Year 7 to Year 11 maths tutoring, founded in 2024. Twelve thousand students on the platform by month four through a partnership with eight state schools. The team had built fast: no age-gate, no parental consent flow, no record of which pupils had triggered a welfare flag.
Industry Edtech development · KCSIE-aware learning platforms · UK
Edtech development your DSL can. defend.
A learning platform that holds children’s data without a safeguarding spine isn’t a product, it’s a liability. We build LMS platforms, cohort tools, and assessment engines with KCSIE awareness, UK GDPR for under-16s, and parental consent flows your Designated Safeguarding Lead can stand behind.
24hreply, from a senior
200+projects shipped since 2019
Senioronly, on the spine
(Why UK edtech founders sign)
A trust’s DPO and a parent ask the same question. We build to the answer.
KCSIE-compliant edtech development isn’t a feature you bolt on the week a multi-academy trust sends the safeguarding questionnaire. It’s a set of decisions you make on day one, or pay a term of rebuild to retrofit. We make them on day one.
0
0
0
The founder this page is for12K pupils · onboarding paused · six MATs joined
Olivia founded a UK edtech. The product worked. The safeguarding didn’t exist.
Then the first multi-academy trust’s DPO sent the safeguarding questionnaire. There was no hand-off to the school’s Designated Safeguarding Lead, no audit log of who touched which child’s data, no answer to a single question on the form. The trust paused onboarding while the team scrambled. The board call was not pleasant.
We rebuilt the spine over twelve weeks. Age-gate with parental consent for under-13s. Welfare-flag triage with DSL hand-off via Teams. Audit log per student decision. Trust onboarding resumed. Six more MATs joined the following term. This page is for the edtech founder who’d rather build with the regulator and the DSL in mind on day one.
EDTECH SURFACES WE’VE SHIPPED
Eight edtech surfaces, live in production
What lives on the learning spine. Each one cohort-scoped, audit-logged, and built so a teacher only ever sees their own class.
Learning Management Systems
Cohort + class structures. Assignment + assessment flows. Teacher, pupil, parent, and SLT roles. Parent progress reports built in.
Cohort + bootcamp tools
Cohort-based learning. Live sessions via Zoom or Daily.co. Discussion boards, project boards, and peer review.
Assessment engines
Auto-marked and teacher-marked. Plagiarism detection. AI-assisted feedback with a teacher review gate before anything reaches a pupil.
AI tutoring assistants
LangGraph state machine. Age-appropriate response design. Teacher review of AI conversations. Every exchange audit-logged.
Parental engagement apps
Progress dashboards. Welfare flags shared appropriately. Consent management. Privacy by default for every child record.
Safeguarding workflows
Welfare-flag intake. DSL hand-off. Pastoral note audit log. Escalation rules mapped to the school’s own process.
Higher education tools
UCAS-aware. The student journey from open day to alumni. Loan and bursary integrations where the brief calls for them.
Corporate L&D platforms
Compliance training. Audit-ready completion records. LMS-LXP hybrid design for teams that need both.
The UK edtech regulatory spine
Six pillars, designed in at week one
The cost of designing for edtech-specific obligations on day one is a fortnight of architecture. The cost of retrofitting them after the first trust or parent letter is a term of senior engineering plus an unhappy board. We build to the questions the DPO and the DSL actually ask.
Pillar 01
KCSIE awareness
Welfare-flag triage. DSL hand-off via Teams, Slack, or email. Audit log per student welfare event. Annual KCSIE refresh tracked.
Pillar 02
UK GDPR for under-16s
Age-gate at signup. Parental consent flow for under-13s. Data minimisation for child data. Right-to-erasure designed in at the schema.
Pillar 03
DfE Edtech Code of Practice
Alignment with the DfE buyer code. ISO 27001 readiness. Cyber Essentials Plus path where the trust requires it.
Pillar 04
Cohort + role-scoped access
Teacher, parent, pupil, DSL, and SLT roles. Cohort-scoped data so a teacher only sees their class. Audit log per role transition.
Pillar 05
SEND / EAL / FSM sensitivity
Sensitive pupil attributes handled per UK ICO guidance. Aggregate-only reporting where individual disclosure would risk identification.
Pillar 06
AI safety + age-appropriate content
Content moderation on AI tutoring output. Age-appropriate response design. Teacher review gate on AI-generated assessment.
Three tiers, one spine, UK data residency by default.
Three edtech platforms have stress-tested these picks. Tier 1 runs every build. Tier 2 is what we reach for when the brief needs it. Tier 3 scales it to a national rollout without a rebuild. AWS London region means children’s data stays in the UK.
T1
What we build every edtech platform on
MERN + FlutterMongoDBExpress.jsReact + Next.jsNode.jsTypeScriptFlutterPostgreSQLMixpanelClerk / Auth.jsLangGraphTailwindPlaywright
T2
When your edtech brief calls for it
reach when neededPythonOneRoster / ClassLinkMicrosoft GraphGoogle WorkspaceWondeZoom / Daily.co
T3
The infrastructure that scales it
AWS London + cloud-nativeAWS (London)Kubernetes (EKS)AWS KMSAWS LambdaAWS RDS / AuroraS3 + CloudFrontRedisTerraformDatadog + SentryVanta / Drata
The pains UK edtech founders bring us
The edtech pain. The architectural answer.
Every edtech founder who emails us is fighting one of these. Each one is impossible to fix cheaply once children’s data is already flowing. Each one is a single architectural decision made on day one.
12wk
Safeguarding spine rebuilt
6+
MATs onboarded next term
“The safeguarding brief was the document that restarted our trust onboarding. The DPO read it once and stopped asking us for things.”
001
Welfare triage + DSL hand-off
Welfare flags trigger DSL hand-off via Teams, email, or Slack. Every welfare event logged. KCSIE-aware reporting, so trust onboarding resumes.
002
Age-gate + parental consent
Under-13s need parental email verification. Consent lifecycle managed, annual refresh tracked. UK GDPR child-data rules built into the schema.
003
Cohort-scoped access, IDOR-tested
Cohort scoping at the data layer. A teacher only sees their class. The IDOR playbook runs in audit week. Cross-cohort access becomes architecturally impossible.
004
Teacher review gate on AI
Teacher review on AI-generated feedback. Content moderation on tutor responses. Age-appropriate design. Every AI conversation logged for DSL review.
005
DfE Edtech Code alignment
DfE buyer-code alignment from week one. Cyber Essentials path, ISO 27001 readiness, sub-processor list. The DPO reads the brief and signs in three weeks.
Safeguarding-ready
Paused onboarding to
Paused onboarding to
six MATs joined, in one term
Olivia’s maths-tutoring platform, in real numbers. Twelve thousand pupils, the spine rebuilt on UK-hosted AWS in twelve weeks, cut over behind a flag to active cohorts. Zero customer-facing breakage, KCSIE-aware DSL flow shipped, trust onboarding resumed.
The rebuild
12wk
Safeguarding spine rebuilt
0
Customer-facing breakage
The outcome
6
MATs onboarded next term
12K
Pupils on the platform
Track record
3
Edtech platforms since 2019
3
MAT reviews passed 2025
Three ways to start. Pricing in the email back.
We don’t publish prices on a page. Every edtech scope is different. Pick the shape that fits and Mohit will send your real number inside 24 hours.
Edtech audit week
One week, fixed cost. We map your build against KCSIE awareness, UK GDPR for under-16s, and the DfE buyer code, then hand you a signed scope.
- 5-day senior audit
- Safeguarding + GDPR mapping
- Architecture brief + ADRs
- No commitment to build
Edtech build sprint
8 to 14 weeks of fixed-scope shipping. LMS, age-gate, parental consent, DSL flow, cohort scoping. KCSIE-aware from day one. Same seniors all the way.
- MERN + Python + AWS London
- KCSIE + UK GDPR designed in
- 30-day walk-away both ways
- IP assigns on every commit
Compliance rebuild
7 to 12 weeks. Your live edtech with the trust questionnaire it can’t answer. We rebuild the gaps and ship the audit log the DSL needs.
- Gap audit + remediation
- Audit-log retrofit
- DSL hand-off rebuild
- Procurement pack shipped
“The safeguarding brief was the document that restarted our trust onboarding. The DPO read it once and stopped asking us for things.”
— Olivia M., founder, UK edtechWhat edtech founders actually ask before signing
Pain-first, soft-second. The questions every founder asks after the first trust safeguarding review goes sideways.
Three of our edtech builds have passed MAT safeguarding reviews in 2025. The architecture brief is written to the questions the DPO and the Designated Safeguarding Lead actually ask: welfare-flag triage, DSL hand-off, audit log, KCSIE-aware reporting, and a Cyber Essentials path. KCSIE-compliant edtech development means the questionnaire is answered before it arrives, not scrambled for after.
Age-gate at signup. Under-13s need parental email verification via a one-time link. The consent lifecycle is managed in the platform, with an annual refresh tracked. UK GDPR Article 8 (child consent) and the Data Protection Act 2018 are designed in from week one, not bolted on after a parent complains.
Content moderation runs on every AI tutor response. Age-appropriate design sits in the system prompt and in a post-filter. There’s a teacher review gate on AI-generated assessment feedback, and every AI conversation is audit-logged for DSL review on request. We’ve shipped two AI tutors in edtech development with zero incidents in production.
No. Cohort scoping sits at the data layer, so a teacher only sees their own class. We run the IDOR playbook in audit week to prove it, which makes cross-cohort access architecturally impossible rather than just unlikely. The audit log records every cohort transition.
Yes. OneRoster and ClassLink for SIS integration. Microsoft Graph and Google Workspace for the school account directory. Custom SIMS, Bromcom, and other MIS integrations available where the brief needs them. Single sign-on so a pupil never manages a separate password.
Three things make this hard to fake. The 30-day walk-away clause goes both ways and refunds the unused portion. Payments are milestoned 25/25/25/25, so you never pay more than 25% ahead of working software. And we’ve been shipping since 2019, listed on Companies House, UK VAT registered. You can check us before you sign.
Yes, with 14 days’ notice. The engineers move to other projects, your repo stays where it is, your spend pauses. Pick it back up with 14 days’ notice and we resume on the same sprint board with the same engineers. No cancellation fee, no restart fee. We’ve done this six times in 2025.
Erasure is designed at the schema, not retrofitted with a script. Graduates trigger an automated erasure with an optional alumni opt-in. UK GDPR right-to-erasure is honoured in days, not months, and the audit log records the erasure itself so you can prove the request was actioned.
Yes, signed inside 30 minutes via DocuSign, with a mutual NDA template ready to go. Send the brief, we sign, and Mohit replies inside 24 hours with a clear yes, a clear no, or the one question that decides it.
In context
What it looks like shipped.
edtech development, in context — the dashboards, flows and components your team actually ships, reviews and maintains.
One paragraph. That’s it.
Tell us what you’re building, who your buyers are, and the safeguarding or compliance question you’re most worried about. Mohit reads every first email and replies inside 24 hours: a clear yes, a clear no, or the one question that decides it.
What happens after the email lands
- < 24h
A personal reply.
Yes, no, or the deciding question. Straight to your inbox, not a team thread.
- Week 1
Audit week begins.
We draw the safeguarding spine, map KCSIE and UK GDPR, hand you a signed scope.
- Week 14
Safeguarding-ready edtech.
Age-gated, consent-aware, DSL-wired, with the brief your trust’s DPO reads cold.