For a startup, the gap between a visionary idea and a market-ready product is often bridged by two things: speed and security. This was the exact challenge facing Virsion, a tech startup focused on democratizing generative AI for small-to-medium-sized institutions.
When founders Giovanni and Gianmarco Virzi set out to build a secure RAG (Retrieval-Augmented Generation) application, they didn't just need a library—they needed a "companion" framework that would allow them to focus on business logic rather than UI boilerplate.
Executive summary
Virsion is an early-stage startup building secure, AI-powered web applications for document management, knowledge sharing, and internal collaboration. Their flagship product is a Retrieval-Augmented Generation (RAG) platform that allows organizations to safely upload, query, and share internal documentation using AI—without sacrificing data residency, security, or compliance.
From day one, the team needed to move fast while meeting enterprise-grade requirements typically associated with much larger organizations. They chose Vaadin with Spring Boot to build their platform entirely in Java, enabling security by design, faster time-to-market, and long-term architectural scalability.
The Challenge: Enterprise-Grade AI with Startup Resources
Virsion’s mission is ambitious: bringing high-level AI document management—usually reserved for tech giants—to legal studios, universities, and SMEs. Their core product allows users to upload proprietary documentation, summarize it via AI, and share it across departments with strict data residency and security-by-design principles.
To succeed, they needed a tech stack that could:
- Guarantee Security: Protecting sensitive legal and institutional data was non-negotiable.
- Accelerate Time-to-Market: As a lean team of two, they couldn't afford months of front-end development.
- Ensure Accessibility: Build a tool that works seamlessly for everyone, including users with visual impairments.
The Solution: Why Vaadin?
Gianmarco, an experienced developer with a past at Ducati Corse, knew that building a modern web UI from scratch using React or Angular would require significant "plumbing"—handling state management, server communication, and security handshakes manually.
Instead, Virsion chose Vaadin 24 paired with Spring Boot.
|
|
"Vaadin is a great companion. It’s an entire framework helping you build something excellent without looking at all the tiny details of small components you have to rebuild from scratch."
|
|
|
"If you know Java, the learning curve is smooth. It transforms hard web parts into something as intuitive as desktop application development."
|
1. Security by Design
Vaadin’s unique server-side architecture naturally minimizes the attack surface.
"Vaadin has double-check verification on both the client and server side," explains Gianmarco.
"A lot of security features are already managed. You don't have to write the boilerplate code required by React or Angular."
2. Radical Productivity
By using Vaadin’s extensive library of ready-to-use UI components, Virsion bypassed the traditional "infrastructure" phase of UI development.
- Time Saved: The team estimates they saved at least one full month of development time.
- Focus: They shifted their energy from "button-building" to the complex orchestration of AI agents and Azure cloud infrastructure.
3. Seamless Java Integration
For a team rooted in Java, the learning curve was nearly flat.
"If you know Java, the learning curve is smooth. It transforms hard web parts into something as intuitive as desktop application development," says Gianmarco.
Technical Deep Dive: Architecting RAG with Vaadin & Azure
For engineering leaders, the Virsion story isn't just about speed—it's about a specific architectural choice that solves the "impedance mismatch" between complex AI backends and secure web frontends.
All documents and content shown in the screenshots are sample data provided for demonstration purposes.
Flow application home page: The home page provides quick access to the main features of Flow, including customer management and the AI Document Assistant (ADA).
The "Zero-API" Security Model
In a typical React/Angular stack, you must expose your RAG logic via REST or GraphQL endpoints. This creates a significant attack surface, especially when handling sensitive legal or institutional documents. Vaadin’s Server-Side-First architecture keeps the entire RAG orchestration—from document chunking to LLM prompting—within the secure JVM boundary.
- No Exposed AI Logic: The business logic for retrieving documents from the vector store never leaves the server.
- Automatic State Management: Vaadin handles the session state between the user’s query and the AI's streaming response automatically, preventing "stale context" issues common in complex SPAs.
The Tech Stack: Spring AI + Azure AI Search
Virsion leverages Spring Boot as the backbone, allowing them to use Spring AI to interface seamlessly with Azure services.
- Vector Storage: Documents are vectorized and stored in Azure AI Search.
- LLM Orchestration: They use the Azure OpenAI service, ensuring that the AI "knowledge" is grounded specifically in the uploaded European/Swiss datasets rather than the public internet.
- Deployment: The current beta runs on Azure App Service, with a roadmap to Azure Kubernetes Service (AKS) for multi-tenant scaling.
Human-Centric Engineering: Built-in Accessibility
While most startups treat accessibility as a post-launch "fix," Virsion utilized Vaadin’s built-in WCAG 2.1 compliance.
- Screen Reader Support: Because Vaadin components are rendered with proper ARIA roles out-of-the-box, Virsion could focus on the "human" side of accessibility—testing with blind users—rather than the technical side of fixing broken HTML tags.
- Keyboard Navigation: Essential for institutional and university users, the entire AI interface is navigable via keyboard without any additional custom JS.
- Accessible AI Chat: Visually impaired users interact with ADA through a fully accessible chat interface, so both the AI interaction and the document management layer can be used by blind users without additional adaptations.
- Accessible Document Formats: Every uploaded document is automatically converted into accessible formats, so visually impaired users can download and navigate the content properly.
For Virsion, accessibility has become a central part of the company’s vision—not just something done for compliance. Rather than treating accessibility as a box to tick, the team builds and tests these features directly with users who are blind, ensuring the product works for everyone in practice.
All documents and content shown in the screenshots are sample data provided for demonstration purposes.
Conversation with ADA (AI Document Assistant).
ADA answers a user question based on the knowledge created from uploaded documents. The response is generated exclusively from user-provided content to reduce errors and hallucinations. Part of the answer has been censored.
In this part of the discussion, ADA explains why she is called “ADA” and displays a sources table at the end of the response. Users can download the documents used to generate the answer, ensuring transparency and traceability. Part of the content has been censored.
Since this case study was first drafted, Virsion has continued to evolve the platform. ADA now automatically understands whether a full document analysis is required or whether it should suggest relevant document fragments based on the user’s prompt. When a user submits a generic request, ADA proposes a list of potentially relevant documents and asks which one to analyze. The chat UI also displays token usage and remaining requests, giving users clearer feedback on system consumption and limits.
When a user submits a generic request, ADA proposes a list of potentially relevant documents and asks which one to fully analyze.
Visible token usage and remaining requests in the chat UI give users clearer feedback on system consumption and limits.
Document management has been improved as well. Folders are automatically created for departments, companies, and users, each with specific permission rules. Drag & drop is supported, and the upload window now includes a “Destination folder” selector to better control document organization.
The Manage documents view: folders are automatically created for departments, companies, and users, each with specific permission rules.
Newly uploaded documents are processed automatically, with accessible versions generated in the background.
The upload window supports drag & drop and includes a “Destination folder” selector for better control over document organization.
Most importantly, the accessibility layer has been strengthened. At the end of each response, the system now shows the original document together with accessible versions in HTML and Markdown format, ensuring that visually impaired users can download and navigate the content properly. A LaTeX accessible version is also being considered for academic and research institutions.
ADA performs a full analysis of a legal document on request, entirely through the accessible chat interface.
At the end of each response, the Sources table always offers the original document together with accessible versions in HTML and Markdown format.
The Results: From Concept to Beta in Record Time
By choosing Vaadin, Virsion transformed from an idea into a functional, secure beta currently being tested by pilot institutions — all within a matter of weeks.
| Metric |
Result |
| Development Time Saved |
1+ Month |
| Team Size |
2 Developers |
| Primary Framework |
Vaadin 254 + Spring Boot |
| Core Values |
Security, Data Residency, Accessibility |
Advice for Fellow CTOs and Managers
Gianmarco’s advice to other engineering leaders is simple: Don't reinvent the wheel.
"I suggest developers go through the documentation first. There is so much already there from the community and the Vaadin team. Before you start building a custom component, look inside the framework—most probably, what you are looking for is already there."
What’s Next for Virsion?
As Virsion prepares for its full public launch, have already upgraded to Vaadin 25, taking the opportunity to refresh the entire UI with the new Aura theme. they are already looking toward Vaadin 25. Their roadmap includes deeper AI agent orchestration and expanding their "Human-First" accessibility features to educational institutions across Europe.