Frequently asked questions

What is SetFlow?

SetFlow is an AI-native learning management system for K-12, higher education, and individual students. It combines classroom workflows (rosters, assignments, quizzes, gradebook), study tools (notes, decks, co-study rooms), and an embedded AI assistant called Tori. Free for individual students. Per-seat pricing for teams and per-student pricing for schools.

What is BYODB and how is my data protected?

BYODB stands for “bring your own database.” Institutions provision and operate a PostgreSQL-compatible database in their own environment and point SetFlow at it via a private network connection. All durable student records (names, emails, grades, assignments, messages) live in the institution's database. SetFlow holds configuration only — institution name, subdomain, billing, and an AES-256 encrypted connection string.

On top of BYODB, SetFlow uses TLS 1.2+ in transit, AES-256 at rest, hardware-backed key management, and tenant-isolated queries at the application layer. See Security overview and Bring your own database.

Can I use SetFlow alongside Canvas (or any other LMS)?

Yes — and this is the question of 2026, so we answer it in full.

Short answer

SetFlow supports full LTI 1.3 Advantage integration including Core, AGS, NRPS, and Deep Linking 2.0. This means institutions can use SetFlow alongside Canvas — students click SetFlow from within Canvas and are automatically logged in — while keeping student data in their own database via BYODB. Schools don't have to choose between their existing LMS and data sovereignty.

Longer answer

A typical pilot looks like this:

• The institution keeps Canvas (or Schoology, Moodle, Brightspace, D2L) as the system of record for the term you're piloting in. No rip-and-replace.
• SetFlow is registered as an LTI 1.3 tool in your LMS. Teachers see a SetFlow tab inside their Canvas course; students click it and are auto-logged in — no separate sign-in, no separate password.
• NRPS keeps the SetFlow roster in sync with your Canvas roster. Students added in Canvas show up in SetFlow; students removed in Canvas disappear from SetFlow.
• AGS pushes grades from SetFlow back to your Canvas gradebook. Canvas remains the gradebook of record. Teachers grade in SetFlow's SpeedGrader (with optional AI assistance), release grades, and the scores flow back into Canvas.
• BYODB keeps the student records in your database — not in SetFlow's, not in any vendor's. The institution sets retention windows, controls deletion, and runs backups on its own schedule.

The architectural payoff: even if a SetFlow infrastructure breach happened tomorrow, the records of your students would not be in the dump. They are in your database, which we never held.

Where is student data stored?

Under BYODB (the institutional plan), classroom records — names, emails, grades, submissions, messages, materials — live in your institution's own database, not on SetFlow servers. On our managed deployment, sensitive free-text profile fields are encrypted at rest so a leaked database shows ciphertext for sensitive disclosure, not readable text. Full encryption details on the security page.

What happens if SetFlow gets hacked?

An attacker who compromises SetFlow's servers would find encrypted database connection strings — not student records. Student data lives in your database, not ours. There is nothing to steal from us because we never hold it.

How does SetFlow verify LTI integrations?

Every LMS integration is verified through two independent layers:

• JWT signing against the platform's published JWKS — the same mechanism used by OAuth 2.0. Issuer, audience, nonce, expiration, and LTI version are all verified.
• DNS domain verification, where your institution proves it controls the domain by adding a TXT record we provide. Same trust model as SSL DV certificates.

This prevents anyone from impersonating your institution's LMS. See Security architecture — LTI 1.3 security for the full flow.

Does SetFlow use cookies?

Yes. Two categories, with different attributes for different purposes:

• Session cookies are HttpOnly; Secure; SameSite=Lax. They cannot be accessed by JavaScript and are not sent on cross-site navigations.
• LTI integration cookies use SameSite=None with the Partitioned attribute, which is required for the iframe context and compliant with Chrome's third-party cookie changes (CHIPS).

Can SetFlow see my students' data?

SetFlow can read data from your database to provide educational services — the same way any application reads a database. We cannot copy, export, or retain that data independently. Every access is logged in your database's audit trail, not ours.

What is Tori?

Tori is the embedded AI assistant across SetFlow. For students, Tori is a Socratic tutor — it explains, asks follow-up questions, builds study guides and flashcards, and gives draft feedback before submission without writing the assignment. For educators, Tori drafts rubrics, generates quiz questions from course content, provides AI-assisted first-pass grading that the teacher reviews and overrides, and drafts announcements and parent emails.

Where does Tori show up?

Tori appears across seven surfaces, each with a persona tuned to its context:

• Study mode — the Socratic tutor for students.
• Tori for Educators — the teaching-assistant for staff.
• Project workspaces — the project manager for founders and teams.
• SpeedGrader — the AI grading assistant.
• Co-study rooms — the shared study buddy.
• Supportive check-ins — the companion for stuck or burned-out students.
• Homepage demo (/tori) — a public, no-signup demo of the tutor.

See Tori overview and personas.

What roles does SetFlow support?

Five primary account roles:

• Student — joins courses, studies, submits work.
• Educator — creates courses, authors assignments, grades.
• Founder — owns a workspace; full control of billing and members.
• Team member — joins an existing workspace; capabilities scoped by workspace role.
• School admin — manages an institution from the admin console.

Inside workspaces, members also have one of five workspace roles — Owner, Admin, Manager, Contributor, Viewer. See Roles & permissions.

How does pricing work?

• Free — full study and learning experience for individual students. No card required.
• Pro — monthly subscription for power users; AI pre-review, AI-assisted grading.
• Team — per-seat for workspaces; pooled AI budget, agents, role permissions.
• School — per-student-per-year for institutions; SSO, LTI 1.3, admin console, DPA support.
• Enterprise — adds BYODB, custom retention, named technical contact.

Full pricing is at getsetflow.app/pricing. Schools can pay by purchase order — see Invoicing.

Is SetFlow FERPA, COPPA, and GDPR compliant?

• FERPA — SetFlow operates as a school official with legitimate educational interest. We sign DPAs that codify this relationship.
• COPPA — under-13 students are supported through the school-authorization safe harbor.
• GDPR — for EEA users, SetFlow is the data processor; the school or user is the data controller. Data subject rights are supported via the privacy@ email.
• U.S. state laws — Texas Education Code 32.151, California SOPIPA, Illinois SOPPA, New York Education Law 2-d, and similar — supported via state-specific DPA addenda.

Do you train AI on student data?

Can I migrate from Canvas?

Yes. SetFlow imports rosters via CSV from PowerSchool, Aeries, Infinite Campus, Schoology, and most other SIS exports. Course content and assignments can be imported from Canvas. Affected institutions get migration support during the 90-day pilot — email [email protected] to start.

What if I want to leave SetFlow?

You can export your data at any time. Personal accounts can be deleted self-serve from Settings. School accounts have configurable retention policies aligned with your district's requirements. With BYODB, your durable student records never left your database — there's nothing to migrate back, only an LTI tool to uninstall.

How do I get support?

• General support — [email protected]
• Privacy & data requests — [email protected]
• Security disclosures — [email protected]
• Founder direct — [email protected]