Freelance AI engineer. I get AI products to production.
Building fast with Cursor, Lovable, v0, Bolt or Claude Code is the right way to find out if anyone wants your product. When real users start arriving, I take it from there: I review what you've built, harden it, launch it properly and build the AI features end to end, in TypeScript or Python. Everything is built to GDPR and UK GDPR, with OWASP and WCAG 2.2 AA as the baseline.
Taking on freelance projects from Colombo, working with teams in the EU, the UK, Switzerland and the US.
What I take on
Production readiness review
A fixed-scope review of your codebase before it meets real users, or before more of them arrive. You get a ranked list of what needs attention for production and how to fix it.
For: Founders and teams who built quickly with AI coding tools and want to know what is safe to ship.
- Security review of auth, API routes, secrets and database access rules, against the OWASP Top 10
- GDPR check: what personal data you hold, where it goes, consent, retention, and whether users can export or delete it
- PII exposure and prompt-injection risks in AI features, against the OWASP Top 10 for LLM applications
- Error handling, edge cases and failure modes that haven't been tested yet
- Cost and performance traps such as unbounded model calls and N+1 queries
- A written report ranked by severity, with a fix plan
Codebase hardening
Give a product that already works the foundations to grow on: typed, tested, structured and deployable, so new features stay quick to ship.
For: Products with traction where each new change takes longer than it should.
- Refactoring into a clear structure with strict TypeScript
- Tests on the paths that matter, written from acceptance criteria
- Proper loading, empty and error states in the UI, accessible to WCAG 2.2 AA
- GDPR fixes from the review: consent, data minimisation, retention jobs, and data export and deletion
- CI, linting and type checks so the next change can't quietly break it
- Handover notes so your team can keep going
MVP to production
Take an MVP from demo to a production-ready launch: auth, database, payments, deployment, monitoring and the boring parts that keep it up.
For: Founders with a validated prototype and a launch date.
- A short PRD with acceptance criteria, so scope is agreed before code
- Auth, database schema and migrations, and access control
- Privacy by design: EU hosting and data residency, consent only where trackers need it, and data export and deletion built in
- Deployment on Vercel or AWS with preview environments
- Monitoring, logging and alerts from day one
- A launch checklist covering the things that break on day one
AI feature build
Add the AI part of your product properly, end to end: the UI, the API, the prompts and the evals, on your existing TypeScript or Python backend.
For: Products that need chat, search, an assistant or an agent that actually works for users.
- Streaming UI with real loading, error and empty states
- Model integration with Anthropic, OpenAI or AWS Bedrock, through the Vercel AI SDK or the official Python SDKs
- Typed tool calls and structured output with Zod or Pydantic
- RAG over your own data with embeddings and pgvector, with cited sources
- Tool calling and agent pipelines with step limits and human sign-off before writes
- PII redaction before prompts, EU-region model endpoints where the provider offers them, and no training on your users' data
- Clear AI disclosure for users, in line with the EU AI Act's transparency rules
- Tracing and evals in Langfuse, Braintrust or LangSmith before anything ships
How it works
- 01
Talk
A call about what you have, what is breaking and what has to ship.
- 02
Scope
An audit or a short spec with acceptance criteria, so we agree on done before any code.
- 03
Build
Small, reviewed pull requests against the spec, deployed to previews you can click through.
- 04
Hand over
Docs, tests and a walkthrough, so the codebase is yours, not mine.
Questions people ask
What does a production readiness review cover?
Security, data handling, AI-specific risks like prompt injection, error handling, cost and performance. It ends with a written report ranked by severity and a fix plan, so you know exactly what to tackle before launch and what can wait.
Do you work on vibe-coded apps built with Lovable, Bolt, v0 or Cursor?
Yes, that's a large part of the work. Getting to a working product fast with AI tools is a sensible way to build. I usually start with a readiness review, fix security and data issues first, then add tests, error handling, CI and monitoring, and deploy properly, so your team can keep changing the app with confidence.
How long does it take to get an MVP to production?
It depends on the state of the code and what launch needs, so it starts with a fixed-scope readiness review. After it you get a plan with acceptance criteria, so the timeline is agreed before any building starts.
What stack do you work in?
TypeScript on the frontend. For the backend and AI layer, TypeScript or Python, whichever fits your team, deployed on modern cloud platforms. For AI, I build on the major model providers, with retrieval over your own data and tracing and evals built in. If you already have a stack, I'll work in yours.
Do you train or fine-tune models?
No. I build product features on top of model APIs: integration, prompts, retrieval, agents and evals. I don't train or fine-tune models or self-host open models.
Do you build to GDPR and other standards?
Yes. GDPR and UK GDPR shape the build from the start: data minimisation, a lawful basis and consent where needed, retention limits, data export and deletion, EU hosting, and processors with signed DPAs. Security follows the OWASP Top 10 and, for AI features, the OWASP Top 10 for LLM applications. The UI targets WCAG 2.2 AA, and AI features follow the EU AI Act's transparency rules, so users know when they're talking to an AI. I'm an engineer, not a lawyer: I build and check the technical side, and your DPO or legal counsel signs off on compliance.
Where are you based and which time zones do you work with?
Colombo, Sri Lanka (UTC+5:30). I've worked remotely with teams in the UK, Sweden and Switzerland, and overlap comfortably with UK and European working hours and the start of the US day.
Got a demo that needs to survive real users?
Tell me what you have and what has to ship. I'll tell you honestly whether I can help.
or write tohello@kaveenhyacinth.com