将 AI 连接至数十亿法律文档：Legora 与 Turbopuffer 的搜索架构演进之路

Jacob Lauritzen: Okay. Hi everyone. Welcome to this 20-minute talk about connecting AI to loads of legal documents. My name is Jacob. I'm an engineer at Legora.

Simon Eskildsen: Yeah. And I got to step into frame here. I'm Simon. I'm the CEO and co-founder of Turbopuffer, a search engine that we work with Legora and others on.

Jacob Lauritzen: Neat. Super quickly, introduction to Legora. We're a collaborative AI platform for legal work. And so that means we have law firms that are clients and we have in-house legal teams that are clients. And they use Legora to do reviews of contracts. They use it to go through an absurd amount of contracts and make sure that they all look good. They use them to create new contracts. They do legal research which means looking over all potential law and they collaborate inside Legora. So you can think of Legora sort of as a Linear, Figma, Notion, GitHub for legal work. It's a lot.

We are one of the fastest growing companies right now. We grow extremely fast. Yeah, tons of numbers on the screen. I'll just skip through that.

What we really want to talk about is search today. So at Legora there's two types of search that we do. There is project search and legal research. Project search is basically projects in Legora is like the unit of work that you have. So if let's say you are SpaceX and you want to acquire Cursor, then that would be one project with your law firm. And so they would go into Legora and they would upload all these documents and the law firm that helped you would go through all of the employment agreements, all of the contracts with suppliers. I know Cursor is using Turbopuffer so maybe there's a contract there they'd look at. But basically you do the search confined to a project and projects can be tens of documents to millions of documents.

The other use case is legal research. And legal research is sort of a deep research style workload where we'll search across tons of laws, previous cases, regulations, etc., etc. And people use this to answer questions such as like how do I handle this specific thing? And they'll also use it for litigation. Maybe they want to sue someone or maybe they are getting sued and they'll use legal research to support and help their case.

Jacob Lauritzen: So if we start at number one, project search, we've been through a little bit of a ride here on how we do search. Starting at hundreds of thousands of documents all the way into billions of documents. And we've tried a lot of different things.

So first we started with the very simple one, which is just a single Elasticsearch cluster for all of our search workloads. That worked relatively well. It was sort of a simple setup. All of the tenants, our clients, our users would be on one big blob storage where we store the raw documents and on one big Elasticsearch where we would do all of the searching, the indexing and the searching. Super simple, worked relatively well initially.

Then we wanted to enter the land of the free and we got some new requirements. Americans only want processing to happen within the US, and Europeans only want it to happen within the EU, and Australians only want it to happen within Australia. And so we had to basically move to multiple Elasticsearchs. And what we actually did was we took the entire setup and we just basically iterated over the set that is EU, US and Asia-Pacific. And so we just had this multiplied by three or four. Kind of annoying, lots of overhead, but it got us to where we needed to be.

Then the next iteration of the story is enterprise. So really big banks, the biggest law firms in the world, they have really annoying requirements. And number one they have is they'll ask for full physical isolation of all of their data. There's probably a little bit of a war on what physical isolation actually means, but essentially means they want their own database. They also want customer-managed encryption keys. And what that means is they basically have a Key Vault thing where they have an encryption key and they give us access to read the key and we then use that key to encrypt and decrypt all of their data at rest. And what that gives them is they can just revoke our access to their key and then we can't decrypt their data anymore and so it's safe. And so in a way that gives enterprises a lot of control over all of their data because they control the key to reading it.

So we moved from Elasticsearch to Postgres. And I imagine a bunch of you guys are like, why would you ever put your vectors into Postgres? It actually worked surprisingly well and the reason that we did this was we were already using Postgres for OLTP workloads and so we sort of already had to do this split of multiple Postgreses and multiple blobs. And so it was really easy for us to try to shift all of our search into Postgres as well because then we only have one system. So the setup here was pgvector, specifically DiskANN, and TSVector for the search. So not BM25, which was you know we lost a little bit of retrieval performance there. And what we do is we would partition the table where we would store all the document chunks. We'd partition it super aggressively, like 4,000 partitions, and then each project we'd basically have the project key and we'd binpack them into the partitions.

That actually worked relatively well, but it was expensive and search performance wasn't super good. And what happened was when we scaled a lot, everything just broke and exploded. And so what happened was basically you can imagine like you have a bunch of projects and some of them you spin up a project, you work on it, and then you close it and you basically never go back to it again. And we have a bunch of those where like they never get queried. And we have a bunch that get queried all the time because they're super active projects. And when we pack them into partitions, the cold ones and the hot ones would land on the same ones and the partitions would get really really big.

And so when we query them, Postgres would pull the partition, put it into memory, we do the stuff, and then we create another partition and another partition and it would essentially thrash the cache all the time. And what that meant was our latencies would spike. So we went from like search and ingestion P99 of 100 milliseconds into 20 seconds, which you can imagine is a really bad user experience.

Jacob Lauritzen: So then we went to turbopuffer in about, you know, when we're about I think 400 million documents something like that. And what we did with turbopuffer was we did one namespace per project. And the advantages of moving to turbopuffer is we got BM25, real BM25, much better relevancy, much better latencies, and it was extremely simple to operate because we could just have a single turbopuffer cluster. We didn't have to have a bunch of different ones like with Postgres, and since it's blob-based it could just query the blobs that we had anyway. And so much lower cost, and it was extremely simple to operate, and we didn't have this problem with the partitions because if a project's not used it's just in blob and so it's really easy. And Simon can talk a bit more about why that works so well.

Simon Eskildsen: Yeah. So Legora has some of, and legal in general has, by the way, if Jake and I have similar accents and maybe even look a bit similar, it's because we're both Danish.

Turbopuffer has a particular architecture that supports these kinds of very regulated environments really, really well. But in order to understand that, we have to understand what kind of search engine is Turbopuffer. Why is it different than the ones that they used in the past?

Since the very beginning of Turbopuffer, the design has more or less been the same. There may be changes in the future, but the design has stood the test of time. When you do a write to Turbopuffer, we write directly to object storage. There is no disk replication. There's no Paxos. There's none of that. Direct to S3.

That's the fundamental trade-off in Turbopuffer, right? Hundreds of milliseconds. If you're like Shopify and doing inventory reservations for a Kylie Jenner flash sale, not going to work very good. But for search, because generally when you're doing search doing a slow write is fine as long as the read performance is adaptable and good. So that's what happens on write: it just goes into write ahead log. You can imagine you write 1.json, 2.json, 3.json. Obviously, it's a database, so it's not JSON, but for illustrative purposes, that's what happens. And in the background, we build the vector indexes, the text indexes, the columnar indexes, and so on to satisfy the queries that Jake and other customers have.

So then at query time, the query reaches some namespace. The namespace is kind of our concept of a table. You can think of it as a directory on S3 that's isolated from everything else. We go to the node that is most likely to have it. It could go to any node, right? It could go to every single node and they're all read replicas, but we go with some affinity to the node that has the highest probability of having it in cache. We check the memory cache for any objects, NVMe SSD cache, and then finally to object storage.

Everything in Turbopuffer is optimized around doing as much work in as few round trips as possible. Right? S3 has a P99 on like 1 megabyte blob size of around 200 milliseconds. So, you want to do as few round trips as possible, right? Ideally, you do around three. And everything in Turbopuffer, the database is designed around minimizing the number of round trips. This is also amazing for modern disks. If you do a lot of concurrency and few round trips, you utilize them optimally. And everything in Turbopuffer is designed around this.

So, why is this so good for a company like Legora? Well, object storage native, if you design it around the atomic unit of separation being the namespace or the table, every single table could be encrypted with a different key. Every single namespace could be in a different bucket. We have customers that have thousands of buckets that they have namespaces in so that their customers get the warm IT fuzzies of having the bucket in their own cloud account. They can also be encrypted with their own keys. You can share buckets. You can do whatever configuration that you need at the namespace level. You can re-encrypt with different keys. You can move them around.

For Legora in particular, this was really important for this full physical separation, right? An encryption separation. All of the namespaces needed to be physically at rest with different keys and as separated as possible. S3, GCS, Azure Blob storage, they pass that. And the other parts of the hierarchy also, except the NVMe SSD cache because in the SSD cache we consider that to be volatile like memory, but your customers did not. So what we did was that we thought we were going to implement encryption into the disk cache, but instead we just disabled the disk cache and saw how it fared. And the performance of Turbopuffer even without the disk cache, with just the memory cache, was so good that we just kept it that way for some of the Legora workloads where we couldn't have the disk cache for multi-tenancy. Turbopuffer will support that in the future, but it just goes to show the natural point where Turbopuffer allows this encryption and storage and separation to become fully multi-tenancy native. I'll hand it back to you on what happened then.

Jacob Lauritzen: And then, drum roll please. Latencies look like this. Latency is improved in order of magnitude basically. And these are median latencies. So, P99 were even better. So obviously this is a huge thing when you're doing, I mean one thing is if you're doing a single sort of RAG-style thing, but if you have an agent that does 20 queries, 100 queries, these really really add up.

So that was on the project side and then a more recent thing is legal research. So legal research is kind of a difficult problem and the reason it's difficult is that the corpus is extremely big. So we're racing towards 10 billion vectors and we're growing extremely fast. We also have quite high read. So QPS can spike a lot because we do a lot of fan-out. Like if you do a sort of legal research query, we will fan it out to a bunch of different queries and we'll keep going.

And the reason we do that is we need this heavy filtering because essentially it's a kind of like a graph for a few different reasons. Firstly, it's hierarchical. You have cities, and you have counties, and you have states, and you have federal law, and it's the same all around the world. And so you need to respect that authoritative sort of hierarchy. There's also some temporal validity. So, one judge might overrule a decision that's been made somewhere else and you need to also respect that and figure that out. And then sometimes there's even like a new regulation that has exemptions or special cases of an old regulation. And so if you're finding this one, you need to find all the other ones as well. So you can imagine that it sort of explodes the search.

And so we started on Elasticsearch for this, but also moving to Turbopuffer, Elasticsearch just got extremely expensive because we have to have everything there. But with Turbopuffer we can basically take different jurisdictions and we can make them namespaces in Turbopuffer. And that means some of them, here's an example where like you have the EU that gets queried all the time that's super hot, and some of them, let's say Danish law cuz we're Danish, no one cares really. It's such a small country so it doesn't really get queried and so that can just stay on blob and that's fine. And because it's sort of a deep research style workload, if there's 500 milliseconds latency to fetch that cold blob, that's okay. That's fine. It's not really a big problem. So, the way that Turbo is designed lends itself super well to this super long scale of like cold weird namespaces and a few that are really, really hot. Yeah. And Simon wants to talk more about that.

Simon Eskildsen: Yeah. So I was talking about why the company is called Turbopuffer at another talk here earlier today, but one of the other explanations of the name of Turbopuffer is that it's about puffing into the different memory hierarchies and really mastering when data should be in particular memory hierarchies.

So, you can think about it here, right, of something like the EU law might be more or less part of almost every one of the legal research queries, right? So that probably sits closer to NVMe SSDs in memory, right? The economics kind of change as you move up and down this hierarchy. In memory, you want things that are queried a lot, right? Then the economics of memory are great. NVMe SSDs, you can do a lot of things directly on them, but the economics change as you move up and down this boundary, the latency changes and the way that the database is architected to take advantage of it in terms of round trips versus random versus sequential all changes as you navigate this hierarchy. Turbopuffer is a database that is really designed around the memory hierarchy and all of the smarts in Turbopuffer is that all of these namespaces are puffed in and out of the cache. You can think of this as we want to have as much data pushed as far down in this hierarchy as possible to get the best performance-cost ratios.

So how does that apply to search? Well, for something like vector search for example, there's two fundamental ways to do vector search. One is to basically design a graph. The problem with a graph on something like object storage or disk, again, we want to have things as far down that memory hierarchy as possible. The problem with a graph is you have to navigate from the center of the graph. And then every time you navigate through these nodes, you're doing 200 millisecond P99 to S3, right? And so you're trying to shrink the diameter of the graph, you're trying to do all these tricks to make the graph, but fundamentally you're at odds with the fact that graph is about a random-sequential trade-off that you have in memory and in registers, but not further down the memory hierarchy.

The way Turbopuffer does it is organize it into clusters, right? Vectors you can think of in two dimensions just as points in a massive coordinate system and we can organize them into clusters. Turbopuffer then creates clusters of clusters and clusters of clusters of clusters to essentially organize all of the vector data in a tree. You can basically think of Turbopuffer as a very, very complicated B-tree, right? Because it's a tree on this geometry of this entire space and the clustering of it in an approximate way. Now the root centroids further up the tree you can imagine are part of every single time you search right there. We're always trying to figure out which clusters that we're in and we're always looking at the upper levels of the tree. So they're going to be further up the memory hierarchy, right? Closer to the registers, almost all in DRAM. Now the leaves that have all of the actual legal cases or whatever long document it could be, images, all of that is probably going to be on SSDs with that single 1-millisecond roundtrip at the end. It doesn't make sense to have all that puffed into DRAM. This is fundamentally the cheapest way that you can run a database, period. So for something like Legora or even web search which is in hundreds of billions or tens of billions depending on how much of the web you've scraped, this is fundamentally the cheapest way to do it. And we have customers that are indexing massive parts of the entire web into Turbopuffer, which is really also a part of what legal research is.

Full text is also really respectful of the memory hierarchies. The way text search works is essentially you can think of it as a hashmap. You have a big document and then you take every single one of the tokens and you put them into the key in the hashmap. The value in the hashmap is some set with all of the document IDs that has that term. So then if you search for "New York population", you're finding those three places in the hashmap and then you're taking the three sets and doing an intersect on the sets. While you're intersecting, you're also trying to do some kind of scoring, right? A document that has "York" in it is probably more valuable than a document that has "new" in it because "York" is a more rare word. When people say BM25, this is the scoring that they're referring to.

The art of full-text search is: one, we want to minimize the number of round trips. So first you download the parts of the dictionary that are relevant — round trip one, maybe a round trip before that to index into where the parts of the terms are. And then the second round trip is to get these massive lists. Try to make the list as small as possible by compressing them. But also while you're doing the text search, you're trying to minimize the amount of memory bandwidth that you want to intersect these lists. You can probably imagine that at some point there's a point where you've seen so many documents with "population" and "York" that have much higher scores that documents that just have "new" in it are irrelevant anymore. This is like a mega crash course in how text search works.

And counterintuitively to most people, text search at web scale is more difficult and more computationally expensive than doing vector search. I'll hand it over to you.

Jacob Lauritzen: Cool. So key learnings from what you heard today: retrieval is extremely important to Legora. It's key to legal reasoning. Turbopuffer really excels for us because it makes it extremely easy to operate. We have 70-plus tenants, we have 100, we have 200 tenants. If we had to have separate Elasticsearch databases for each of these, it would be just hell. But we can do this natively with Turbopuffer with data residency and CMEK, etc., etc.

And then it's extremely cost-efficient generally when you have these types of workflows or workloads that we do where there's a long tail of cold indices basically that you don't need to query so much and you're sort of okay paying the small latency cost for it.

So now with Turbopuffer, in 4 seconds to go, now we can focus on making Legora, we can focus on the product, making it really really great, and not on scalability and infra. And also David, our CFO, is really happy about the cost. So, it's great. Thanks everyone.