Tablet management console for schools

Schools use more tablets in class every year, but most have one IT person, if any.

• Consumer settings on school devices: students install games, add personal accounts and change settings.
• Tablets shared across classes: one cart serves several sections a day, each needing different apps.
• Exams on tablets: a test must lock every device to one app, then release it afterwards.
• Child safety and consent: web access needs filtering, and India's Digital Personal Data Protection Act generally requires verifiable parental consent for children's data and restricts tracking them, with narrow exemptions for schools in the DPDP Rules, 2025.
• Two platforms: many schools own both iPad devices and Android tablets and want one place to manage them.
• End of year: hundreds of devices must be erased and set up again for new students.

• School console (Next.js): devices organised by campus, grade, section and cart; a profile per grade; app sets per subject; an exam calendar; and readiness reports for the principal.
• Teacher view: a simple page to check which tablets are ready for a class, request an exam lock and report a broken device. For live lesson control on iPad, teachers use the Classroom app.
• iPad management: built on the Apple MDM protocol, with devices assigned in Apple School Manager and set up through Automated Device Enrollment.
• Android management: built on the Android Management API for Android tablets bought through zero-touch resellers or enrolled with a QR code.
• Parent notices: consent forms and plain-language notices that explain what the school can and cannot see.

• Tenancy: one tenant per school or school group, each with its own Apple School Manager connection and Android enterprise.
• Apple side: MDM check-in and command services with pushes through APNs, declarative device management where the iPadOS version supports it, and class groups built from Apple School Manager rosters.
• Android side: a policy per grade through the Android Management API; the exam lock is a kiosk policy applied on schedule and removed afterwards.
• Scheduling: exam windows and school-hours rules run as scheduled jobs that apply and remove profiles or policies, with a log of every change.
• Data: PostgreSQL for schools, devices and audit logs, with student data limited to names, classes and device assignments; Redis for command queues.
• Certificates: the product owner holds the MDM vendor certificate from Apple and signs each school's push certificate request; each MDM push certificate is renewed every year with the same Apple Account.