Technical Growth & Enterprise EdTech Guide for Educati

Per-institution multi-tenant isolation

For a multi-campus group, each institution gets its own logical space — data, domain, theme, administrators — on shared infrastructure. Every query is confined to the user's institution: that is what stops an instructor at one campus acting on a student record at another.

Granular roles and an audit log

Rights are granted by role and scope, and sensitive actions — grade changes, exports, record edits, permission grants — are timestamped in an audit log exportable as CSV, though plain reads are not. That log, not a screenshot, is what documents who did what when a decision is contested.

What the platform actually exposes today

Exchange with the wider IT estate runs through exports (AREF, MASSAR, students, payments, logs) and a v1 API whose domain data is read-only, authenticated either with an explicitly scoped institution key or with a user token, and rate-limited. Two endpoints write: authentication, which mints and rotates tokens, and marking a notification as read. It covers the authenticated user's courses, assignments, grades, timetable, attendance and notifications; it does not cover the whole feature set — no assignment hand-in, no grade entry — and calling it a complete API would be dishonest. Verify actual coverage before building an integration on it.

Scale: test it, don't promise it

Before a critical session, have a load test run that reproduces the expected peak, and ask for the report. A capacity figure announced without measurement is worth nothing on exam day.