How We Build AI Automations for SMEs

Dabster Labs builds production AI systems for small and mid-sized businesses in Cyprus and Greece: AI agents, business-process automation, workflow automation, and system integrations that run on infrastructure the client controls. This is engineering work, not chatbot setup, not single-step recipes, and not prompt consulting. Every system we ship is version-controlled code, deployed to servers you own or to EU-hosted infrastructure under a data-processing agreement, with audit logs, encrypted secrets, and tested backups from day one.

Below is what we build, how we build it, and the stack we build it on. It is written plainly so a technical buyer can judge the depth for themselves.

AI agents and LLM-in-the-loop

We build AI agents that take real actions inside a business, not demos that only answer questions. For a marketing agency we shipped an agent that reads a client brief document, splits it per deliverable with a frontier LLM under a data-processing agreement, and writes the notes back into the right record, filling only empty fields and recording an audit trace on every write.

• Task-scoped agents with an explicit allowlist of permitted actions, never open-ended
• Human-approval gates on consequential or personal-data actions, in line with GDPR Article 22
• A PII sanitizer wrapping every LLM call, including tool-call payloads, before data leaves the box
• Full audit trail of every agent run, so you can see exactly what was read and written
• Self-hosted open-source agents reachable over messaging channels for internal AI-ops work
• Model choice is portable: frontier hosted models under a DPA, or an EU or self-hosted alternative

Retrieval and knowledge over private data

We build retrieval systems that let an AI answer from your own documents, records, and website content rather than from general web knowledge. A voice and web assistant we deployed answers prospect questions using retrieval over the client’s own site content, and a knowledge-base architecture we maintain separates immutable raw sources from an AI-written layer so answers stay traceable back to their source.

• Retrieval grounded in your documents, CRM records, and site content
• Source-traceable answers: every generated statement links back to an underlying source
• Structured knowledge bases with an immutable source layer and a maintained catalog
• Scoped data exposure, so the model only sees what the task requires
• Self-hosted document and object storage keeps private corpora off third-party clouds

Workflow automation with n8n

n8n is our primary delivery tool for connecting systems and automating multi-step processes. We build validated pipelines: a website contact form and a voice agent both file structured, consent-stamped tickets into a CRM through separate authenticated webhooks, with rate limiting, deduplication, and a honeypot on the public form. For a training provider we built a three-tier synchronization that logs into a government programs portal on a daily schedule and syncs programs, participants, and evaluations into the CRM.

• Multi-step pipelines: intake, normalize, validate, route to CRM, email, and messaging
• Authenticated webhooks with signature verification, rate limits, and anti-spam gates
• Scheduled portal-to-CRM synchronization on daily triggers with error-branch alerting
• Reusable intake-form factory: one shared workflow routes every form, per-client config isolated to a single node
• Credentials referenced from the secret store, verified by node-by-node audit to contain no hardcoded keys

CRM and system integration

We do custom integration work, not just off-the-shelf connections. We run a self-hosted open-source ERP and CRM platform for clients, extend it with custom PHP modules and Python automation, and wire it to lead sources, email, and AI tooling through its REST API. We built a custom connector so an AI assistant can query live CRM data, exposing 15 tools across 7 modules behind a bearer-token gate.

• Custom modules and automation on a self-hosted open-source ERP and CRM platform
• REST API and webhook integrations to lead sources, email, storage, and messaging
• A connector framework where every integration is an encrypted secret decrypted only at point of use
• Custom AI connector exposing live CRM data as tools, 15 tools across 7 modules, token-gated
• Signature-verified inbound lead webhooks that hydrate and attribute each lead automatically

Security engineering

Security is built into the architecture, not bolted on afterward. On our flagship CRM build, an automated run exercised 255 API operations with zero exploitable findings, and a dependency scan over 1176 packages found zero production-exploitable issues.

• Database row-level security enforced by running the app as a non-privileged role
• Append-only audit logs, made immutable by database triggers blocking update and delete
• AES-256-GCM encryption of stored secrets, decrypted only at point of use
• Constant-time HMAC-SHA256 verification on inbound webhooks; header-auth on service endpoints
• SSRF guard blocking private-range, loopback, and cloud-metadata destinations on every outbound fetch
• CI security gates: dependency audit, SAST, and secret scanning, plus pre-commit hooks
• Automated HTTP threat banning at the firewall, and jails on repeated auth failures
• Read-only security audits producing scored reports, and a documented breach-response runbook

EU-hosted, GDPR-first deployment

We and our clients are EU-based, so EU data residency is a hard constraint on everything we deploy, not a later add-on. On one production deployment we purged 5067 inherited personal records in a single transaction for data minimization, and we build persistent AI-interaction disclosure to meet the AI Act transparency requirements.

• EU data residency as a hard requirement, with documented processor and provider roles
• GDPR data-lifecycle tooling: erasure (Art. 17), export (Art. 15 and 20), retention purge (Art. 5)
• AI Act transparency: persistent AI-interaction disclosure and marking of AI-drafted content
• Consent stamped on every inbound record: channel, timestamp, IP, and user agent
• Encrypted off-site backups, restore-tested end to end, with retention schedules
• The digest and audit trail double as GDPR Article 30 and 32 evidence

How we work

We build to be safe in production. Destructive operations run in dry-run mode by default and only mutate live data behind an explicit apply flag, and once live, systems report on themselves with a daily scored health digest.

• Staging and dry-run first: live changes are gated behind an explicit apply flag and a target ID
• Safe cutover: config backup taken before every change, with an anti-lockout rule preserved
• Read-only verification account re-checks the result after every change
• Human-in-the-loop on personal-data and irreversible actions
• Observability by default: a daily self-audit digest with OK, WARN, and ALERT thresholds
• Off-site encrypted backups that are restore-tested, not assumed

Our stack

We use mature open-source tooling, self-hosted wherever it keeps data under the client’s control.

• Automation and orchestration: n8n, Docker and Docker Compose, cron, Node.js, Python, PHP, and bash
• Data: PostgreSQL, MariaDB and MySQL, Redis, a self-hosted S3-compatible object store, and typed schemas with migrations
• Infrastructure: Linux servers, a TLS reverse proxy with automatic HTTPS, Proxmox virtualization, WireGuard VPN, and firewalling with network segmentation
• Security: automated threat banning, encrypted off-site backups, row-level security, AES-256-GCM secret encryption, HMAC signatures, and SAST plus secret scanning in CI
• AI: frontier hosted LLMs under a data-processing agreement, EU and self-hosted alternatives, retrieval over private data, self-hosted speech-to-text, a hosted voice-AI layer, and custom connectors over your own systems

Frequently asked questions

Do you host our data in the EU?

Yes. EU data residency is a hard constraint on every deployment. We host on infrastructure inside the EU, and where an AI model call has to leave the EU we run it under a data-processing agreement with a transfer-impact assessment, or we use an EU or self-hosted model instead. GDPR lifecycle tooling (erasure, export, and retention purge) is built in.

Can we self-host what you build?

Yes. We build on open-source components and deploy to infrastructure you own or control, from a single server to an on-premises cluster. We have migrated a client fully from a cloud VPS to owned on-premises hardware, and we design systems to run without lock-in. You keep the code and the data.

Do you do custom integrations or just off-the-shelf tools?

We do custom integration engineering. We write custom CRM modules in PHP, automation in Python and Node, and connectors against REST APIs and webhooks, and we build custom AI connectors that expose your live systems as tools an assistant can query safely. Off-the-shelf tools are used where they fit, but we are not limited to what a no-code catalog offers.

How do you handle security?

Security is engineered into the architecture. We enforce access at the database with row-level security, seal secrets with AES-256-GCM encryption, keep append-only audit logs made immutable by database triggers, and verify inbound webhooks with constant-time HMAC signatures. On our flagship build, an automated run across 255 API operations returned zero exploitable findings.