Sophia
Sophia is SoftInstigate's enterprise RAG platform. It turns a company's documents, products, processes and tickets into conversational AI agents reachable through a web interface, a REST API or MCP clients, for SMBs and large organisations.
What is Sophia?
Sophia is a conversational knowledge-base platform built and operated by SoftInstigate Srl Società Benefit, the Italian studio behind the open-source RESTHeart framework. It runs on retrieval-augmented generation: answers come from the customer's own documents rather than from the model's general knowledge. The vendor illustrates the difference by contrasting Claude on its own, which cannot see internal policies, with Claude plus Sophia, which answers and points to the document it used.
The workflow is direct. Documents are uploaded, segmented and turned into embeddings, and a retriever is exposed on top of them. Agents built over that index are then queried from the web chat, from a REST API or from any MCP client. Each agent carries its own prompt template, document tags, RAG configuration and agentic behaviour, which lets an organisation keep customers, internal staff and partners on separate bodies of knowledge. The platform is multi-tenant: one instance hosts several organisations, and every agent, document, user, session and API token is filtered by server-side access-control lists. Access is invitation-only - the vendor activates a tenant after a commercial agreement, and there is no public sign-up.
Models are interchangeable per agent - Claude, Nova, Mistral, Nemotron, Qwen, MiniMax - and inference runs exclusively through AWS Bedrock. Three mechanisms target cost: Smart Routing assigns a different model to each phase of a turn (claimed up to 40% cheaper at equal quality), prompt caching replays a recurring prefix at 10% of its cost, and history stripping trims the conversation; the vendor claims up to 65% lower cost per answer on recurring conversations. When a Bedrock model fails or throttles, Sophia switches to a configurable secondary model and the user simply sees a model_fallback event while the answer continues.
Production plumbing - authentication, ACLs, audit, tag filtering, change streams - is included, next to an agentic mode with a visible tool loop, a collaborative mode with interactive HTML artefacts and follow-up buttons, and Deck View, which lays a chat out as horizontal cards. Four public demo agents run without a login. Sophia is sold as a managed cloud offer for SMBs, from EUR 149 per month, and as an Enterprise offer deployed on-premise, on dedicated cloud or managed, in English and Italian.
What it does
- Answer questions from a company's own documents and cite the source behind each answer
- Ingest and index PDF, Markdown, HTML, XML, docx, xlsx, pptx, rtf, epub, OpenDocument, Apple iWork files and source code
- Run several compartmentalised agents, each with its own prompt, document tags and RAG configuration
- Work in agentic mode, chaining tool calls - search, file retrieval, context saving - with the reasoning shown in real time
- Expose every agent as an MCP server for Claude Desktop, Claude Code, Cursor and VS Code
- Embed a chat agent in any third-party website through a script snippet or an iframe
- Switch models automatically when a Bedrock model fails or throttles, and track token consumption and cost per chat, agent and model
When to use Sophia / When not to
A quick filter to help you decide if Sophia is the right fit.
When to use Sophia
- After-sales and technical support teams looking for ticket deflection across multi-vendor manuals in mixed formats and languages
- B2B sales teams in manufacturing, business services, software, consulting and insurance who need current prices, product sheets and customer history during a conversation
- B2B and B2C e-commerce operators - retail, industrial spare parts, components, construction supplies, distribution - fielding technical questions at the point of purchase
- Legal, compliance, HR and training departments that need separate agents per subject area, with access controlled department by department
- Engineering teams that want their knowledge base available inside Claude Desktop, Claude Code, Cursor or VS Code through MCP, and organisations that require an on-premise or dedicated-cloud deployment
When not to use Sophia
- Individuals and small teams who expect to sign up on their own: access is invitation-only and a tenant is activated by the vendor after a commercial agreement
- Anyone shopping for a free plan or a free trial - neither is published, and the entry point is EUR 149 per month per agent plus a one-off EUR 1,500 onboarding fee
- Buyers who need a fixed, predictable bill: LLM inference is re-billed as a pass-through at the provider's list price and is not capped
- Users looking for a general-purpose assistant - Sophia answers from the customer's own corpus, not from the model's knowledge of the world
- Organisations that need 24/7 support, a native mobile app or a browser extension, or an interface in a language other than English or Italian (support runs Monday to Friday, 9am-6pm CET)
How to use Sophia
A typical end-to-end flow, from setup to results.
- Contact SoftInstigate through the form on the Sophia site, or at sales@softinstigate.com: there is no self-service sign-up, and the tenant is activated after a commercial agreement
- Go through onboarding with SoftInstigate consultants - mapping documents and sources, configuring agents, tags and policies, initial ingestion, retrieval validation, prompt-template tuning, accuracy testing and administrator training
- Have an administrator invite users by email; the transactional invitation is sent through AWS SES
- As an invited user, choose a password, accept the terms, the privacy policy and the article 1341 clauses, and you are logged in automatically
- Upload documents from the admin panel: prose and code formats, directory autocompletion, inline or bulk tag editing, and one-click re-indexing of documents that indexed badly
- Create one or more agents, each with its prompt template, document tags, RAG configuration and agentic options (iteration count, search-and-fetch preamble, compact payloads, context management, prompt caching, extended thinking)
- Chat with the agent from the web interface, switching on collaborative mode or Deck View when the session calls for it
- For programmatic access, issue an API token scoped to specific agents and tags, then call the REST API on api.bysophia.ai (POST /chats, GET /agents, POST /docs.files, GET /textSegments)
- For an MCP client, copy the configuration snippet generated by the admin panel for Claude Desktop, Cursor, Claude Code or VS Code; re-authentication uses OAuth client credentials
- To put an agent on a website, paste the embed script snippet with its data attributes (agent, position, primary colour, Italian and English labels, theme), then follow consumption and cost per chat, agent and model in the Costs dashboard
Pros & Cons
Pros
- Answers are grounded in the customer's documents and cite their source - the vendor's own claim is "Doesn't hallucinate. Cites sources."
- Cost is engineered rather than absorbed: Smart Routing, prompt caching and history stripping, with LLM inference re-billed at list price and no markup added, plus consumption dashboards per chat, agent and model
- Full programmatic access: documented REST API, a native MCP server per agent, API tokens scoped by agent and tag, and a copy-paste embed snippet that needs no framework or build step
- Serious compartmentalisation: multi-tenant architecture with server-side ACLs, separate agents per audience, and no data shared between tenants without explicit configuration
- Explicit legal framework: DPA on request, a single named AI subprocessor, versioned and time-stamped consents, and customer content treated as confidential by default
- Sovereignty options for organisations that need them: on-premise deployment, where data never leaves the customer's perimeter, or a dedicated cloud, with local models such as Llama or Nemotron
- Service continuity through automatic switching to a secondary model when a Bedrock model fails or is throttled
Cons
- No free plan and no free trial is published, and there is no self-service sign-up: access follows a commercial agreement and an invitation
- High entry ticket: EUR 149 per month for the first agent, EUR 99 per month for each additional agent, plus a one-off EUR 1,500 onboarding fee per agent
- Total cost is not predictable, because LLM inference is billed on top at the provider's list price
- Public pricing stops at the SMB offer - beyond three agents, and for Enterprise deployments, you have to go through sales
- Everything depends on a single AI subprocessor, AWS Bedrock, which the supplier may replace at its discretion
- Support runs 5x8, Monday to Friday 9am-6pm CET, with a first response on blocking incidents of 8 to 2 hours depending on the tier; there is no 24/7 coverage
- Interface and content are limited to English and Italian, no data-hosting country is published, and the legal links in Sophia's own footer return 404 - the real documents live under restheart.com/legal/
Pricing & Plans
There is no free plan and no free trial. The lowest published entry point is EUR 149 per month for the first agent on the managed cloud offer for SMBs, with each additional agent at EUR 99 per month; paying twelve months in advance brings this to EUR 1,609 and EUR 1,069 per year respectively, a 10% reduction. A non-recurring onboarding fee of EUR 1,500 per agent applies. LLM inference is billed separately as a pass-through at the provider's list price, with no markup added - the published examples are roughly USD 1 and USD 5 per million input and output tokens for Claude Haiku 4.5, and roughly USD 0.10 and USD 0.30 for Nemotron Nano 9B. Beyond three agents, and for Enterprise deployments, pricing is quoted on request. All amounts are stated excluding VAT.
- EUR 149 per month or EUR 1
- 609 per year for the first agent
- EUR 99 per month or EUR 1
- 069 per year for each additional agent
- including dedicated infrastructure
- software updates
- support and a four-working-hour response on blocking incidents
- EUR 1
- 500 one-off per agent
- delivered by SoftInstigate consultants
- on-premise
- dedicated cloud or managed
- Professional (8-hour response on blocking incidents
- 2 named contacts)
- Business (4 hours
- 5 contacts) and Enterprise (2 hours
- 10 contacts)
- all available Monday to Friday 9am-6pm CET with updates included
- billed separately on top of any plan
- as a pass-through at the provider's list price
Data, GDPR & hosting
A consolidated view of how Sophia handles your data.
GDPR overview
GDPR implementation is documented in detail. SoftInstigate Srl Società Benefit, registered at Via del Beato Cesidio 49, L'Aquila, is the controller for its own processing under Regulation 2016/679 and Italian Legislative Decree 196/2003; its legal representative is Andrea Di Cesare. No DPO has been appointed, the supplier considering that article 37(1) does not apply. For Sophia, the customer is the controller and SoftInstigate the article 28 processor, with a separate DPA available on request. Data subjects exercise access, rectification, erasure, restriction, portability, objection and consent-withdrawal rights at info@softinstigate.com, and may complain to the Italian Garante. Non-EU transfers rely on the Commission's standard contractual clauses and the EU-U.S. Data Privacy Framework. Consents are recorded with document version, timestamp and IP address, with blocking re-acceptance after a major version change. The service is not intended for under-16s. The privacy policy and the Sophia terms (v1.0) both took effect on 14 May 2026.
Who owns the data?
The customer keeps ownership of the content it ingests into the knowledge base and of the conversations its users hold. SoftInstigate acquires no rights beyond a limited licence to process that content for the sole purpose of providing the service, classifies it as confidential by default, and accesses it only where technical support requested by the customer makes it necessary. Sophia itself - code, infrastructure and documentation - remains the exclusive property of SoftInstigate. Usage rights over AI outputs are granted to the customer, with no warranty of originality or non-infringement, and the supplier notes that AI-generated material is generally not protected by copyright. For personal data, the customer is the controller and SoftInstigate the processor under article 28 GDPR.
Reuse rights
The customer may reuse its own ingested content and its conversations freely, without asking permission: the supplier holds only a service-delivery licence over them. Processing follows a documented pipeline - text extraction, segmentation, embedding generation and storage inside the customer's own tenant. On each message, the message itself and a selection of fragments retrieved from the knowledge base are transmitted over TLS to AWS Bedrock, the single named AI subprocessor, governed by the AWS Service Terms and the AWS DPA. AWS Bedrock does not retain customer content beyond what the operation requires and does not use it to train foundation models, whether AWS or third-party. Sophia keeps AI usage metrics - model, input and output tokens, cost, latency - for billing, monitoring and optimisation, and stores chat history so users can return to it, with multi-tenant isolation enforced server-side. Account, technical (IP address, user agent, logs), billing and communication data are also processed; marketing processing requires consent. The supplier reserves the right to replace the AI provider with one offering equivalent or better guarantees.
Data retention & training
Hosting summary
No hosting country is published, either on the site or in the privacy policy. Inference and embeddings run exclusively through AWS Bedrock, and the supplier acknowledges that AWS may operate infrastructure outside the European Union, notably in the United States. Those transfers rely on the European Commission's standard contractual clauses included in the AWS DPA and on the EU-U.S. Data Privacy Framework, with supplementary measures: TLS in transit, no persistent storage on the Bedrock side, and pseudonymisation where applicable. Model invocations can be confined to specific AWS regions, European ones included, where AWS supports it and the customer requires it - an option, not a published commitment. Enterprise customers have two alternatives: on-premise deployment, where data never leaves their own perimeter, or a dedicated cloud on SoftInstigate's infrastructure with physical separation of resources. Announced security measures include encryption in transit and at rest, access controls, regular audits, staff training and incident procedures, with logical multi-tenant isolation enforced by server-side ACLs. The supplier is established in Italy and the contract is governed by Italian law.
Things to keep in mind
Risks and trade-offs to weigh before adopting Sophia.
- AI answers are produced by stochastic statistical models: the contract warns of inaccuracies, hallucinations and fabricated references, and forbids relying on an answer as the sole basis for legal, financial, medical or safety decisions
- Grounding in company documents makes answers sound authoritative, and users stop opening the cited source; an outdated or wrong document then becomes an official-sounding answer repeated across the organisation
- The customer remains responsible for the lawful basis of any personal data inside the uploaded documents and for moderating its own corpus; special-category data under article 9 GDPR is prohibited without a dedicated DPA
- The supplier's liability is capped at the subscription fees paid over the previous six months
- Clauses classed as onerous under article 1341 of the Italian Civil Code must be approved separately: service evolution, payment obligations, limitation of liability, termination, exclusive jurisdiction of the court of Pescara and unilateral amendment
- Subscriptions renew automatically, cancellation requires written notice 30 days before the term ends, there are no pro-rata refunds, and after termination only 60 days remain to export before tenant content and data are permanently deleted
- The supplier may change or remove features, migrate to other cloud or AI providers and revise prices with reasonable notice; and the legal links in Sophia's footer return 404, so the documents that actually bind you have to be found under restheart.com/legal/
Setup & Integrations
Technical difficulty
Two very different levels. Putting an agent on a website is copy-and-paste: one script snippet, no framework and no build step, configured through data attributes. Getting there is not self-service - a commercial agreement comes first, then onboarding led by SoftInstigate consultants who map the documents, configure agents and policies, run the initial ingestion, validate retrieval, tune the prompt and train administrators; the vendor advertises a pipeline live in days. Day-to-day administration needs no code. Programmatic access assumes technical staff (API tokens, OAuth, MCP, REST endpoints), and on-premise or dedicated cloud assumes an infrastructure team on the customer's side.
Deployment
Integrations
Supported languages
Behind Sophia
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What is Sophia?
Can I sign up on my own?
Is there a free plan or a free trial?
How much does Sophia cost?
Which AI models does Sophia use?
Are my documents used to train AI models?
Who owns the documents and the conversations?
Which document formats can be ingested?
Can I query Sophia from Claude Desktop, Cursor or my own code?
How long is my data kept?
Should you pick Sophia?
Sophia is a serious piece of work, technically and contractually, but it is not a tool you pick up on impulse. There is no free plan, no free trial and no sign-up form: a tenant is opened only after a commercial agreement, and onboarding is delivered by SoftInstigate consultants at a one-off EUR 1,500 per agent, on top of EUR 149 per month for the first one.
What that buys is a retrieval-augmented platform that answers from your own corpus and cites the document behind each answer, a native MCP server for every agent next to a documented REST API, multi-tenant isolation enforced by server-side access-control lists, and inference re-billed at the provider's list price with no markup - with Smart Routing, prompt caching and history stripping working to keep that bill down. Organisations that cannot put their data on a shared platform can take the Enterprise route: on-premise, where nothing leaves their perimeter, or a dedicated cloud.
The trade-offs are just as clear. The total bill is not predictable, since LLM usage is passed through and uncapped. Public pricing stops at three agents. Everything runs through a single AI subprocessor, AWS Bedrock, which the supplier may replace at its discretion, and no hosting country is published - confining model invocations to European AWS regions is presented as conditional. Support is business hours only, and the product speaks English and Italian.
Two things to check before signing: ask for the DPA, which is only available on request, and read the contract directly under restheart.com/legal/, because the legal links in Sophia's own footer return 404. Behind the product stands an established Italian studio - SoftInstigate has been maintaining the open-source RESTHeart framework for more than ten years.
- Choosing a selection results in a full page refresh.
- Opens in a new window.