Compliance-first delivery
Education traffic is spiky, budgets are tight, and the users are often children
An admissions portal sees almost nothing for eleven months and then millions of requests in a week. An online exam has to work for every candidate at exactly the same minute. A school app holds data about children, which brings stricter privacy rules than almost any other sector. And all of it has to be accessible to students with disabilities, often by law.
We build and integrate accessible portals and LMS extensions, run elastic cloud infrastructure for exam and results days, secure student data with identity and privacy controls, and build AI help-desk bots and tutors grounded in your own course material.
What education technology teams tell us
Different institutions, remarkably similar problems.
“The portal crashed on results day”
Traffic spikes far beyond the normal load, and every crash makes the news or social media.
“Our online exam can’t fail mid-test”
Thousands of candidates start together, and timing, autosave and integrity all have to hold.
“We have an accessibility deadline”
Courses, portals and PDFs must meet WCAG 2.1 AA, and nobody has audited them yet.
“School districts sent us a privacy questionnaire”
Buyers want to know exactly how student data is stored, shared, retained and deleted.
“Our systems don’t talk to each other”
Admissions, SIS, LMS, fees and alumni systems each hold part of the student record.
“Students ask the same 200 questions every term”
The help desk drowns in routine queries about fees, timetables and deadlines.
Education solutions built for peaks, privacy and access
Start with the one that is closest to a deadline.
Exam & results-day scalability
The challenge
Admissions windows, online exams and results announcements create short, extreme spikes.
Our approach
We design for the spike: static and cached results pages, queue-based submissions, autoscaling with pre-warming, load tests at the expected peak and a rehearsed runbook for the day itself.
What you get
- Spike-ready architecture
- Pre-warmed autoscaling and CDN
- Load test at expected peak
- On-call support for the event
Accessibility remediation
The challenge
Portals, course pages and documents have never been checked against WCAG, and a legal or procurement deadline is approaching.
Our approach
We audit key user journeys with automated tools and manual screen-reader and keyboard testing, fix templates and components at the source, and set up checks in CI so regressions are caught.
What you get
- WCAG 2.1/2.2 AA audit of key journeys
- Component-level fixes
- Accessible documents and media guidance
- Automated accessibility checks in CI
Student-data privacy & security
The challenge
Student records, minors’ data and parent contacts held across apps, spreadsheets and vendors.
Our approach
We map where student data lives, apply least-privilege access and SSO, encrypt and log access, define retention and deletion, and prepare the documentation schools and regulators ask for.
What you get
- Student-data map and inventory
- SSO and role-based access
- Retention and deletion controls
- Privacy and security documentation
SIS, LMS & fees integration
The challenge
Moodle, Canvas or Google Classroom, a separate SIS and a fees system that are all updated by hand.
Our approach
We connect them through APIs and standards such as LTI and OneRoster where available, so enrolments, grades and payments flow automatically and are reconciled.
What you get
- Enrolment and roster sync
- Grade passback via LTI
- Fee and payment reconciliation
- Single sign-on across systems
AI tutors & help-desk bots
The challenge
Students want instant answers, staff are overloaded and generic chatbots make things up.
Our approach
We build assistants grounded in your handbooks, course content and FAQs using retrieval, with citations, age-appropriate guardrails, human handoff and evaluation before launch, on web, app or WhatsApp.
What you get
- Assistant grounded in your content
- Citations and human handoff
- Age-appropriate guardrails
- Web, app and WhatsApp channels
Privacy and accessibility rules in education
Education carries some of the strictest data and accessibility obligations of any sector. These are the ones we design for.
FERPA
Protects student education records at institutions receiving US federal funding. EdTech vendors usually act as “school officials”, with contractual limits on how they use the data.
COPPA (amended rule)
The FTC’s amended COPPA Rule, published in April 2025, required compliance by 22 April 2026, with stricter consent for third-party sharing, written security programmes and data-retention limits for services directed at under-13s.
ADA Title II web rule
The DOJ’s 2024 rule requires WCAG 2.1 AA for state and local government web content and apps, including public schools and universities, with deadlines tied to entity size. The DOJ has since revised the timeline, so confirm the current date for your institution.
GDPR & the Children’s Code
The UK Age Appropriate Design Code sets 15 standards for online services likely to be used by children: high-privacy defaults, minimal data and no nudging.
DPDP Act, 2023: children
Processing data of anyone under 18 requires verifiable parental consent, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited.
WCAG 2.2
Published by W3C in October 2023, it adds criteria on focus visibility, target size and accessible authentication. It is a good target even where the law cites 2.1.
Status as of October 2026. Regulations change; we help you design, implement and evidence technical controls. Legal interpretation belongs with your counsel, and certifications or audit opinions are issued by independent bodies, not by us.
Platforms and standards we work with
- Moodle
- Canvas
- Google Classroom
- Microsoft Teams for Education
- LTI 1.3
- OneRoster
- SAML / OIDC SSO
- WordPress
- Laravel
- WCAG 2.2
- HLS video
- WhatsApp Business
Products education teams use with our engineering
Built and run by us, and handy for admissions, enquiries and keeping cloud costs in check between peaks.
Insight OS
Analytics, live chat & leads in one script Privacy-friendly analytics with live chat and WhatsApp enquiries in one inbox, ideal for admissions season. Visit insight.hi4.in
CloudMonitor
See your entire cloud, clearly — multi-cloud cost, security & inventory Make sure the capacity you scaled up for exams scales back down, with spend alerts across clouds. Visit cloud-monitor.radiatus.com
SemperWise
AI-first cybersecurity: VAPT, pentesting & compliance on SemperWise One™ Penetration testing for student portals and apps before a privacy questionnaire asks for it. Visit semperwise.comA typical first engagement: accessibility and privacy baseline
Three to four weeks, fixed scope, covering the two areas where education institutions face the most legal exposure.
Journeys & data map
We pick the critical journeys (apply, enrol, learn, pay) and map where student data flows.
Accessibility audit
Automated scans plus manual keyboard and screen-reader testing of each journey against WCAG 2.1/2.2 AA.
Privacy & security review
Access control, retention, vendors and a light penetration test of the main portal.
Prioritised fix plan
Issues ranked by legal risk and user impact, with effort estimates and quick wins.
Guides and terms for education teams
Guides
Questions education teams ask us
Usually we extend: Moodle, Canvas and Google Classroom are mature, and most institutions are best served by integrating and customising them through plugins, LTI tools and APIs. We build custom when the learning model genuinely does not fit.
We audit, fix templates and components, guide content authors on documents and media, and add automated checks to stop regressions. Full conformance also depends on content your staff create, so we train them too.
We minimise what is collected, apply high-privacy defaults, restrict and log access, define retention and deletion, and avoid third-party trackers in child-facing experiences, in line with COPPA, GDPR and India’s DPDP Act.
Any AI system can be wrong. We reduce the risk by grounding answers in approved content, showing sources, restricting topics, evaluating answers before launch and offering human handoff, and we monitor quality after launch.
Yes. We design for the spike with caching, queueing and pre-warmed autoscaling, then load-test at your expected peak and stay on call on the day.
Exam season, an accessibility deadline or a privacy questionnaire coming up?
Tell us your date. We will tell you what can realistically be ready by then.