Scoping an EdTech software project means deciding, before any vendor quotes, which users each feature serves, when demand on it peaks, what student data it touches, and which school systems it must connect to. That discipline matters because PMI's 2018 Pulse of the Profession found 52% of projects experienced scope creep, and EdTech adds obligations most SaaS never carries: FERPA disclosure records, the amended COPPA Rule (compliance date April 22, 2026), WCAG 2.1 AA under ADA Title II, and LTI 1.3 or OneRoster integrations. The 4P Feature Passport turns each of those into a priced line item instead of a mid-project change request.

DevSecOps is the practice of building automated security checks into every stage of software delivery, so security runs with each release instead of after it. For EdTech vendors, it matters because the amended COPPA Rule requires operators to regularly test and monitor their security safeguards, and New York's Education Law 2-d regulations require contractors that receive student data to align with the NIST Cybersecurity Framework. A DevSecOps pipeline turns those obligations into evidence produced on every release, which is what district and university reviewers ask to see.

Enterprise software due diligence typically evaluates a vendor across six key dimensions, and any product handling student or customer PII usually lands in the top tier—where buyers inspect architecture, identity, and logging beyond a basic SOC 2 report. AI-built apps carry heightened risk here: Veracode's 2026 testing showed AI models averaging a 56% security pass rate on coding tasks and only 15% on cross-site scripting. Passing requires verifiable proof, including tested tenant isolation, SAML or OIDC single sign-on, SCIM provisioning, exportable audit logs, and a contract-compliant deletion workflow.

A paid trial sprint is a short engagement, typically 2 to 4 weeks, in which a shortlisted vendor's named engineers build a real, non-critical backlog item inside your own repository before you sign a long-term contract. It swaps sales claims for evidence you can check: commit authorship, pull request size and review depth, whether required CI checks gated every merge, and weekly working demos on staging. The Repo Evidence Test scores those five signals pass or fail, and a fail on authorship or pipeline discipline should end the evaluation.

AI governance in EdTech is the system an education software vendor uses to classify each AI feature against EU AI Act Annex III, evidence the resulting obligations, and hand that evidence to institutional buyers. Four functions trigger high-risk status in education: determining admission or access, evaluating learning outcomes, assessing the appropriate level of education, and monitoring students for prohibited behaviour during tests. Regulation (EU) 2026/1744 moved Annex III high-risk obligations to 2 December 2027, but Article 50 transparency duties already apply, emotion inference in education has been banned since February 2025, and a provider claiming the Article 6(3) exemption must document that assessment before shipping.

Choosing between nearshore and offshore EdTech development depends on how much synchronous work your roadmap needs, not on where student data is legally allowed to go. FERPA's school official exception turns on direct control and use limits rather than location, and the amended COPPA Rule (compliance date April 22, 2026) requires a written information security program wherever developers sit. The one federal rule that names countries, the DOJ Data Security Program, lists six countries of concern, including Venezuela, and the Philippines isn't one of them.

The SIS vs LMS difference comes down to records: a student information system (SIS) is the system of record for enrollment, schedules, attendance, and final grades, while a learning management system (LMS) runs instruction, assignments, and working scores. For EdTech products, rosters flow down from the SIS through 1EdTech's OneRoster standard, and scores flow up through LTI Assignment and Grade Services into the LMS gradebook, not the SIS. Google Classroom, which holds 31% of active K-12 LMS implementations, isn't directly compatible with LTI tools, so it needs its own integration.

Monitoring a vibe-coded app means proving the user's path still works, not just that the server responds. Columbia University's DAPLab built more than 15 applications across five AI coding agents and found error handling and business logic to be the most serious and common failure patterns, and both fail silently while the app keeps returning a normal 200 OK. Reliable coverage runs in four layers: server checks every 30 to 60 seconds, response-shape checks on key endpoints, scripted browser journeys through your revenue paths, and a recurring reconciliation that confirms the business recorded what the customer actually did.

Student data tokenization replaces district-issued student identifiers with opaque values your platform generates, so a copy of your database identifies nobody. It matters because bulk rostering under OneRoster transfers a complete district data set that overwrites the last one, and because the FTC's June 2026 order against Illuminate Education requires that company to delete student data it does not reasonably need and to stop collecting more. EdTech vendors shrink breach scope and shorten district security review by moving from bulk CSV sync to delta sync, to live API reads, and finally to tokenized identifiers.

Student-centered EdTech UX/UI design evaluates usability alongside instructional goals. Task speed can matter, but it should not be optimized at the expense of comprehension, accessibility, engagement, or the learning activity’s intended outcome. It differs from standard SaaS design in four measurable ways: it protects working memory instead of minimizing clicks, it splits one interface across developmental age bands, it treats WCAG 2.2 accessibility as a build input rather than a pre-launch audit, and it validates in classrooms rather than labs. NN/g recommends touch targets of at least 2 cm by 2 cm for young children and describes this as four times its 1 cm by 1 cm recommendation for adult users. Treat this as NN/g usability guidance, not a WCAG requirement or universal clinical standard.