The platform your schools run on — not a prototype, a production system.
EduPrime is a multi-tenant learning platform: admissions, live classrooms, tuition billing, AI-assisted teaching and a partner API, all behind one deployment where every school's data stays provably apart from the next school's. It is already running — real students, real live classes, real tuition payments.
This page is the scope of what's built, the numbers behind it, what it means commercially, and — just as importantly — the parts that are honestly still unfinished.
394 of the 543 tests were run live alongside other suites with one incidental timeout (it passes alone in 1.3s); CI runs the full 543 on every merge to main. Size figures are counted from source, not estimated.
What's built
Multi-tenant by construction
One Prisma client adds the tenant filter itself; a query with no tenant in context throws instead of returning everyone's rows. CI fails the build if a new table doesn't declare who owns it.
A payment ledger, not a spreadsheet
Paystack webhooks are signature-checked and idempotent; tuition runs as a per-level ledger that pays the oldest charge first.
Live classrooms, built in
LiveKit-based rooms with token minting, automatic recording, and moderation — no separate video vendor to integrate.
AI-assisted teaching
A class-notes pipeline (transcription and extraction) and an AI tutor with tested failover across three providers.
It watches itself
Deduped incident tracking, a "drift" check comparing what the browser actually rendered against what the database says should show, and a developer console generated from source.
A partner API, not a demo
Scoped keys, cursor pagination, idempotent writes, and outbound webhooks signed and retried for 17 hours.
Tenant scoping is not opt-in
Every query in EduPrime passes through the same Prisma client, and that client adds the tenant filter itself. A query that runs with no tenant in context throws — it doesn't quietly return every school's rows. Getting the tenant to a query several function calls deep needed AsyncLocalStorage, with the auth gate installing an empty holder first and filling it in once the session lookup returns. A CI check fails the build if a table is added without saying whether it belongs to a tenant.
Deletes it can undo, and a log it can't edit
The schema has 222 cascade relations, so one careless delete could quietly take payments and grades with it. Deletes on the 15 models that matter — users, students, payments, certificates — become soft deletes, and a bulk delete with no filter, or one touching more than 200 rows, is refused. Changes to money, marks and identity get a before-image in an audit table, and a Postgres trigger blocks updates and deletes on that table itself. If someone got into the app, the app would not be the tool they could use to cover their tracks.
Backups that have actually been used
A nightly encrypted pg_dump, plus a monthly job that restores the newest dump into a throwaway Postgres and checks the row counts against the live database. On 3 September, production was reset to an empty schema by an environment mix-up. It was caught from the failing migration step and fully restored from a point-in-time backup — about an hour end to end. A CI check now fails the build if a production database URL turns up somewhere it shouldn't.
Every outbound call has a deadline and a breaker
Calls to Paystack and the AI providers used to have no timeout — a call that just hangs never trips a breaker that only counts failures. Now every outbound call goes through one wrapper: a deadline first, a breaker second. Network errors, timeouts, 5xx and 429 count against a provider; a declined card doesn't, so a few mistyped emails can't switch off payments for everyone. Neon suspends when idle, so the first query after a quiet spell can fail — that one connection error is retried, because nothing reached the server, so a retry can't write twice.
36 scheduled jobs that no longer wait on each other
It used to be one daily function running all 36 jobs in a row inside a 300-second limit — one partner endpoint that never answered would starve everything behind it. The jobs now run in five lanes split by what they depend on (payments, delivery, nudges, housekeeping, AI, media), each with its own time budget, running at the same time. A stuck job is dropped at its lane's cap and reported as timed out; the rest of the lane carries on.
Margins are an engineering problem too
On one day, close to a terabyte moved through serverless functions because every video range request was being proxied through them. Recordings, materials and offline downloads now redirect to short-lived signed bucket URLs instead, and a CI check fails any route that streams a file without explaining why that's okay. Transfer spend went from about $55 on the worst day to roughly $1.50 a day — a cut of more than 97%, with nothing removed for the user.
Payments, and the rule that used to disagree with itself
The Paystack webhook checks its signature with a constant-time compare and is idempotent on the payment reference, so the same event landing twice does nothing twice. The question "is this student allowed into the portal?" had been worked out separately in 13 places, and the copies disagreed — the admin screen said open while the student saw a padlock. It's now one function, with a CI check that fails the build if a route works it out on its own.
Proven with a real tenant, not a demo
EduPrime's first tenant is a German-language school in Nigeria — roughly 400 students, live classes, and card payments switched on for real since 2 September 2026. Everything above is what runs underneath the page below.
What this means for a business
- →Onboarding a new school is a config change, not a rebuild. Multi-tenant isolation is enforced by the data layer itself, not by convention — so a second, third or tenth institution doesn't add architectural risk.
- →The money side is already defensible. A real payment ledger, an audit trail the app itself can't edit, and idempotent webhooks mean it can survive a finance or compliance review, not just a sales demo.
- →It degrades instead of falling over. Circuit breakers, timeouts and parallel job lanes mean one slow vendor — a payment gateway, an AI provider, a partner webhook — doesn't take the rest of the platform with it. Backups have already been used once, for real, in under an hour.
- →Infrastructure cost is engineered, not accepted. The bandwidth fix alone cut transfer spend by more than 97% with no feature removed — margin discipline that holds as the tenant count grows.
- →It's already partner-shaped. A documented, idempotent, webhook-driven API means EduPrime can be integrated into a partner's systems — payment processors, SMS, placement or admissions partners — without a rewrite.
Honest gaps, and what closes them
Interested in EduPrime for your institution?
Happy to walk through the architecture, the numbers, or a live demo on a call.
Get in touch