The Eformogi Principles
Eformogi is a record of learning the student owns, witnessed by the adults who were there, verifiable at one link with no login, and issued by the schools and counselors who hold the learners. These are the rules we hold ourselves to. They predate the company. They will outlast any individual feature.
1. The individual owns their context
The record belongs to the person, not to us, not to the institution that asked for the data, not to any AI agent that touches it. Always. There is no "platform fee" on ownership.
Why the family holds the keys
Every few years, an institution-side product holding student or family data has a breach, a policy change, or a quiet acquisition that re-prices the relationship. The family bears the cost. The institution writes a notice. The settlement, if there is one, arrives years later.
Eformogi is built so this pattern cannot happen here. The record is the family's. The consent history is the family's. The audit trail is the family's. When a counselor or a school sends a document, it lands in the family's own record, labeled with who sent it, instead of a system the family cannot see, cannot leave, and cannot revoke.
This is not a marketing position. It is the architectural inversion the other principles on this page enforce, and it is the reason a school can issue on this record without ever coming to own it.
2. The record is free for the learner. Forever.
We do not charge the people the record belongs to for their own record. Capturing, witnessing, issuing, exporting, and verifying never cost the family anything. Somebody else pays instead: the schools and counselors who issue on the record, per learner per year, and an office that asks us for a hosted verification service at volume. Families who want their state paperwork rendered and filed can choose to pay for that, and the record itself is never behind it. If the record ever stops being free for the learner, we have stopped being Eformogi.
3. Consent is an artifact, not a checkbox
Every share creates a signed, scoped, time-bound, revocable record. Purpose stated. Categories listed. Duration set. Downstream-sharing rules attached. This is what makes the data trustworthy on the receiving end and recoverable on the sending end.
4. Proof-minimization by default
Share the smallest piece of information that answers the question. "Is this child old enough to participate?" gets an answer, not a date of birth. The institution gets what it needs. The person doesn't give up more than that.
5. Receipts for everything
Every access leaves a record. Human or AI agent. The person can see it, audit it, revoke it. No silent reads. No surprise sharing. No "we updated our terms."
6. AI agents are users, not owners
An agent acting on a person's behalf operates under that person's consent rules. Not its own. Not the model vendor's. Not the institution's. The agent surface is governed by the same consent layer humans use, with the same audit trail.
7. Infrastructure, not platform
We are picks-and-shovels. We do not aggregate user attention. We do not run a feed. We do not monetize engagement. Stripe doesn't compete with the businesses on Stripe. Cloudflare doesn't compete with the sites on Cloudflare. We don't compete with the people on Eformogi.
8. The institution never owns the record
Schools, microschools, learner-driven networks, online schools, independent counselors, and eventually districts are the people who already hold the learners, so they are the people who issue on this record. They may pay to issue on it. They may never own it. The learner holds the keys and the export, and an issuer that stops paying leaves its learners with the record intact.
This is a real constraint, not a slogan. It rules out every arrangement where a school buys a record it can hold back from a family, and it is why the price is per learner rather than per seat. The founding terms are published at /issuers.
9. The protocol is open
The receipt grammar, the witness attestation format, the key model, the transparency log, the verification rules, and the export format are published, not held. A receiver can verify a record with a reference verifier that never contacts us, and anyone can write their own implementation against the same chapters we build against. Read them at /spec.
We tried the other order first. A standard that only works while one company is up is not a standard, and a family whose record depends on our servers staying online does not really own it.
10. The intelligence layer is replaceable. The record is not.
Models change every six months. Any agent can fill a form. Only the record can prove who witnessed the work. What compounds instead is the consent receipts, the audit trails, the verification provenance, and the relationships between families and the receivers they trust. We invest in what compounds.
11. We do not sell data. Ever.
We do not sell it aggregated, we do not sell it anonymized, we do not license it for research, and we do not hand it over to improve someone's product. The answer stays no under every future name for the same idea, and any business model that requires changing this answer is one we will not build.
What this means for you
If you are a family whose kid's learning happens outside a normal school: your record is free, forever, by contract. Every share is logged and revocable, and the export always works. Start the record. If you homeschool, see /homeschool. If your school runs Portrait of a Graduate, see /portrait.
If you run a school, a microschool, or a caseload: you issue on the record and the learner keeps it. The founding year is free through June 30, 2027, then $49 per learner per year, billed to you and never to the family, and founding issuers keep that price for as long as they issue. Start as a founding issuer.
If you are a teacher, coach, or mentor who witnesses: signing what you saw is free, takes no account, and produces a receipt you can verify yourself. Counselors who want the caseload view can see it at /counselors.
If you are a receiver (a college, an employer, a scholarship committee, or an underwriter): verifying one link is free, forever, with no account, and an office that wants a hosted verification service at volume can ask us. You will not own the data. That is the feature, not the limitation. For receivers.
If you are a developer or AI lab: the protocol and the MCP surface are open. Any agent can fill a form. Only the record can prove who witnessed the work, and your agent operates under the family's consent rules. Read the spec.
If you are a capital allocator: we are building the record that should have existed all along and never did. The reference class is Stripe, Cloudflare, and Plaid, not edtech. We take capital from people who think in decades. hello@eformogi.com.
Questions about a specific principle?
Write to us. hello@eformogi.com. We'll answer in plain language, on the record.