growth and above. Growth+

Was this page helpful?