# Introducing EduByte: an open-source school platform for Bangladesh

> EduByte is our MIT-licensed school platform for Bangladesh: attendance, marks, fees and guardian updates, Bangla-first, offline-capable and multi-tenant.

- URL: https://byteminus.com/blog/introducing-edulab-open-source-school-platform/
- Published: 2026-10-15
- Author: Byte Minus Engineering (Byte Minus)
- Topics: Open source, EduByte, Education

**In short:** EduByte is an MIT-licensed school operating platform for Bangladesh, built by Byte Minus. It covers attendance, marks, fees, notices and guardian communication in Bangla and English, records attendance and marks offline in an installable web app, keeps each school's data apart with PostgreSQL row-level security, and keeps a hash-chained audit log.

Most schools and colleges in Bangladesh run on a mix of registers, spreadsheets, SMS bundles and a fee book that only one person in the office fully understands. Software exists, but much of it is English-only, assumes a fast and constant connection, and keeps the data somewhere the school can't inspect.

**EduByte** is our answer to that: a school operating platform built for Bangladesh's institutions, and released under the **MIT license** so that anyone can read it, run it and improve it.

## What EduByte does

EduByte covers the daily work of a school office and its classrooms in one system. The codebase is organised into modules, each owning its own folder in the API and the web app. Among them:

- **Students and admissions** — enrolment, sections and records.
- **Attendance** — per period or per day, recorded by the class teacher on a phone or tablet.
- **Exams and marks** — a marks grid built for entering a whole section quickly, plus results and certificates.
- **Fees** — dues, collection and receipts, with the ledger rather than a browser redirect treated as the truth for payments.
- **Communication** — notices, homework and messages to guardians.
- **Timetable, HR and payroll** — for the office side of running an institution.

Every screen is offered in **Bangla and English**, and Bangla is the default. The aim is Bangla as staff actually use it, not a word-for-word translation of an English interface.

## Built for the connection classrooms actually have

A teacher taking attendance in a classroom with one bar of signal should not lose their work. The EduByte staff app is an installable **Next.js progressive web app** with an offline write path built on IndexedDB (via Dexie).

Each mark a teacher records becomes an *operation* with a client-generated, time-ordered ID. When the device is online, operations go straight to the server. When it isn't, they wait in an on-device outbox and are flushed in order when the connection comes back, when the app opens, and every minute while anything is waiting. Because each operation carries its own ID, sending it twice is harmless: the server uses it as an idempotency key.

The server answers per operation, so if one mark is rejected — say the student moved section in the meantime — that mark stays visible with the reason until someone deals with it, and the rest go through.

Rosters kept for offline use are encrypted with a per-institution key that the browser cannot export, and they expire after 14 days. Guardian phone numbers are never stored on the device.

## Every school kept apart by the database

EduByte serves many institutions from one deployment. That only works if one school can never see another's data, so we didn't leave isolation to application code alone.

Every tenant-owned table has a `tenant_id` column and **forced row-level security** in PostgreSQL. The application connects as a database role that cannot bypass those policies, and each request runs inside a transaction that sets the current institution first. A request with no institution context simply sees no rows.

Two commands keep us honest. `php artisan db:check-rls` fails if any table with a `tenant_id` lacks forced RLS, and CI runs it on every pull request. `php artisan db:isolation-check` goes further: it takes two institutions and proves, table by table and route by route, that neither can read or write the other's data.

We wrote up the full approach in [Row-level security as a tenancy boundary](https://byteminus.com/blog/postgresql-row-level-security-multi-tenant-laravel/).

## Guardians in the loop, without accounts to forget

Parents shouldn't need yet another password. Guardians reach their child's page through **signed links**, and sign in to the companion mobile app with their phone number and a one-time SMS code.

The guardian page is assembled from cards that each module contributes — attendance, homework, results, dues, notices — so a new module appears for guardians without a separate app release. Push notifications name only the kind of news and the school, never the message itself, because they show on a locked screen.

## An audit log you can verify

Schools handle marks, money and personal records, so "who changed what" has to be answerable. EduByte keeps a **hash-chained audit log**: each entry is linked to the one before it, and `php artisan audit:verify` walks the chains and reports any break.

## The stack

| Part | Technology |
| --- | --- |
| API | Laravel 12 on PHP 8.3, organised as a modular monolith |
| Staff app | Next.js 15, TypeScript, Dexie (IndexedDB) for offline writes |
| Mobile app | Expo React Native, for staff and guardians |
| Database | PostgreSQL 16 with forced row-level security |
| Jobs and cache | Jobs in PostgreSQL, dispatched after commit; Redis or Valkey alongside |
| Tests | Pest for the API; Vitest and Playwright for the web app |

Architecture decisions are recorded as ADRs in the repository, so the reasoning behind choices like "pooled tenants in one database" or "a custom offline log instead of a sync framework" is written down rather than tribal knowledge.

## Running it yourself

EduByte runs locally with Docker Compose in one command, and the seeders create two demo institutions with sample accounts so you can see attendance, marks and fees working straight away. Without Docker, you need PostgreSQL 16 and Redis or Valkey; the README walks through creating the two database roles and running migrations as the owner role.

## Why open source

Schools are long-lived institutions, and the software that holds their records should outlast any one vendor — including us. An MIT license means a school, an education board or another developer can adopt EduByte, audit how it handles student data, and keep it running on their own terms.

It also keeps us careful. Code that anyone can read is code we want to be proud of.

## What's next

We are preparing the public repository and contributor guide now. To hear when it opens — and when the next projects follow — watch [byteminus on GitHub](https://github.com/byteminus) or subscribe to [this blog's RSS feed](https://byteminus.com/blog/feed.xml).

If you run a school or college and would like to pilot EduByte, write to us at [contact@byteminus.com](mailto:contact@byteminus.com).