Case · estud.ia · 3-minute read

How I design, secure and ship an AI product.

estud.ia is an education platform where AI helps each student without replacing the teacher. I designed and built it end to end, and every decision below is one I made on purpose.

One school, seven points of view

Each role sees its own view of the same school. Teacher, student, parent and principal are described through the personas used to explain the product.

Admin
Runs the platform: schools, country settings and the AI configuration.
School admin
Sets up a school: its structure, its users and the parent invitations.
Principal
Elena, on the leadership team, sees performance by grade and course, the topics with the highest error rate, progress over time, how autonomous students are and early alerts when a group stalls.
Teacher
Laura has 28 students and little time. She loads the plan, sets criteria and limits, schedules lessons and tasks with help aligned to her frame, and reads insights by topic and by student.
Psychopedagogy
Follows individual cases and receives alerts in a dedicated view.
Student
Emilia gets help that guides her to understand, not the answer: step-by-step explanations, examples, hints and different ways to see it, always inside her teacher’s context. Each help costs points, so she tries first.
Parent
Juan sees progress by topic before the final grade and gets early signals when learning stalls, so he can help with focus.

Same content, four ways to take it in

For students, the AI changes how the teacher’s help is presented, not what it says.

Visual
Turns the topic into a diagram or mind map, with colors and arrows linking the ideas.
Analytical
Justifies each step with a fact or a rule and closes with short “if A, then B” conclusions.
Audio
Explains the procedure like a short podcast, stressing key words and concrete examples.
Spatial
Lays the content out like a space: elements in layers or stages, and how they relate.

Help that makes the student think first

The teacher writes each level. Using help costs 5, 10 or 15 points, so students try first.

Low
Pinpoints the key ideas of the task and links them to what the student already knows.
Medium
Splits the work into short steps: review the material, pull out the key data and draft before developing it.
High
Walks through the whole procedure, explaining each step and the conclusion to reach.
Detail mode
Brief (two or three sentences), guided (a short intro plus a few steps) or complete (a mini guide with a checklist).

Adoption in six steps

Adoption is progressive, from setting up the school to using it in class. Leadership gets an institutional view without turning the system into a ranking.

1 · School setup
Grades, divisions and subjects, plus the school’s identity.
2 · Users
Teachers, students and school leaders, with roles and permissions.
3 · Academic framework
The study plan and the learning goals per subject and grade.
4 · Teacher preparation
A short training and the pedagogical context that will guide the AI’s help.
5 · Classroom
Lessons and tasks on the platform, with the AI supporting learning through configured explanations and guides.
6 · Community
School follow-up and communication with families, with actionable insights on progress and needs.

What the tests protect

They run against PostgreSQL, not SQLite, so schema and migration problems show up early.

Access control
Roles and school isolation, including attempts to reach another school’s data.
Security hardening
Failing closed on corrupted encrypted data, cookie flags and session conflicts.
Encryption and privacy
Field-level encryption and personal-data compliance checks.
AI safety
Content safety for minors and the prompt layer.
Consent
Parental consent flows, from the invitation to the acceptance.
Retention and migrations
The data retention policy, schema integrity and database migrations.

No green checks, no commit

Each gate has to pass before a change moves on. If one fails, the change stops there and gets fixed.

Gate 1 · On edit
The app must still import after each change.
Gate 2 · Commit
Schema and services must match the models, or the commit is blocked.
Gate 3 · Review
Security review of the diff first, then the full test suite. A human confirms the commit.
Gate 4 · CI
Tests repeat on a clean machine with PostgreSQL 15, on every push and pull request.
Release
Database migrations run before the new version starts.

Why it exists

Schools teach as if everyone learns the same way, and AI invites shortcuts.

Learning is in a quiet crisis: technology moves faster than pedagogy, and AI, meant to extend human thinking, is often used as a cognitive shortcut.

  • 4 in 5

    sixth graders in Latin America and the Caribbean would not reach the minimum level of reading comprehension.

    UNICEF

  • 78%

    of class time is actual teaching; the rest goes to order and administrative tasks.

    OECD, TALIS 2018

  • 11%

    of student submissions show AI-generated text.

    Turnitin (2024), via Education Week

What I set out to solve

Make personalization possible at scale without replacing the teacher. The teacher sets the pedagogical frame; the AI adapts how each student takes in the content and never hands over the answer. Two users drive the design: teachers, who need to personalize without multiplying their workload, and students, who need consistent support in the way they learn best.

What it shows Problem framing: starting from evidence and one hard constraint (assist, never replace) before choosing the technology.

Principle zero

Security comes first: in the process, the product and the AI.

In the process

The security review is step one of every commit, before the tests run.

In the product

Consent comes before access. Personal data is encrypted from the first write.

In the AI

Safety rules for minors lead every student- and parent-facing AI call, ahead of the teacher’s content.

How it was designed

Designed with the people who use it, across different schools.

The design phase ran with teachers and school leaders from different schools. They have different needs, and the work was to turn that input into one coherent product.

What it shows Stakeholder management: gathering requirements across institutions and aligning them into one product.

Decisions that shaped it

Four calls I made on purpose.

The AI adapts style, not content

The teacher writes the help in three levels. For students, the AI only reshapes it for how they learn: visual, analytical, audio or spatial.

What it shows Product judgment: I scoped the AI to what earns trust, not to what looks flashy.

Minors are protected by design

A student cannot enter without valid parental consent, and a school cannot go live until its parents have signed. Personal data is stored encrypted.

What it shows Security and compliance thinking built into the flow from day one, not bolted on.

One door to the AI provider

Chat and help calls pass through a single client: safety rules in, moderation and audit out. The provider (Anthropic, OpenAI or an offline fallback) can be swapped per school.

What it shows Architecture: one choke point makes the provider swappable and every call governable.

No green checks, no commit

Quality gates run before every commit: an import check, schema and service integrity, a security review and the full test suite. Continuous integration then reruns the tests on PostgreSQL.

What it shows Delivery discipline: automated gates make quality the default, not an afterthought.

Safeguards

What is built in.

  • ✓ Personal data encrypted at field level
  • ✓ A permanent audit log the application cannot edit or delete
  • ✓ Parental consent recorded, with expiring links
  • ✓ Retention policy: AI prompt content purged after 30 days
  • ✓ One active session per person
  • ✓ Rate limits on AI endpoints and on ID lookups
  • ✓ Strict security headers: HSTS, frame protection, secure cookies
  • ✓ Encrypted daily database backup