What we can tell you, and what we can't
Everything on this page describes something that exists in the product today and can be demonstrated on a call. The second half lists what we do not have — because a page with no weaknesses on it is the one nobody believes.
Access is enforced in the database, not the interface
Every table carries row-level security, and scope is part of the query rather than a filter the interface applies afterwards. A district administrator's session reads their district; a school administrator's reads their school; a teacher's reads their own classes; a parent's reads only children they have a confirmed link to. Hiding a link is not a permission, and nothing here relies on one.
One person, one account, one role, one portal
There are no dual-role accounts and no switcher. Each of the nine portals authenticates only its own roles, and a credential presented at the wrong door is refused generically — the message never reveals which portal the account actually belongs to. Page routes are authorised in one table enforced before any route code runs, so a wrongly-authenticated request never renders a frame of protected markup.
Accounts are provisioned, never self-registered
Students, teachers, parents and staff cannot create their own accounts. Your own administrators provision them with a username and a one-time password, and self-signup is blocked at the database itself rather than only in the interface. The two exceptions are the consumer products — independent learners and professional tutors — which never touch a school's data.
Attributable by default
Account actions — provisioning, password resets, locks, recovery requests — write to an append-only log. District broadcasts, exports, report generation and record links write a row naming the person who did it. When somebody asks who saw what and when, the answer is a query rather than an investigation.
Files are private by default
Uploads live in object storage that is not publicly listable. Anything a browser fetches goes through a short-lived signed URL issued by our own origin after an ownership check, so a link copied out of a page stops working rather than becoming a permanent public URL.
The AI shows its working, and never acts alone
Every insight publishes the evidence it used and a confidence figure, and every action it proposes — an email, a message, a report — is a draft a person reviews and sends. Teachers set the AI level per assignment and the document enforces it. Learning data personalises that student's own experience and rolls up into your analytics; it is not sold.
Usable without a mouse, and without the motion
Everything here is implemented and checkable from a keyboard. What we do not have — a VPAT, and an audit by anyone outside this team — is in the next section with the rest of it.
Operable from the keyboard, and focus is never lost
Dialogs trap focus while they are open and hand it back to whatever opened them, and Escape closes them. Forms mark required fields, carry autofill hints, announce validation failures through a live region rather than only colouring a border, and move focus to the confirmation heading on success so a screen-reader user is told the submission worked.
Reduced motion is honoured, not decorated around
This site is built on a live water simulation and physics-driven scrolling. Under prefers-reduced-motion the simulation renders a single static frame, smooth scrolling falls back to the browser's own instant jumps, the custom cursor never mounts, and entrance animations are skipped rather than shortened. The page is the same page; it simply stops moving.
State is exposed to assistive technology, not just drawn
Accordions publish aria-expanded and aria-controls, the walkthrough chapter rails mark the section you are in with aria-current, icon-only controls carry real labels, and headings and landmarks describe the page rather than being sized to look like a heading.
Contrast is a target, not an afterthought
Body text and interactive labels are held at 4.5:1 against their own background, including over the dark bands and the translucent glass panels, where a colour that passed on white quietly stops passing.
The part most vendors leave out
You are going to find these out anyway, and finding them out in week six of a procurement is worse for both of us than reading them now.
No SOC 2 or ISO 27001 report
We have not completed a third-party audit. If your process requires one before signature, say so on the call and we will be straight with you about timing rather than pointing at a roadmap.
No VPAT, and no third-party accessibility audit
The behaviour described above is implemented and you can verify it with a keyboard in five minutes, but nobody outside this team has assessed the product against WCAG 2.1 AA, and there is no VPAT to attach to your submission. The public site has had a deliberate accessibility pass; the signed-in application has had a lighter one. If a conformance document is a condition of award, ask on the call and we will tell you where we actually are.
No SSO or SAML yet
Sign-in is a username or email and a password, with provisioned one-time passwords and role-scoped recovery. SSO is a frequent request and it is not built.
No published sub-processor list yet
We can tell you exactly which providers process what — database and authentication, object storage, the model provider, email, and video — on the call and in writing. It is not yet something you can read here without asking.
Data residency is a conversation, not a toggle
Where your data sits, how long it is kept, and what happens to it at the end of a contract are part of the agreement we write with you. There is no self-serve region picker.
Your review will have questions this page does not answer. Bring them to the call — the people who built the access model will be on it, and you will get a written answer rather than a brochure.
See also our privacy policy. For how access is structured per audience: district, school, academy.
Reporting a vulnerability. Email mohamad.ouhocine@gmail.com with enough detail to reproduce it. We will acknowledge within two business days, and we will not pursue anyone who reports in good faith and does not access data that isn't theirs.