Embed AI in your product without vendor lock-in.
AI product consulting and security for software vendors and SaaS. LLM integration into your roadmap with multi-provider architecture (Anthropic, Mistral, OpenAI, local), token pricing and margin, B2B GDPR subprocessor contracts, defence against user prompt injection, AI Act transparency.
Colombani.ai helps software vendors embed AI in their products without becoming captive to a single model provider. Multi-provider architecture with hot-swap (Anthropic, Mistral, OpenAI, local), token management and margin pricing, B2B GDPR subprocessor contracts, multi-tenant prompt isolation, resistance to user prompt injections, AI Act documentation (transparency, generative use). Approach that preserves product sovereignty and commercial latitude.
Use cases
Multi-provider LLM abstraction architecture
Abstraction layer that lets you switch between Anthropic, Mistral, OpenAI or a local model without changing your product code. Automatic fallback on provider incidents.
AI feature on customer data (secure RAG)
Semantic search or assistant integration on your customers data, with strict multi-tenant isolation. A tenant can never access another tenant prompts or data.
Token pricing and SaaS margin
Pricing models that absorb LLM cost variability while preserving your margin: plan-based quotas, marked-up pass-through, optional tokens, prepaid.
Contractual documentation and AI Act
Drafting of ToS, DPA, GDPR subprocessor contracts, AI Act mentions (transparency for generative uses, synthetic content marking). Usable as a basis for your enterprise negotiations.
Ethics and regulatory framework
B2B GDPR — subprocessor and sub-subprocessor
As a vendor, you are a subprocessor of your customers (GDPR art. 28). If you use a cloud LLM, you become a sub-subprocessor. Contractual chain to document: client DPA, LLM vendor DPA (Anthropic, Mistral, OpenAI), international transfer if applicable.
AI Act — generative uses and transparency
Since August 2025, obligation to inform the user they are interacting with an AI and to mark synthetic content (art. 50). Colombani.ai helps formalize this compliance in your product flows.
Compliance inherited from customer sector
If your customers are subject to HDS, DORA or PCI DSS, your product must adapt. Colombani.ai identifies applicable requirements and adapts your architecture to be sellable to these regulated customers.
What we don't do
- End-to-end product development: your team keeps the codebase.
- UX design: our deliverables scope the AI, not the product overall interface.
- Product marketing: we do not write your commercial positioning.
- External DPO role: we help your DPO or find one, never in their place.
How we work with you
Solutions: AI agents & security
AI agent plugins and AI security audits (prompt injection, multi-tenant isolation).
Consulting: AI Act compliance
Risk classification of your AI features and expected documentation.
Training: AI for product and engineering teams
Qualiopi programs for PMs, tech leads and engineers integrating LLMs into their product.
Frequently asked questions
How do you handle LLM tokens in SaaS pricing? +
Four patterns: (1) plan-included quotas with overage in paid tokens, (2) pass-through with fixed margin, (3) freemium with usage-based paid AI, (4) flat pricing with a technical cap. The right choice depends on consumption variance across your customers and your commercial strategy. Colombani.ai scopes this choice at the start of the engagement.
How do you isolate prompts between customers? +
Three layers. First, a session ID injected in every LLM call with isolated context (no history re-sharing). Second, tenant-scoped MCP: tools can only query the current tenant data. Third, post-tool validation hooks verify the response contains no data from another tenant. Tested in CI with adversarial scenarios.
Do we need a DPA with Anthropic, Mistral or OpenAI? +
Yes, systematically. Each LLM vendor offers a Data Processing Agreement (GDPR art. 28). Anthropic and OpenAI offer DPAs with zero-training-on-customer-data commitment. Mistral offers dedicated EU instances with adapted DPA. Colombani.ai helps you structure the contractual chain.
Discuss your project
First call is free. Straight answer on what is feasible and what is not within your ethics framework.