We didn't build another LMS.
We built the one that should have existed before the breach. Three differences that compound: the architecture, the pedagogy, and the pace. Every other point of comparison flows from those three.
Pillar 01
Architecture
Schools can hold their classroom data in their own database.
Every other LMS holds 100M+ student records on centralized servers. The Canvas / Instructure breach in May 2026 exposed 275M of them. SetFlow's BYODB model lets schools on the institutional plan keep classroom data in their own infrastructure — under BYODB, a breach of our servers cannot expose those records because we never held them. The institution is the data controller end-to-end.
Pillar 02
Pedagogy
Built on 140 years of learning research, not vibes.
Spacing effect (Ebbinghaus 1885). Testing effect (Roediger & Karpicke 2006). Interleaving (Rohrer & Pashler 2007). Bloom's taxonomy. Cognitive load theory. Every Tori interaction is built against the same five well-replicated findings the cognitive-science literature has converged on. Receipts on a dedicated page with citable bibliography.
Pillar 03
Pace
One founder shipping faster than your incumbent's entire roadmap.
SetFlow is built solo by Sanithu Hulathduwage in Texas. No quarterly planning cycle. No VC pressure to compromise on student data. The platform you're looking at today was rebuilt root-to-tip in May 2026 in response to the Canvas breach — six weeks. Canvas's response to its own breach was a status-page advisory. The asymmetry is the product.
What you get with each option.
Honest read across SetFlow, the LMS incumbent (Canvas), generic AI (ChatGPT), and the median other AI tutor. Where the answer is “no” or “partial”, we say so.
| Feature | SetFlow | Canvas / LMS | ChatGPT | Other AI tutors |
|---|---|---|---|---|
| Student data lives in YOUR database | Yes (BYODB) | On Instructure's servers | On OpenAI's servers | On vendor servers |
| Architecture survives a vendor breach | Yes | No (May 2026) | No | No |
| AI built into the LMS | Tori across 7 surfaces | Bolted on (Khanmigo, etc.) | Yes (but no LMS) | Varies |
| AI refuses to write the assignment for the student | Yes (hard limit) | N/A | No | Sometimes |
| Pedagogy grounded in cited research | Five principles, public bibliography | Implicit | No | Varies |
| LTI 1.3 Advantage (Core + AGS + NRPS + Deep Linking) | Yes | It is the LMS | No | Some have Core only |
| Free for individual students and educators | Yes, forever | No (paid via school) | Limited free tier | Trial only |
| Free 90-day institutional pilot | Yes | No | N/A | Rare |
| Founder reachable by email | [email protected] | Sales rep | No | Rare |
Built solo. Reachable. Shipping daily.
Most EdTech is shipped by venture-backed companies optimising for the next funding round. Their data model — centralized vendor databases — is a liability the moment a breach lands. Their pace — quarterly product cycles gated by board approval — can't respond to events like the Canvas breach in less than a year.
SetFlow is built solo by Sanithu Hulathduwage, in Texas. The architecture decision that made BYODB central — the most important architectural decision in EdTech of 2026 — was made before the breach happened, in a single afternoon, without committee.
When you email [email protected], the founder reads it. When something on the platform doesn't work, the fix is in production within hours, not after the next sprint planning. That asymmetry is what makes a one-person team competitive with a public EdTech company. It's the whole pitch.
Currently
Applying to Y Combinator S26 (Summer 2026). In conversation with Wichita Falls ISD and a small handful of other early pilot institutions. Founder is reachable directly by every email on the contact page; treat that as the default state, not a phase.
The case for SetFlow is the case against waiting.
Free for students. Free for educators. Free 90-day pilot for schools. Architecture you can audit. Pedagogy you can cite. A founder you can email.