AI Toolkit Cheat Sheet

A practical guide to AI tools, costs, and resources for small business owners and solopreneurs.

Crystallized Intelligence ยท Last reviewed 5 August 2026

Section 01

Low-Code Workflow Platforms

Build AI-powered automations visually: no need to learn Python, LangChain, or any programming framework. Drag, drop, connect.

PlatformPricingSelf-Hosted?Best ForEU Notes
n8nFree (self-hosted), Cloud from โ‚ฌ24/moโœ“Technical users who want full control; 400+ integrationsCan be self-hosted on EU servers
MakeFree tier, then from โ‚ฌ10.59/moโ€“Visual thinkers; great UI, strong app ecosystem๐Ÿ‡จ๐Ÿ‡ฟ EU data centres available
PipedreamFree tier, then from $29/moโ€“Developers comfortable with light codeUS
ZapierFree tier, then from โ‚ฌ19.99/moโ€“Beginners; simplest interface, 7,000+ appsUS, some EU processing
ActivepiecesFree (self-hosted), Cloud from $5/moโœ“Open-source Make alternative; growing fastCan be self-hosted on EU servers
Recommendation: Start with Make if you want ease of use with EU data residency. Move to n8n when you need more control. And if you'd rather not build this yourself, we design and run these orchestration workflows for you.

Section 02

API Routers & Orchestrators

A single gateway to access multiple AI models. One API key, switch between models easily, and keep your data in the EU.

PlatformWhat It DoesPricingEU Compliance
EUrouterEU-sovereign AI routing; drop-in OpenRouter replacementPay-per-use๐Ÿ‡ช๐Ÿ‡บ Data stays in EU
Requesty EU140+ models, zero cross-border transfer, Frankfurt-hostedPay-per-use๐Ÿ‡ช๐Ÿ‡บ GDPR Art. 44, ISO 27001
EuqaiEU-native router with intelligent model selectionPay-per-use๐Ÿ‡ณ๐Ÿ‡ฑ Hosted in Netherlands
OpenRouterLargest model selection (200+)Pay-per-useNote: EU routing by request only
Why use a router? You avoid vendor lock-in, can compare models easily, and European routers keep your data within EU borders, important for GDPR compliance.

Section 03

Best AI Models by Task

You don't need the biggest model for every job. Here's what works best for common small business tasks. Prices below are input cost per million tokens, taken from each provider's own pricing page on 5 August 2026; this is the fastest-moving table on the page, so check the link before you budget on it.

General Text (emails, summaries, content drafts)

ModelProviderCost / 1M inNotes
Mistral Small 4Mistral AI ๐Ÿ‡ซ๐Ÿ‡ท$0.15Open weights; the sensible default for everyday tasks and European languages
Mistral Large 3Mistral AI ๐Ÿ‡ซ๐Ÿ‡ท$0.50Strong quality-per-euro; currently cheaper than Medium 3.5
Mistral Medium 3.5Mistral AI ๐Ÿ‡ซ๐Ÿ‡ท$1.50Mistral's frontier model; powers Vibe. Best European option for hard tasks
Claude Haiku 4.5Anthropic ๐Ÿ‡บ๐Ÿ‡ธ$1.00Fast and cheap; good for high-volume classification and summarising
Claude Sonnet 5Anthropic ๐Ÿ‡บ๐Ÿ‡ธ$2.00 โ†’ $3.00Excellent for nuanced writing and analysis. Introductory price runs to 31 August 2026, then $3
Model names and prices churn every few weeks; the flagship you pick today will have a successor before your project ships. That is an argument for an API router and a provider-agnostic setup, not for picking the perfect model.

OCR (Reading documents, invoices, scanned PDFs)

Model / ServiceTypeBest For
Mistral OCR 4API (commercial) ๐Ÿ‡ซ๐Ÿ‡ทBest all-round document understanding; $4 per 1,000 pages
Google Document AIAPI (commercial)Strong layout detection
Azure Document IntelligenceAPI (commercial)Best for invoices and forms
PaddleOCR 3.5Open SourceSelf-hosted, 100+ languages, free
olmOCR-2-7BOpen SourceState of the art for scanned docs
One step further: extracting the text is usually only the beginning; the real value comes from turning documents and data into searchable knowledge systems your team can query.

Speech-to-Text (Transcription)

Model / ServiceTypeBest For
Mistral VoxtralAPI + Open Source ๐Ÿ‡ซ๐Ÿ‡ทEU-sovereign; outperforms Whisper on European languages
Whisper Large V3 TurboOpen SourceBest overall open-source STT; 50+ languages
Deepgram Nova-3API (commercial)Best real-time; lowest latency
ElevenLabs Scribe v2API (commercial)99 languages, excellent diarisation
Google Chirp 3API (commercial)100+ languages

Section 04

Coding Harnesses

When someone says "I use Claude Code," they are naming two things at once. There is the model, the intelligence, and there is the harness, the program wrapped around it that gives the model hands: it reads your files, writes changes, runs commands, remembers what it already tried, and decides when to stop and ask you something.

This distinction is worth holding onto, because the two are separate purchases. The same model behaves very differently in two harnesses, and it is the harness, not the model, that determines where your code and prompts are sent. If sovereignty matters to you, this is the layer where you win or lose it.

HarnessOpen sourceModels it runsWhat you payBest for
Claude Code
Anthropic ๐Ÿ‡บ๐Ÿ‡ธ
NoClaude, but on the cloud and region you pick. Other models via a gateway (see below)Included with Claude Pro/Max ($20โ€“$200/mo), or API pay-per-useThe most polished option. Best if you want it to simply work and you are happy staying on Anthropic
opencode
Community
Yes (MIT)Any: 75+ providers, including Mistral and local OllamaFree; you pay your model provider directlyModel freedom. Swap providers with a config change instead of a migration
Mistral Vibe
Mistral AI ๐Ÿ‡ซ๐Ÿ‡ท
Open weights, closed appMistral (Medium 3.5, Devstral)Free tier; paid plans and API usageThe sovereign default: European company, European hosting, chat and coding agent in one tool
Codex CLI
OpenAI ๐Ÿ‡บ๐Ÿ‡ธ
YesGPT familyChatGPT Plus/Pro sign-in, or an OpenAI API keySandboxed execution by default; teams already paying for ChatGPT
Aider
Community
YesAny (Claude, GPT, Mistral, local Ollama)Free; you pay your model provider directlyGit-native. Every change lands as its own descriptive commit, so undoing one thing is easy
Gemini CLI
Google ๐Ÿ‡บ๐Ÿ‡ธ
Yes (Apache 2.0)GeminiAPI key or Vertex AI. The free consumer tier closed in June 2026Very large context windows; teams already on Google Cloud
Copilot CLI
GitHub ๐Ÿ‡บ๐Ÿ‡ธ
NoMulti-providerCopilot subscription from $10/moDeep GitHub integration: pull-request aware, useful if your work already lives there
The sovereign route. Two honest options. Use Mistral Vibe directly: French company, EU hosting, nothing to configure. Or run opencode or Aider pointed at Mistral's La Plateforme, using Devstral 2 or Codestral for code. Either way your source and your prompts stay on EU infrastructure. A third option, if you are attached to Claude Code: keep it, and point it at an EU region on Bedrock, Google's Agent Platform, or Microsoft Foundry: same tool, inference inside the EU.

The fully local option is Ollama behind opencode or Aider: nothing leaves your machine, no per-token cost at all. The trade is real: you need a decent GPU or a recent Mac, and small local models are noticeably weaker than frontier ones. Good for sensitive code, frustrating for hard problems.

Scaleway, and the prompt-caching trap. Scaleway is a French cloud provider serving open-weight models from French data centres: GLM-5.2, the Qwen3.5 and 3.6 family, Mistral, Pixtral. Several of these genuinely compete with frontier models on coding and agentic work, which makes it one of the strongest fully European options available.

The catch is worth understanding before you commit, because it is not obvious from the per-token price. Scaleway does not currently offer prompt caching. An agent resends the whole conversation (your files, its earlier reasoning, every tool result) on every single turn, and providers that cache normally charge around a tenth of the input price for the repeated part. Without that discount you pay full price for the same context, over and over, and a long agent session gets expensive far faster than the headline rate suggests.

The practical rule: excellent for one-shot and batch calls, where each request stands alone. Watch your spending carefully if you point a coding agent at it and leave it running.

You are not stuck with the model your harness ships with

Worth knowing before you pick, because it undercuts the usual "Claude Code means Anthropic, full stop" assumption. There are two separate escape hatches, and they are not equally supported.

1. Same model, your choice of cloud and region. This one is official and documented. Claude Code can run against Amazon Bedrock, Google Cloud's Agent Platform (formerly Vertex AI), or Microsoft Foundry instead of Anthropic's own API: you set an environment variable and pick your region. You are still using Claude, but the inference happens in the region you chose, under your existing cloud contract and its data-processing terms. For a European organisation that already has an EU region on one of those clouds, this is the straightforward way to keep an agentic coding tool inside your compliance perimeter.

2. A different model entirely, through a gateway. Claude Code talks to whatever address you put in ANTHROPIC_BASE_URL. Point that at a translation proxy (LiteLLM is the common choice) and the proxy converts between Anthropic's API format and whatever is behind it: Mistral, an open-weight model, or Ollama on your own machine. You keep the harness you like and swap the intelligence underneath it. Claude Code even lists gateway-served models in its model picker.

The honest caveat on route 2. This is a community pattern, not a supported configuration; nobody promises it keeps working after an update, and behaviour tuned for one model does not automatically transfer to another. A proxy is also a new dependency sitting directly in the path of your API keys, so treat it like any other supply-chain decision: pin the version, check the project is actively maintained, and do not install it casually on a machine holding production credentials.

Choosing one, in a sentence each

  • You want the least friction and you are not price-sensitive: Claude Code.
  • You want to keep your options open: opencode. The provider is a line of configuration, so next year's better model is a five-minute change.
  • You handle client or personal data, or sovereignty is contractual: Mistral Vibe, or opencode pointed at Mistral. If you are already committed to Claude Code, running it against an EU region on Bedrock, Google's Agent Platform, or Foundry gets you most of the way there.
  • You are nervous about an agent touching your files: Aider. Every edit is a separate git commit, so reverting is one command.
  • Your whole team already lives in GitHub: Copilot CLI.
One thing that transfers between all of them: MCP. The Model Context Protocol is a shared standard for connecting a harness to outside tools: your calendar, a database, a document store. Every major harness above speaks it, so a tool you set up once keeps working when you change harness. Where you can choose a standard over a proprietary integration, choose the standard.
What a harness is not. It is not a senior developer. It will write code confidently that is subtly wrong, and it is agreeable by design: if you ask "is this secure?" it will often tell you what you want to hear. Read the changes before you merge them, keep the work in git so you can always walk backwards, and never let it read your .env file. See the security questions below before any of this touches real users.

Claude Skills Worth Stealing for Any Model

A Claude Skill is a folder with a SKILL.md file (plain markdown instructions) and optional bundled scripts. The format is portable: you can drop the same instructions into opencode with Mistral, Aider, or Gemini CLI; you just lose Claude's automatic loading. Below are six worth borrowing.

SkillWhat it doesWhere it's from
frontend-designBuilds polished UI that avoids generic "AI slop" aesthetics: strong taste, real CSS, considered typographyanthropics/skills
gdpr-complianceAudits code for GDPR issues, drafts privacy notices and DPAs, answers compliance questions with article citationsorazionelson/gdpr-compliance-claude-skill
video-useEdits video by conversation: transcribe, cut, colour grade, burn subtitles. No menus, no presets.browser-use/video-use
systematic-debuggingDisciplined reproduce โ†’ minimise โ†’ hypothesise โ†’ fix loop for hard bugs and performance regressionsobra/superpowers
code-reviewReviews a pull request against the plan and your coding standards: catches what self-review missesanthropics/claude-plugins-official
rememberPersists session state so the next conversation picks up with full context: buffer, daily, recent, archivethedotmack/claude-mem
How to use a Claude Skill in another tool (opencode, Aider, Mistral Vibe):
  1. Clone or download the skill folder from GitHub.
  2. Open SKILL.md: everything below the YAML frontmatter is plain English instructions.
  3. Paste those instructions into your tool's system prompt, or reference the file directly: "Follow the instructions in skills/gdpr-compliance/SKILL.md when reviewing this code."
  4. If the skill bundles scripts (Python, shell), they run on your machine regardless of which model called them.

You lose Claude's automatic "decide when to invoke" behaviour: other models will treat the skill as a suggestion rather than an imperative. Tell them explicitly when to use it.

Section 05

What Does AI Actually Cost?

Real examples with real numbers. Spoiler: it's probably less than you think.

AI API costs are measured in tokens (chunks of text). Rough guide: 1,000 tokens โ‰ˆ 750 words. A typical email is about 200โ€“400 tokens.

Weekly Event Digest

Process 20 event descriptions, generate a categorised summary once a week

~$0.06/year
Using Mistral Small 4

Customer Email Summarizer

Process 50 emails/day, generate daily summaries

~$10/year
Using Mistral Medium 3.5: about $1/year on Small 4

Transcribe a 1-Hour Meeting

Whisper (self-hosted): Free
OpenAI API: ~$0.36/hr
Deepgram Nova-3: ~$0.46/hr
Mistral Voxtral: EU-hosted option

Free โ€“ $0.46
Depends on provider

Coding with a Harness

The one AI cost that is not loose change. A subscription is predictable; pay-per-use scales with how hard you drive it

$20โ€“200/month
Subscription, or API usage at similar order of magnitude
Bottom line: For the automation use cases most small businesses start with, API costs are negligible: often less than a coffee per month. Two things do cost real money: an agentic coding tool used daily, and your own time building and maintaining the workflows. Budget for those, not for tokens.
Based in Luxembourg? The State co-funds 70% of an eligible AI project, up to โ‚ฌ17,500. See AI funding in Luxembourg for what qualifies and how to apply.

Section 06

Low-Code Web & App Builders

Need a frontend for your AI workflow? These let you create web apps, portals, and dashboards without coding.

PlatformStarting PriceBest ForConnects To
SoftrFree, then $49/moClient portals, internal tools, simple web appsGoogle Sheets, Notion, Xano
WeWebFree, then โ‚ฌ29/moMore design control; beginner-friendlySupabase, Xano, REST APIs
Recommendation: Start with Softr: it's the fastest path from idea to working app.

Section 07

European AI Resources & Directories

ResourceWhat It IsLink
European AI AtlasDirectory of EU-made AI tools and servicesaiatlas.eu
AI4Europe (AIoD)EU-funded AI-on-demand platformai4europe.eu
Mistral AILeading European LLM provider ๐Ÿ‡ซ๐Ÿ‡ทmistral.ai
InfomaniakSwiss hosting with built-in AI tools ๐Ÿ‡จ๐Ÿ‡ญinfomaniak.com
LuxinnovationLuxembourg's national innovation agencyluxinnovation.lu
SME Packages โ€“ AILuxembourg State co-funding: 70% of an eligible AI project ๐Ÿ‡ฑ๐Ÿ‡บguichet.public.lu
Scaleway Generative APIsOpen-weight models served from French data centres ๐Ÿ‡ซ๐Ÿ‡ท: no prompt caching, so watch agent costsscaleway.com
OllamaRun open-weight models locally: nothing leaves your machineollama.com
Two of ours, if useful: AI funding in Luxembourg explains the co-funding process end to end, and AI Act readiness covers which EU AI Act obligations actually apply to a small organisation; the transparency rules have been live since 2 August 2026, and they catch anyone running a chatbot or publishing AI-generated media. If that co-funding looks relevant to your business, see how we work with SMEs in Luxembourg.

Section 08

Learning Resources

ResourceWhat You'll LearnFormat
Elements of AIThe fundamentals of AI: what it is, how it works, where it's goingFree online course ๐Ÿ‡ซ๐Ÿ‡ฎ
promptingguide.aiHow to write effective promptsFree online guide
n8n.io/coursesBuilding workflows in n8nFree video courses
CI NewsletterCurated AI news for businessDaily or weekly email
crystallized.lu/gemsAI concepts explained simplyBlog posts
make.com/academyMake platform tutorialsFree courses
Mistral AI DocsUsing Mistral's models and APIDocumentation

Section 09

Quick Decision Guide

Pick what you want to do, get a starting point.

"I want to automate a repetitive task" Make or n8n + an AI model

Start by picking a single task that's eating your time: sorting incoming emails, tagging leads, copying data between Google Sheets and your CRM, generating weekly reports. Don't try to automate everything at once.

In Make or n8n, you build the workflow visually: a trigger (new email, form submission, scheduled time) โ†’ a processing step that calls an AI model to classify, summarize, or draft โ†’ an action (update the sheet, send a Slack message, file the document). Make is friendlier for beginners and has EU data centres. n8n gives you more control and can be self-hosted on your own EU server for full data sovereignty.

Both have free tiers that are enough to get started. A typical first workflow takes 30โ€“60 minutes to build and saves several hours per week from day one.

Non-technical shortcut: you can ask an AI chat (Claude.ai or Mistral Vibe) to build the whole workflow for you as an importable JSON file. Describe in plain English what you want: what triggers it, what data to pull, what the AI should do with it, where the result goes, and ask for the finished n8n JSON. Then in n8n: open a new workflow โ†’ click the โ‹ฏ menu โ†’ Import from File (or paste the JSON directly onto the canvas). The entire workflow appears with nodes pre-wired, ready for you to plug in your credentials.

Example prompt you can copy, paste, and adapt:

I want to build a workflow in n8n that helps me keep track of what's happening in Luxembourg's networking scene, so I don't have to check the Network website every week.

Here's what I'd like it to do:

  1. Go to https://thenetwork.lu/events/events-calendar/ and grab the page.
  2. Pull out the useful bits for each event: the title, date, time, whether it's online or in person, where it is, a short description, and the link.
  3. Send those events to an AI model to sort and summarise them into a weekly digest aimed at busy small business owners. I'd like the events grouped into three buckets:
    ๐Ÿ”ฅ High relevance: technology, leadership
    ๐Ÿ“‹ Worth knowing: workshops, training, networking
    ๐Ÿ˜ธ Fun: drinks and aperos
  4. Email the digest to me via Gmail.

A few setup notes:

  • I'm using n8n cloud.
  • For the AI step, I'm calling Mistral through OpenRouter, with Bearer token auth. The model is mistral-medium-3.
  • I am non-technical. I need everything as set up as possible with clear instructions on how to attach my OpenRouter and Gmail credentials.
  • Please use as few steps as possible. Simplify where it makes sense.
  • Please give me the finished workflow as a JSON file I can import straight into n8n.
"I want to summarize or draft content" Mistral Vibe (EU, free tier) or Claude.ai

Both are free chat interfaces with no setup: open the link in your browser, sign up, and start typing. Paste your text and describe what you want: "summarize in 3 bullets," "rewrite in a formal tone," "extract the action items from this meeting."

Mistral Vibe is EU-hosted in France, GDPR-native, and fastest for European languages (French, German, Spanish, Italian, etc.). Claude.ai is stronger for nuanced writing, very long documents (a 1M-token context window, roughly 750,000 words), and structured reasoning tasks like reviewing contracts or analyzing spreadsheets.

The free tiers are enough for occasional use. Paid plans (~โ‚ฌ20/month) unlock the most capable models, longer documents, and higher daily limits.

"I want to transcribe meetings" Whisper (free) or Deepgram

You have three realistic routes, depending on how technical you want to get and whether the recording needs to stay private:

1. Free, on your own computer (most private): Install Whisper locally. Technical users run it as a Python command (whisper recording.mp3 --model medium.en). Non-technical users can use a friendly desktop app like MacWhisper (Mac) or Buzz (Mac/Windows/Linux): drag, drop, transcribe. Nothing ever leaves your device.

2. Free through a chat tool: Upload the audio to Mistral Vibe or Claude.ai and ask it to transcribe and summarize in one step. Fastest for one-off recordings, but the audio leaves your device.

3. Paid API (best for high volume or live): Deepgram Nova-3 is faster, more accurate with accents, and supports real-time captions. Around โ‚ฌ0.40/hour: call it from Make or n8n in an automated pipeline.

"I want to read & process documents" Mistral OCR or Google Document AI

For one-off scans or simple PDFs: upload the file to Mistral Vibe or Claude.ai and ask for the extracted text, tables, or specific fields. Free, instant, no setup.

For automated pipelines (invoices arriving daily, an archive of documents to digitize, contracts to process): call the Mistral OCR API from a Make or n8n workflow. It handles complex layouts, tables, and multi-language documents in one pass. EU-hosted.

For structured field extraction (invoice number, VAT, dates, line items into a database): Google Document AI has pre-trained "processors" for invoices, receipts, IDs, and forms. Azure Document Intelligence is the comparable Microsoft offering: strongest for forms.

"I want to build a client portal" Softr with built-in tables

Softr lets you ship a login-protected client portal in an afternoon. Use their built-in database (no separate tool needed) or connect an existing Google Sheet, Airtable, or Notion workspace. Out of the box you get user authentication, per-client content, file uploads, forms, and a clean mobile-friendly design.

The free tier covers small portals. The โ‚ฌ49/month plan unlocks custom domains, more users, and payment gating. If you want more design control or custom interactions, WeWeb is the next step up: still no-code, but closer to a full web framework.

Typical starter build: client login โ†’ dashboard with their projects/invoices โ†’ file upload area โ†’ contact form. One afternoon, zero code.

"I want to stay GDPR-compliant" EUrouter or Requesty EU + Mistral

Two practical rules: keep the data inside the EU, and prefer EU-hosted models.

Route your API calls through EUrouter or Requesty EU instead of OpenRouter. Both are Frankfurt-hosted with zero cross-border transfer, meaning your customer data never touches US servers, even in transit.

Pick Mistral models as your default. French-hosted, GDPR-native, and competitive on quality. Reserve US-hosted models (Claude, GPT) for tasks that don't involve personal data, or only after you have a signed DPA in place.

Document it. Add your AI tools to your processing register (GDPR Art. 30), note where each provider hosts data, and include them in your privacy policy. For platforms like Make, choose the EU data region at setup: it's a one-click decision that's much harder to reverse later.

"I want to connect multiple AI models" Use an API router (see Section 02)

Instead of juggling separate accounts, API keys, and monthly bills with OpenAI, Anthropic, Mistral, Google, and the rest, use one router. You get a single API key, one dashboard, one invoice, and can swap between models by changing a single string in your workflow or code.

OpenRouter has the largest selection (200+ models) but is US-based. EUrouter and Requesty EU are the EU-sovereign alternatives, fewer models, but your data stays in Europe.

All are pay-per-use: no monthly fees, no minimums. You only pay for tokens actually used. For a typical small-business workload, that's usually a few euros per month.

Not sure which path fits your team? Book a free pre-discovery call and we'll map it with you.

Section 10

The Thirteen Layers of Building a Real App

Vibe coding gets you to a prototype quickly. Shipping it to real users is the iceberg under the waterline. Here are the thirteen layers that exist whether you think about them or not: what each is, when it starts mattering, and a starter-friendly tool or pattern for each.

1. Frontend foundations

What users see and click: the HTML, CSS, and JavaScript running in their browser.

When it matters: always.

Starter pattern: React, or plain HTML for a one-pager. Pick a UI kit; don't reinvent buttons.

2. APIs and backend logic

The server code that handles requests from the frontend.

When it matters: as soon as your app does anything beyond static content.

Starter pattern: Express on Node, FastAPI on Python, or Supabase to skip writing a server.

3. Database and storage

Where data persists between sessions.

When it matters: as soon as you have users with accounts, saved content, or anything that survives a refresh.

Starter pattern: Postgres. Supabase or Neon offer Postgres as a service.

4. Auth and permissions

How users log in. Who can do what.

When it matters: the moment you have more than one user.

Starter pattern: Clerk, Auth0, or Supabase Auth. Don't roll your own.

If you must roll your own: hash passwords with bcrypt or argon2: never plain text, never MD5/SHA. You'll also need secure session cookies (HttpOnly, Secure, SameSite), CSRF protection, a password-reset flow with single-use tokens, login rate limiting, and ideally TOTP for 2FA (otplib). That's the minimum, and why most people use Clerk.

5. Security and row-level security

Making sure user A can never read or modify user B's data, even if there's a bug elsewhere.

When it matters: the moment two users share an app.

Starter pattern: Postgres Row-Level Security (RLS) policies. Built into Supabase.

6. Rate limiting

Stopping abusive traffic: bots, brute-force login attempts, runaway scripts.

When it matters: before your first public deploy.

Starter pattern: Cloudflare's free tier, or express-rate-limit on Express.

7. Caching and CDN

Making your app feel fast for users far from your server.

When it matters: once you have international users or static assets.

Starter pattern: Cloudflare or BunnyCDN in front of your app.

8. Hosting and deployment

Where your code actually runs in production.

When it matters: the day you want anyone to use your app.

Starter pattern: Scaleway, Hetzner, or Fly.io for a real server. Vercel or Netlify for static frontends.

9. Cloud and compute

The underlying machine: CPU, RAM, disk.

When it matters: when you outgrow shared hosting or want predictable performance.

Starter pattern: a single Scaleway or Hetzner VM is enough for years for most small SaaS.

10. CI/CD and version control

Git for tracking changes. CI for running tests automatically. CD for deploying when tests pass.

When it matters: from day one for git; CI/CD when you have anyone else on the team or any tests worth running.

Starter pattern: GitHub + GitHub Actions. Sovereign alternative: self-hosted GitLab on a Scaleway or Hetzner VM, with GitLab CI built in.

11. Load balancing and scaling

Spreading traffic across multiple servers when one isn't enough.

When it matters: when you genuinely have too much traffic for one box. Most small apps never reach this.

Starter pattern: wait until you need it, then add a managed load balancer.

12. Error tracking and logs

Knowing your app is broken before users tell you.

When it matters: before your first public deploy.

Starter pattern: Bugsink (self-hosted, Sentry-compatible) for errors, or Sentry's SaaS if you don't want to host. Better Stack or Logtail for logs.

13. Availability and recovery

Backups. Restore procedures. What happens when the server dies.

When it matters: before you have a single paying customer.

Starter pattern: daily Postgres backups to Scaleway Object Storage or Infomaniak Swiss Backup. Test restoring them once a quarter.

The non-negotiable minimum before your first user: layers 1, 2, 3, 4, 5, 6, 8, 9, 10, 12, and 13. The rest (CDN, scaling) can wait until traffic or complaints tell you it's time. If the iceberg looks like too much, we build and maintain production apps end-to-end.

Section 11

Six Security Questions Before You Take On Live Users

You need to be able to answer these six questions about your own product.

1. Where does the data live? EU vs. US

Picking an EU host (Scaleway, Hetzner, OVH) keeps you out of cross-border-transfer trouble. See Hosting for starter options.

2. What do you actually store? Less collected = less to leak

Audit your own forms. Don't collect a birthday you'll never use.

3. Who can see it? Authentication and access control

One sentence each on a checklist: who is logged in, what role they have, what records that role can touch. Row-Level Security in Postgres makes this enforceable, not just policy.

4. Can users get their data out, or delete it? Access, rectification, erasure, portability

GDPR in four verbs. Build a "download my data" and "delete my account" path before launch; they're easier to add early than retrofit.

5. What do you tell people you're doing? A privacy notice in plain English

Before the cookie banner. Name your sub-processors (hosting, AI APIs, email tools). Plain language beats legalese every time.

6. Are your secrets kept out of the AI? Keep .env away from your coding tool

Don't share your .env file with your AI coding tool. Keep secrets separate, or swap to real values manually before launch.

Section 12

Two Shortcuts to MVP

Some wheels aren't worth reinventing. Two shortcuts that save weeks of work.

PostProxy

One API connects you to Instagram, TikTok, LinkedIn, Facebook, and X. No per-platform OAuth, no quirks. You pay them; they handle the messy parts.

Progressive Web Apps (PWAs)

A web app that installs to a phone's home screen from the browser. Feels native. No app store, no native code, no store review. One codebase. For most small-business products, this is enough to launch.

Need help getting started with AI?

Get in touch