The AI learning platform your DPO can actually approve.
Sign one DPA. Connect your SIS. Onboard teachers in 30 minutes. Pull a TraceLayer audit trail when a parent — or a regulator — asks.
Built for schools, with safeguards in place.
How a school runs on CurioPilot.
Procurement + onboarding
- Sign DPA + Privacy Notice
- Connect SIS (OneRoster)
- Configure AI policy
- Bulk-import users
- Set retention windows
Day-to-day operations
- School Admin Dashboard
- Today's priorities triage
- Intervention queue
- Co-Teacher digest
- Smart Homework + diagnostics
Ongoing trust + audit
- TraceLayer per-tenant
- Audit log (7-year retention)
- DPA renewal
- DSAR fulfilment
- GDPR Article 17 erasure
Built for the systems schools have.
OneRoster Sync
Daily delta from PowerSchool, Infinite Campus, Skyward — your roster, current.
LiveLTI 1.3 + grade passback
Embed in Canvas, Moodle, Blackboard. Durable queue + nightly worker means retries are crash-safe.
LiveSAML 2.0 SSO
Entra ID, Okta, Google Workspace, any SAML IdP. JIT provisioning + single sign-out. Standard+ tier.
LiveGoogle Classroom
Roster + assignments + grade passback — two-way sync (on the immediate roadmap).
RoadmapStripe
B2B billing, token bundle top-ups, idempotent webhooks for procurement.
LiveReach parents on WhatsApp — audited, capped, opt-in.
UAE-first comms with Meta-verified WhatsApp Business templates, Twilio SMS Sender ID, email, push, and in-app — one broadcast, five channels, zero double-sends.
Audited WhatsApp template flow
Every template approved by Meta. Two-step opt-in capture (parent confirms before any commercial template fires). Conversations threaded with audit trail per parent.
Per-school AED budget cap
Real ledger. Hard cap enforced at send time. Alerts at 70% and 90%. Critical-priority safety messages override the cap with an audit-logged COMM_CONSENT_OVERRIDE row.
STOP keyword honoured platform-wide
Replying STOP unsubscribes the parent from that channel everywhere — no double-sends, no re-subscription drift across class-level broadcasts.
Author by Bloom’s percentage. The allocator does the maths.
Author a unit exam the way your curriculum coordinator already writes it: “30% Apply, 40% Analyze, 30% Evaluate across these five topics.” CurioPilot’s Hamilton-rounding allocator fans the right counts into the right buckets, then asks the question generator to fill each bucket — dedup-aware, mastery-aware, reviewable.
For end-of-year and pre-board prep across an entire grade, Exam Prep paces the practice to the exam date. Class-wide audiences resolve server-side from divisionIds — never trusted from the client. Drift-guarded by exam-prep-audience-drift-guard.test.ts.
License-gated under blueprint-exams (Standard+). Draft-only persistence — half-built blueprints never auto-publish.
Grade handwritten work from a phone shot.
Teachers snap a photo of student work on their phone (or upload from a scanner). The platform OCRs the handwriting, runs the output through the same rubric the AI generator used to author the question, surfaces partial credit on multi-step problems, and lets the teacher confirm or override before the grade lands in the gradebook.
Every image flows through the fail-closed moderation pipeline before any model sees it. Multi-modal generation is fail-closed; student uploads fail-open so a child’s submission isn’t blocked by a moderation timeout. Pinned by image-moderation-required.test.ts.
License-gated under photo-grading (Standard+). Multi-modal stem image generation (Imagen 3) is a separate gate on Campus + Premium Family.
The facts your IT can verify.
We publish the technical posture, not just the marketing version. Your IT can run our PII attestation script, review our Firestore security rules under NDA, and audit our retention policies before you sign anything.
See full compliance postureThings your IT can verify
- Run our PII attestation script:
npm run tracelayer:attest:check - Field-level encryption on SIS credentials + LTI secrets + SAML SP signing material
- Crisis-language detector — deterministic, no LLM on the child-safety triage path
- Tenant data export (GDPR Art. 20) — 37 collections, SHA-256 per CSV in MANIFEST.json, 24h signed URL
- Incident workspace with regulator-notification clock (GDPR 72h)
- Audit log retention: TraceLayer 90 days, audit logs 7 years
Transparent pricing in AED.
Per-student rates are 50–70% cheaper than Khanmigo, Newsela, and Quizizz Premium. UAE pilot offer for first 10 schools: 3–4 months free (term-aligned) or 50% year-1 discount.
Trial
Full features, up to 300 users, 2M tokens.
Starter
≤200 users · 2.5M tokens/yr · 33 AED ($9) per student/yr.
Standard
Most pick this≤500 users · 7M tokens/yr · 51 AED ($14) per student/yr. SAML SSO, LTI 1.3, Blueprint exams, photo-grading, Parent Coach Brief, voice (Spark + Create).
Campus
≤1,000 users · 15M tokens/yr · 73 AED ($20) per student/yr. Multi-modal stem images + premium voice.
District
5+ schools, district-wide TraceLayer, white-label.
What week 1 looks like.
Real timeline. Fast, but not magical.
- Day 1: Discovery call (45 min)
- Day 2: DPA + Privacy review with your DPO
- Day 3: SIS connection test (your IT in the call)
- Day 4: AI policy configuration + first teacher invite
- Day 5: Teacher training session #1 (live)
- Day 6: First class assigns + first activity goes live
- Day 7: First TraceLayer audit pull (we walk you through)
For schools, in detail.
Are you FERPA / GDPR / COPPA / UAE PDPL compliant?
Yes — for all four. TraceLayer logs every AI decision; GDPR Art. 15 export and Art. 17 erasure are one-click; Art. 20 tenant data export bundles a full ZIP with SHA-256 manifest; COPPA gating blocks personalisation for under-13s without verified parental consent; UAE PDPL alignment covers SMS/WhatsApp consent capture + 7-year SECURITY-class audit.
Do you support SAML SSO?
Yes — SAML 2.0 SSO ships on Standard+ tier. Per-tenant config for Microsoft Entra ID, Google Workspace, Okta, or any SAML IdP. Signed AuthnRequests for Entra strict mode, Upstash-backed replay cache, single sign-out both directions, JIT provisioning with role mapping locked to your IdP's defaultRole attribute. IdP role claims are deliberately ignored — privilege escalation has to go through your IdP, not a SAML attribute.
Does LTI grade passback work?
Yes — LTI 1.3 with grade passback is live, with a durable queue and a nightly worker so retries are crash-safe. Embed CurioPilot activities in Canvas, Moodle, Blackboard, or any LTI 1.3 LMS; grades land back in the LMS gradebook with the same idempotency guarantees as Stripe webhooks.
Do you train models on our students' data?
No. Our AI providers (Google, OpenAI, Anthropic) are configured on enterprise tiers that contractually exclude training. We log which provider answered each AI call so you can verify.
What happens if our internet is down?
Activities students started can be submitted later (offline PWA). Teacher dashboards degrade gracefully. New activity creation requires connectivity — AI lives elsewhere.
How long does onboarding take?
DPA review with your DPO inside week 1. SIS connection test inside week 1. First teacher trained and assigning activities inside week 2. Most schools are running real workloads by week 3.
Can we run our own DPIA?
Yes — we provide a pre-filled DPIA template (`docs/trust/dpia-template.md`) populated with CurioPilot-specific facts to make your assessment fast.
How long do you retain our data after we cancel?
Active data: 30 days. Backup retention: 90 days. After 120 days, all data is hard-deleted unless you've requested an export. The GDPR Art. 20 tenant data export bundle ships a full ZIP with SHA-256 manifest, 24-hour signed URL.
Who owns the data — you or the school?
The school. We are a processor (in GDPR terms). Your DPA defines the relationship; we don't claim any rights to your data.
See CurioPilot in your school’s context.
45-minute demo with you, your IT, and your DPO. We show TraceLayer scoped to a real school, walk through the DPA, and answer your jurisdiction-specific questions.