Why Real-Time EdTech Needs Security Built In, Not Bolted On

This post details the security requirements for EdTech platforms, emphasizing the need for security to be built-in rather than bolted on. It highlights common compliance regulations (FERPA, CCPA, SOC 2, GDPR, HIPAA) and their overlapping requirements: role-based access control (RBAC) at the data tier, multi-tenancy with real isolation, real-time identity management, and comprehensive audit logging. The post uses the PowerSchool breach as a case study and contrasts application-layer access controls with database-layer enforcement, advocating for the latter to ensure principle of least privilege. It references GoGuardian and Curriculum Associates as examples of platforms implementing these principles at scale.