How AI4SMB Insights is built

The system that powers the platform, in plain terms.

Presentation

Next.js 16 (App Router) with React 19 and Tailwind CSS, server-rendered, deployed on a global edge network; internationalized English / Simplified Chinese.

Available through an ordinary browser; no installation or account required.

Application services

A set of stateless API services covering generation, segmentation, the conversational strategist, post formatting, image generation and review retrieval.

Separate API routes organize these capabilities; shared providers can affect multiple features.

Inference

Provider-abstraction layer routing to an open-weight model, gpt-oss-120b, served on LPU inference hardware, with Google Gemini 2.5 Flash / Pro as an alternate route, selected per request.

No hard dependency on any single model vendor; models are interchangeable behind one interface.

Cost governance

Gemini has per-process minute/day request limits and can fall back to Groq on quota errors. Generation and segmentation have separate in-memory session rate limits.

Helps control requests; these are not a global spending cap or a guarantee of fail-over on every error.

Data

PostgreSQL (Supabase) with row-level security enabled on every table; migration-controlled schema; anonymous session model with optional authenticated accounts via magic link.

Tenant isolation and least-privilege access; use without an account is the default.

Client-side data handling

CSV and POS input is parsed in the browser. Recognized identifying columns are removed; column statistics, computed cohort counts and sanitized sample rows are sent for analysis.

The original file is not uploaded. Heuristic redaction may miss identifiers in unfamiliar columns or free text; review inputs before analysis.

Where this is going

  • Self-hosted inference on vLLM, so model serving runs on infrastructure we operate rather than third-party APIs.
  • Domain-specialized open-weight models, fine-tuned with parameter-efficient adapters on consented, de-identified data.
  • Automated detection and redaction of residual identifiers in free-text input.
  • Differential-privacy techniques for cross-business industry benchmarks.
  • Independent security assurance, including a SOC 2 examination.

Read more about how customer data is handled and the models behind the platform.