Generative AI: SaaS

Generative AI in SaaS

Every SaaS roadmap now has an AI line on it, and every enterprise security questionnaire now has an AI section. We build copilots and agents that work inside your product's tenancy model, act only through your own API and permissions, keep token costs inside your margins, and ship with evaluation and logging that let you answer the next customer's AI questionnaire in an afternoon.

Get a free assessment SaaS software

Key highlights

We build in product copilots, agents that act through your API, MCP servers for your product, support automation and natural language analytics.
Retrieval and tools run with the user's own tenant and permissions, so the AI can never see or change data the user could not.
Per tenant token budgets, caching and model routing keep AI costs predictable enough to price into your plans.
Every feature ships with a golden dataset harness that runs in CI, so model upgrades and prompt changes cannot silently break it.
A measured prototype usually takes about 4 weeks, and a production AI feature 8 to 16 weeks.

Why SaaS AI features stall

Shipping an AI demo inside a SaaS product takes a week. Shipping one that is tenant safe, affordable at scale and good enough that customers keep using it is where most teams get stuck.

Cross tenant leaks through the vector index. Embeddings for every customer sit in one index and the tenant filter is applied in application code. One missed filter and a copilot quotes another customer's documents.

Token costs that eat the margin. A few heavy users on the base plan run long agent loops on the most expensive model. The AI feature is popular and loses money on every account that uses it.

Quality that drifts with every change. A prompt tweak fixes one complaint and breaks three other cases nobody tested. Without an evaluation set, every model upgrade is a gamble.

Enterprise deals stuck on AI questions. Security reviews now ask which model providers you use, whether customer data trains models, where it is processed and how prompt injection is handled. Sales has no written answers.

Agents with too much power. An agent with an admin API key can do anything, so it either ships with dangerous access or is locked down until it is useless.

A chat box nobody opens. The AI feature is a generic chat panel bolted onto the side of the product. It does not know the screen the user is on or the task they are doing, so usage drops after launch week.

Use cases

Generative AI use cases we build for SaaS

Each use case is built into your product's data model, permissions and billing rather than bolted on as a separate widget.

In product copilot

Context aware assistance on the screen the user is working on: drafting, summarising and explaining records, with RAG over the tenant's own data and your help centre, citations to the source, and every action proposed for the user to confirm.

Agents that act through your API

Tool using agents built on LangGraph or the Claude Agent SDK that call your own public API with the user's permissions, so the agent can do exactly what the user can do and nothing more, with confirmation gates on destructive actions.

MCP server for your product

A Model Context Protocol server that exposes your product's resources and actions to Claude, ChatGPT and other MCP clients, with OAuth, scoped tokens, rate limits and audit logging, so customers can use your product from the AI tools they already have.

Support triage and drafting

Inbound tickets are classified, routed and given a first draft reply with cited help centre and account context. Agents review and send, and gaps in the docs are surfaced from questions the AI could not answer.

Natural language analytics

Users ask questions about their own data in plain English and get validated, read only SQL scoped to their tenant, with the query and chart shown so the answer can be checked rather than trusted blindly.

AI assisted onboarding and import

Messy CSVs, spreadsheets and exports from competitor tools are mapped to your schema by an LLM with structured outputs, validated and previewed before import, cutting time to value for new accounts.

How we deliver

From one feature to a governed rollout

01
Use case discovery and data readiness
We look at where users get stuck, what data each tenant has, and how your tenancy, permissions and billing work. Output: a written scope, a cost model per tenant and acceptance criteria for the first feature.
02
Evaluation harness and prototype
A golden dataset of real, anonymised tasks is built with your product team, then two or three models are tested for quality, latency and cost per task. The harness runs in CI from this point on.
03
Guarded beta with users in the loop
The feature ships behind a flag to design partners, with thumbs up and down feedback, full tracing, cost caps and confirmation on any action. Real usage is added to the golden set.
04
Production rollout with monitoring
General availability with per tenant budgets, model routing, caching, and dashboards for quality, adoption and cost per account. Models are reviewed as new versions ship and swapped behind a thin abstraction.

AI governance for SaaS

For SaaS companies, AI governance is mostly procurement readiness: tenant isolation, sub-processors, data use and security against prompt injection. We build the controls once and document them in the language enterprise buyers use.

SOC 2 control mapping ISO/IEC 42001 awareness EU AI Act transparency duties GDPR and UK GDPR CCPA and CPRA OWASP Top 10 for LLM Applications HIPAA eligible architecture EU data residency

Tenant isolation extends to the AI. Vector search is filtered by tenant in the database with PostgreSQL row level security on pgvector, or with separate namespaces per tenant, and tools run with the calling user's token rather than a service key. Automated tests prove that cross tenant retrieval fails closed, the same way we test the rest of the product.

Sub-processors and data use are written down. Each model provider goes into your sub-processor register with its region, retention setting and no training terms. EU customers can be served from EU endpoints, regulated tenants from self hosted models, and the documentation is ready for SOC 2 evidence and enterprise security questionnaires.

Transparency and security by default. The EU AI Act requires that people are told when they are interacting with an AI system and that certain AI generated content is marked. We label AI features and outputs clearly, defend against the OWASP Top 10 for LLM Applications including prompt injection and excessive agency, and log every prompt and tool call for audit.

Models and tooling we use for SaaS AI

Portable by design: thin model abstractions so providers can be swapped, framework agnostic evaluation, and the same multi tenant infrastructure as the rest of your product.

Claude GPT Gemini Llama and Qwen (self hosted) Claude Agent SDK LangGraph Model Context Protocol PostgreSQL and pgvector Qdrant and Pinecone Langfuse and LangSmith Stripe usage metering Node.js, TypeScript and Python

FAQ

Common questions

How much does it cost to add generative AI to a SaaS product?

It depends on the feature and how many integrations it needs, so we start with a fixed price prototype and price production from a written scope. Equally important is running cost: we model token cost per tenant before build and add budgets, caching and model routing so the feature fits your plan pricing. You get a written estimate within 48 hours, and our pricing page explains how engagements are structured.

Will our customers' data be used to train AI models?

No. We use model endpoints with no training on customer data and retention minimised or disabled, list each provider as a sub-processor with its region, and offer EU or self hosted models for customers who need them. You get written answers you can reuse in security questionnaires.

How do you keep AI features accurate as models change?

With an evaluation harness that runs in CI. Every feature has a golden dataset of real tasks with acceptance criteria, and every prompt, model or retrieval change is scored against it before release. Production traces and user feedback feed new cases into the set, so quality is tracked rather than assumed.

How long does it take to ship an AI feature in a SaaS product?

Usually 8 to 16 weeks. A measured prototype takes about 4 weeks, followed by a beta with design partners behind a feature flag and then general availability. Agentic features that take actions sit at the longer end because of permission and confirmation design.

Should we build AI features ourselves or use an off the shelf AI widget?

Use a widget for generic help centre chat if that is all you need. Build when the AI has to use your data model, respect your permissions and tenancy, take actions in your product or become part of your pricing, because those are the parts a third party widget cannot do well and the parts that differentiate your product.

Should we build an MCP server for our product?

Often yes, if your customers already work in AI assistants. A Model Context Protocol server lets Claude, ChatGPT and other MCP clients use your product's data and actions with the user's own permissions. It reuses your public API, so it is usually a modest addition once authentication, scopes and rate limits are designed properly.

Keep exploring

Related services and industries

Free consultation, no commitment

Ready to ship AI your customers keep using?

Tell us about your product and the feature you have in mind. Written scope, timeline and cost estimate within 48 hours.

Book a free consultation All industries