Case study 03
School ERP
Most schools in Bangladesh still run on paper registers, spreadsheets and desktop software: fees reconciled by hand, results tabulated in Excel, and guardians hearing about absences days late. School ERP puts a school's academics, finance, people and communication on one affordable, mobile-first platform in Bangla and English. A school signs up and configures itself (sessions, classes, grading rules, fee heads, roles) without a sales call, and every school's data is isolated by PostgreSQL row-level security in a single shared deployment. The first release targets a pilot with a handful of schools: student records, attendance, exams and results with Bangladesh GPA grading, fee collection, notices and a guardian portal.
- Founder & sole engineer
- Own product
- EdTech, SaaS
- School Management, ERP, Multi-tenancy, Row-level Security, Localization
- Next.js
- React
- NestJS
- PostgreSQL
- TypeORM
- Redis
- BullMQ
- TanStack Query
- Tailwind CSS
- Docker
What School ERP does
- Self-serve signup and a setup wizard, so a school can be running within a day
- Academic structure: sessions, shifts, classes, sections, subjects and teacher assignments
- Student and guardian records, with Excel import
- Mobile attendance and student leave
- Exams and results with Bangladesh GPA grading and report-card PDFs
- Fee heads, invoices, counter collection, receipts and dues
- Notices, in-app notifications and email
- A web portal for guardians and students
- Role-based access with configurable roles, including a managing-committee role
- Bangla and English throughout
- A dashboard sidebar each school can configure
The problem
A school ERP touches admissions, classes, exams, fees, staff and guardians, and most schools in Bangladesh still do all of it on paper and in spreadsheets. To be affordable it has to serve many schools from one deployment, and a single missing WHERE clause must never leak one school's students to another.
Approach
Isolation is enforced by the database, not by convention. Each request sets the tenant in the session and PostgreSQL row-level security policies filter every tenanted table, so application code can't forget. Notices and long reports run on a queue.
Key decisions
- D1
Row-level security
Tenant filtering lives in PostgreSQL policies, so even a buggy query can't read across tenants.
- D2
Configurable navigation
The dashboard sidebar is data-driven, so each school sees only the modules it uses.
- D3
Configurable, not custom
Grading rules, fee heads, terms, shifts, roles and report cards are settings, so a new school never needs a code change.
Highlights
- Tenant isolation with PostgreSQL row-level security on tenanted tables.
- Next.js dashboard with a configurable sidebar, backed by a NestJS API.
My contributions
- Came up with the product and wrote its product requirements: personas, tenancy model, module scope and a phased roadmap
- Designed the multi-tenant architecture, with PostgreSQL row-level security on every tenanted table
- Built the tenancy foundation: a NestJS API with TypeORM migrations and seeders, and a Next.js dashboard with a configurable sidebar
- Set up local infrastructure with Docker Compose: PostgreSQL, Redis and a mail catcher