RAG compliance: Where confidential data goes