Embed AI in your product without vendor lock-in.
AI product consulting and security for software vendors and SaaS. We help you bring LLMs into your roadmap: an architecture open to several providers (Anthropic, Mistral, OpenAI, local model), pricing that accounts for token costs without eroding your margin, a documented GDPR processing chain, protection against prompt injection and meeting the AI Act's transparency obligations.
Colombani.ai helps software vendors embed AI in their product without depending on a single model provider. The architecture lets them switch models without interruption, between Anthropic, Mistral, OpenAI or a local model. The cost of calls is controlled and reflected in pricing, each customer's data stays separate, and the agent withstands manipulation. GDPR data processing agreements and AI Act documentation are delivered with the product.
Use cases
Abstraction layer to switch model providers
Abstraction layer that lets you switch between Anthropic, Mistral, OpenAI or a local model without changing your product code. Automatic fallback on provider incidents.
AI feature on customer data (secure RAG)
Semantic search or assistant integration on your customers data, with strict multi-tenant isolation. A tenant can never access another tenant prompts or data.
Token-based billing and margin protection
Pricing models that absorb fluctuations in LLM costs while preserving your margin: per-plan quotas, marked-up pass-through, add-on token packs, prepayment.
Contractual documentation and AI Act
Drafting of terms of service, DPAs, GDPR processing clauses and the notices required by the AI Act (transparency of generative uses, marking of synthetic content). Usable as a basis for your enterprise negotiations.
Ethics and regulatory framework
B2B GDPR, processors and sub-processors
As a vendor, you are a processor for your customers (GDPR Article 28). If you use a cloud LLM, it acts as your sub-processor. Contractual chain to document: client DPA, LLM vendor DPA (Anthropic, Mistral, OpenAI), international transfer if applicable.
AI Act, generative uses and transparency
Since August 2026, obligation to inform the user they are interacting with an AI and to mark synthetic content (art. 50). Colombani.ai helps you build these notices into your product's user journeys.
Requirements specific to your customers' sectors
If your customers are subject to HDS, DORA or PCI DSS, your product must adapt. Colombani.ai identifies applicable requirements and adapts your architecture to be sellable to these regulated customers.
What we don't do
- End-to-end product development: your team keeps the codebase.
- UX design: our deliverables cover the AI features, not the product's overall interface.
- Product marketing: Colombani.ai does not write your commercial positioning.
- External DPO role: Colombani.ai helps your DPO or finds one, never in their place.
How do we work with you?
Solutions: AI agents and security
AI agent plugins and AI security audits (prompt injection, multi-tenant isolation).
Consulting: AI Act compliance
Risk classification of your AI features and expected documentation.
Training: AI for product and engineering teams
Programmes delivered by a Qualiopi-certified provider for PMs, tech leads and engineers integrating LLMs into their product.
Frequently asked questions
How do you handle LLM tokens in SaaS pricing? +
Four models exist. A quota included in each plan, billed beyond it. The real cost passed through with a fixed margin. A free product whose AI features are paid by usage. A flat price with a technical cap. The right choice depends on how much consumption varies across your customers and on your commercial strategy: Colombani.ai settles it at the start of the engagement.
How do you isolate prompts between customers? +
Three layers. First, a session ID injected in every LLM call with isolated context (no history re-sharing). Second, tenant-scoped MCP: tools can only query the current tenant data. Third, validation hooks run after each tool call verify the response contains no data from another tenant. Tested in CI with adversarial scenarios.
Do we need a DPA with Anthropic, Mistral or OpenAI? +
Yes, systematically. Each LLM vendor offers a Data Processing Agreement (GDPR art. 28). Anthropic and OpenAI offer DPAs with zero-training-on-customer-data commitment. Mistral offers dedicated EU instances with adapted DPA. Colombani.ai helps you structure the contractual chain.
Got a project in mind?
Describe your situation. The first 30-minute call is free. Get a frank response within one business day.