Education · Web platform/2026
NomadKids
A deployed kindergarten portfolio platform, integrated with Mongolia's national education system — teachers record development, parents follow their own child, and each history exports as a printable PDF.
- Director
- Teacher
- Kitchen
- Parent
Overview
NomadKids is a digital portfolio for Mongolian kindergartens: teachers record observations and developmental assessments, parents follow their own child's progress and photographs, and administrators manage kindergartens, groups, and staff.
Problem
Kindergartens track child development on paper. Records scatter when a child changes group, year, or kindergarten, and the family is left with nothing to keep. The client's brief also sets strict rules on who may see a child's data.
Solution
A Next.js front end against a NestJS and Prisma API, with authorization enforced server-side per role and per child rather than in the UI — roles live on membership, so one person can be both a teacher and a parent. Sessions use same-site HttpOnly cookies, a short access token with a rotating refresh, and no token ever stored in localStorage. Photos live in a private Cloudflare R2 bucket behind presigned URLs, and reports are rendered as A4 Mongolian-Cyrillic PDFs by a Puppeteer worker pulling off a BullMQ queue.
Outcome
Deployed and serving: nomadkids.mn with its API on api.nomadkids.mn and media on a private bucket, behind a strict content-security policy and HSTS. The ESIS access token was issued and the connection verified end to end; per-service scope is still being granted by the ministry's IT centre, which is an external gate rather than a code gap.
Roles
Roles live on membership, not on the account — one person can be both a teacher and a parent, and every check runs server-side per role and per child.
Director
Sees the whole kindergarten — attendance, groups, staff and reports — and runs the ESIS console: pulls child, staff and institution records from Mongolia’s national education system across 39 wired services, with readiness per service, read-only dry runs, sync history and an audit log.
Teacher
Records attendance, observations and developmental assessments, posts to the class board and builds each child’s portfolio.
Cook
Owns the kitchen: the weekly menu, ingredients, and technology cards with calories per portion, stock levels and food orders. Product types and food categories are pulled from the ESIS reference catalogue rather than typed by hand.
Parent
Follows their own child only — progress, photographs and reports, scoped per child by the authorization boundary.
- In development
Mobile app
In development: the parent experience as a React Native app, so daily updates arrive where families already are.
Gallery
Explore the product screens. Select an image for a closer look.
Engineering highlights
Integrated with ESIS, Mongolia's national education information system: 39 services wired against the ministry's v2 catalogue of 198, chosen on least privilege and matched 39-for-39 against the ministry's own official service list, path for path.
Built by a team of two that I led, across the Next.js front end, the NestJS API and the integration work.
Multi-tenant by construction — one provider token serves many kindergartens through a per-kindergarten ESIS institution mapping, so tenant data can't leak across the integration.
An operator console where a kindergarten admin sees readiness per service, runs a read-only dry run, and reads back sync history and an audit log — without touching live records.
Self-assessed line by line against ministerial order A/261: of 51 mandatory criteria, 35 met, 14 partial, 1 outstanding. Self-assessed, not certified — the distinction is the point.
28-table schema with the authorization boundary written into it, and a security acceptance matrix covering RBAC, tenancy, IDOR, media and reports.