Pinecone, Qdrant, Weaviate, and pgvector for Regulated Enterprise RAG

For regulated enterprises building retrieval-augmented generation systems, the vector database shortlist isn't shaped by benchmarks — it's shaped by data residency requirements, security policy, and audit obligations. This episode of LLM.co works through the four stores that dominate serious RAG conversations right now — Pinecone, Qdrant, Weaviate, and pgvector — against the criteria that compliance teams actually apply. The full analysis behind the episode is available in the deep-dive article on vector stores for regulated enterprise RAG. The episode covers five decision layers that separate these engines once deployment context is fixed: Network isolation: Pinecone is a managed SaaS product — queries and vectors cross the customer boundary — while Qdrant, Weaviate, and pgvector all support fully self-hosted deployments that keep data inside the enterprise perimeter. For legal, defense, and many financial environments, this single fact ends the evaluation early. Row-level security: Regulated corpora are rarely uniform; patient subsets, client-privileged matter files, and ITAR-bucketed documents each require granular access enforcement at the engine level. pgvector inherits PostgreSQL's native CREATE POLICY semantics directly, making it the strongest candidate for HIPAA-compliant AI in healthcare, legal, and financial deployments where SQL policy is already the access-control standard. Hybrid search: Regulated search rarely stays purely semantic — case numbers, CPT codes, and ticker symbols demand keyword precision alongside vector recall. All four stores now offer some form of sparse-dense fusion, though the implementation differs: Weaviate uses tunable BM25-and-vector blending, Qdrant pairs sparse and dense vectors through a unified query API, and pgvector leverages PostgreSQL's native full-text search with fusion expressed in SQL. Scale and multi-tenancy: Weaviate's architecture is explicitly designed for one cluster serving thousands of logically isolated tenants simultaneously — a critical property for managed-service providers running private multi-document RAG per client. pgvector's headroom has expanded significantly with the pgvectorscale extension and iterative index scans introduced in the 0.8 release, with independent benchmarks showing materially lower latency and roughly one-fifth the monthly cost of Pinecone at matched recall on fifty million high-dimensional embeddings. Audit boundaries: SaaS vector stores export logs on the vendor's terms; self-hosted options write to local disk, journald, or Kafka and ingest into Splunk or Sentinel like any other on-premises workload — removing a vendor dependency that is difficult to defend to an auditor. The episode closes with a practical starting-point heuristic: teams already running PostgreSQL in production, with corpora under roughly fifty million vectors and a stated row-level security audit requirement, have a natural on-ramp in pgvector before evaluating more specialized engines. For more on the infrastructure considerations that sit alongside vector store selection, the episode The Numbers Behind On-Prem AI Hardware in 2026 covers the hardware economics of keeping AI workloads fully on-premises. LLM.co hardware.co