A plain-English guide
Content filters block websites. They don't teach children why some websites are dangerous.
Firewalls block threats. They don't teach users what a threat looks like.
Compliance mandates check boxes. They don't build capability.
A child who understands why personal information is valuable protects it instinctively. A child who is simply blocked from sharing it finds another way.
A parent who understands what a phishing attempt looks like is protected everywhere. A parent whose email filter catches phishing is protected only there.
An IT coordinator who understands their network makes better decisions every day. An IT coordinator who follows a compliance checklist makes better-documented decisions.
Nemesis SL was built on a different premise:
The goal is not compliance. The goal is capability.
We protect immediately. We explain clearly. We teach permanently.
In every alert. In every diagnostic. In every AI response. In every learning module.
For every user. At every level. In their language.
Because the families and schools that need security most are the ones who can least afford to hire someone who already understands it. We built Nemesis SL so they don't have to.
Children on school computers can reach harmful websites, predators, and inappropriate content. Schools know this. Most can't afford to stop it properly.
Students on school-issued Chromebooks are freely accessing video games, movies, and entertainment platforms during class time. Teachers have no visibility into what students are actually doing on their devices. Districts pay for devices that are being used against the very education they're meant to deliver.
Students are submitting AI-generated work as their own — not using AI as a learning tool, but as a replacement for learning entirely. Current platforms have no mechanism to detect, discourage, or redirect this behavior at the network level. The result: students are graduating without the skills their transcripts claim they have.
When a school laptop leaves the building, the school has no idea what a student is doing on it. Often, parents don't either.
Students who don't speak English as a first language often struggle with curriculum written only in English. Schools rarely have the budget to translate materials.
Some states are now passing laws restricting phones in class — but giving schools no technology to enforce them without confiscating phones at the door every morning.
Every piece of this already exists somewhere, sold by a different company, to schools that can afford it.
Cisco, Fortinet, and similar
Securly, GoGuardian, and similar
Khan Academy, Khanmigo, and similar
Chalkie, and similar
A teacher productivity tool, not a school platform — it doesn't compete with Nemesis so much as it could one day feed content into it.
Various vendors
Raptor, Navigate360, and similar
Partial: LockedIn (app, launched March 2026)
These are the tools schools already buy to teach with. They are good at what they do. None of them touches security, and none of them is self-hosted.
IXL
Strong drill-and-practice engine, used by millions of students. Price verified: Wichita Falls ISD board approval, 2026 — 9,200 students, $227,895 total.
NoRedInk
Popular with ELA teachers, strong writing instruction. No published price — we are not estimating one.
Summit K12
Strong ESL instruction for newcomers. No published price — we are not estimating one.
These are competitors' figures, not Nemesis pricing. Nemesis pricing is in section 06.
We build what we can own. We choose vendors deliberately when we need them. And we always have a plan to replace what we license.
Where we use vendors today: Amazon Polly for voice synthesis — removing this weekend after we record our own. Anthropic Claude API for AI features — chosen deliberately for quality, not because we couldn't build something else. The AI is the product's brain. We chose the best brain available.
The principle is not “license nothing.” The principle is: own everything that defines the product. Choose vendors only for what doesn't.
A vendor can change their TTS pricing. They cannot change our curriculum. They cannot change our security platform. They cannot change our agents. The pieces that make Nemesis SL what it is: those are yours. Permanently.
One device, about the size of a small book. It plugs into the school's existing network. The school buys it once. They own it. They control it. Student data never leaves the building.
Blocks harmful websites automatically, updated daily with new threats. Works whether the student is at school, or at home on a school-owned laptop.
IT directors get full visibility and control over every firewall rule on the Nemesis appliance, from the dashboard — no command line needed.
firewall.py) is real and already enforcing rules today; this is a management UI for it, not a new enforcement mechanism.
An AI helper that works with students on their lessons — not doing the work for them. Students must complete their lesson to earn access to it.
Home users don't run high-end security software — not because they don't care, but because they don't understand it. A parent who sees "Suspicious outbound UDP/53 to known malicious infrastructure" does nothing, not because they aren't worried, but because they don't know what it means or what to do about it. The threat continues. The protection fails — not because the software failed, but because it spoke a language the user didn't speak.
Nemesis solves this the way differentiated instruction solves it in a classroom: the same alert, translated into the language the person reading it actually speaks.
The parent acts. The IT coordinator investigates. The security professional responds. One click, saved in the browser, live on every page — a parent in a rural community without IT training gets the same protection and the same understanding as a corporate IT director. Technical awareness shouldn't determine whether a family is protected online.
The setting lives entirely in the browser — never written to the server or the user's session — so it can't be intercepted or overridden server-side, including on a demo or sandboxed install. Coverage today is partial: a substantial share of dashboard text is already tiered this way, but not every element has all three versions yet, and the exact share hasn't been fully measured. This document won't claim "everywhere" before that's true.Every tool Nemesis uses to monitor your network is also a lesson. 19 built-in diagnostic checks — hardware load, disk space, VPN status, DNS health, firewall rules, and more — each one a real window into how your network actually works, not a marketing article about it.
Each check already carries three genuinely distinct explanations of what it does and why it matters — plain English, a technical summary, or the full technical detail — the same Expertise Chooser that changes how alerts read changes how these read too. One click runs any check and shows the real output, live, next to whichever level you've chosen.
For the curious home user: a path from "my internet seems slow" to understanding load averages, memory pressure, and VPN tunnels — because they wanted to, not because they had to. For the school IT coordinator: every system they manage, explained without a computer science degree standing between them and the answer.
No extra subscription. No separate app. Built into the product you already run.Students are limited to educational tools during learning time — no social media, no distractions, no off-topic browsing while lessons are active.
Beyond dangerous content, unprotected school networks allow:
Nemesis blocks all of it during learning time. Students stay on task. Teachers maintain classroom focus. Parents know their child is doing their own work. Academic integrity is enforced at the network level — not by asking students to comply, but by making non-compliance impossible.
Scope, stated because the rest of this document is specific about it: "at the network level" means traffic that crosses the school network or an enrolled school-owned device. A personal phone on its own cellular data is outside that path until the network-level phone control below is built — which is exactly why that item is on the roadmap.Data-driven instructional reporting built into every lesson — teachers see exactly what each student struggled with and what to teach next.
Quiz scoring is live today. The reporting layer that turns it into a teach-next recommendation is in build for the October demo.Nemesis translates into any language Claude knows — 200+ languages and dialects. Schools configure which languages they actively use.
A Vietnamese-speaking student gets the same lesson as an English-speaking student — automatically, at no extra cost. Adding a language is a configuration change, not a development project: there is no language pack to install and no per-language engineering work.
PUNCHLIST.md.
When a school laptop goes home, the protection goes with it — same blocking, same monitoring. The protection lives on the device, not on the building.
Applies to enrolled, school-owned devices.Nemesis monitors every device for missing or compromised security components. ClamAV removed by a student. A security engine that goes absent after a Windows update. Component inventory that changes unexpectedly. Nemesis detects it on the next heartbeat and alerts the administrator immediately.
The administrator sees which device has the problem, exactly what is missing, and how long it has been missing. Detection is instant and certain — the administrator knows before the teacher does.
Automated remote recovery is on the active development roadmap. When complete, administrators will be able to trigger a full component reinstall from the dashboard, delivered silently to the device.
Expected: pre-release. Detection (above) is live today; remote recovery is designed, not yet built.Parents will see what their child is doing on school devices — in their own language, on their phone.
A school-safe version of social media. Students can only access it after completing their lessons.
One button locks down the school. First responders scan a QR code for safe access.
Students get AI help with homework. The system watches for integrity concerns and notifies the teacher — without accusing the student.
Teachers will be able to upload their own lesson content directly into Nemesis. Upload a text file or document — Nemesis processes it automatically:
The teacher reviews and approves everything before it goes live to students. The teacher writes the lesson. Nemesis handles the rest.
Not shipped yet — described here so it isn't confused with what students and teachers can use today.One protocol, one dashboard, multiple platform implementations. The Windows agent solved every hard design problem — attestation, tamper detection, telemetry, dashboard integration; the remaining platforms are translation work against that protocol, not new design work.
The infrastructure to control personal phones on school WiFi — without requiring any app installation — is designed and planned. Unlike current solutions that require an app on every student's phone, Nemesis will enforce school rules at the network level, automatically. This is in development.
Nemesis includes a built-in reading teacher powered by phonics — the evidence-based approach at the center of the Science of Reading movement.
Students get pronunciation support, phonics instruction, and vocabulary building integrated directly into every lesson. The same AI that teaches AI safety teaches reading.
For older students and ESL learners: a song lyrics library where students can bring their own songs or choose from Creative Commons licensed music. The AI teaches phonics, vocabulary, and cultural context through music.
Students can read aloud and receive real-time phonics feedback. The AI hears what they say, identifies the specific error, teaches the rule, and asks them to try again.
A language learning module lets any student practice a new language using the same phonics engine, the same reading library, and the same song library — with AI feedback in the target language.
All of this runs on the school's own hardware. Student voice data is never stored. Audio is processed in real time and discarded.A district administrator sees all schools in their district from one dashboard.
This isn't an idea. It's a working system — and this is exactly what is and isn't built, checked against the actual project, not a wish list.
Every device at the demo location connects to Nemesis running remotely via Tailscale — no local server, no special setup, the same architecture a real school deployment uses. The IT director, or investor, in the room watches in real time as their own devices appear in the dashboard; an unmanaged device attempting to reach a managed one gets blocked; a new device enrolls in about 30 seconds; the AI assistant responds to a real student question; and the cost tracker increments by a fraction of a cent for that call.
This is not a simulation. It is the product, running live, in the room.
Figures (30-second enrollment, per-call cost) are illustrative of a typical demo run, not independently re-measured for this document. As of this writing, this describes the demo as designed. The production dashboard has been running continuously since before today's firewall-rule and AI overage-pool work landed — a restart is required to bring that work online, and a full rehearsal against a freshly-restarted dashboard carrying today's changes has not yet happened.Nemesis costs less than one year of what schools pay today for inferior, fragmented solutions — and there's no year two.
Supersedes every earlier per-student and per-year figure in this document.
| School size | Price |
|---|---|
| Small (under 500 students) | $8,400 — one time |
| Medium (500–1,500 students) | $14,000 — one time |
| Large (1,500+ students) | $21,000 — one time |
| District (5+ schools) | Contact for custom pricing |
$1,200–$3,000/year, by school size. Covers platform updates, new curriculum additions, priority support, and the hardware replacement program.
Completely optional — the platform runs without it.
Nemesis, once, forever: everything above for $8,400–21,000, one time.
Nemesis works alongside schools to identify education-technology grants that cover the full purchase price. E-Rate, Title I, Title IV-A, and state technology grants frequently apply.
Many schools pay nothing out of pocket. We help you find out if yours qualifies.
Contact support@nemesis-sw.com.
Every school starts where it's comfortable and goes as deep as it chooses. No all-or-nothing commitment, no district-wide decision required to get started.
Blocks harmful content automatically. Protects enrolled school-owned devices at school and at home. No curriculum changes, no teacher training.
Who decides: IT director. Time to deploy: one afternoon. Cost: hardware + base license.
Pre-built lessons on AI safety, internet safety, and digital citizenship — already built, translatable into any language the school configures, already tested. Students complete lessons before accessing the AI assistant.
Who decides: principal or IT director. Time to enable: ~10 minutes. Additional cost: included.
A teacher describes a lesson on any subject; the AI builds it; the teacher reviews and publishes it. No district approval needed, no commitment beyond that one lesson.
Who decides: individual teacher. Depends entirely on the Curriculum Builder (section 08 below), which does not exist yet.
A department or school builds curriculum for a full subject, aligned to state standards, reviewed by their own teachers, replacing one subscription at a time.
Who decides: department head or curriculum director. Same Curriculum Builder dependency as Level 3, one tier up.
Curriculum, assessment, AI tutoring, parent portal, and translation in one self-hosted system — Nemesis as the school's primary education platform.
Who decides: superintendent and school board. This is the Phase 3/4 vision in section 08, not a current option.
Nemesis today is a working security platform with one curriculum built on top of it. The company's ambition is bigger — stated plainly here, phase by phase, so it's never confused with what exists right now.
Separate vendors, per category, per year
Total today: $125,000–285,000 per school, per year, forever. These figures are the founder's own working estimates, not independently sourced this session — worth a real citation before quoting them to a grant board. The vision: hardware ($400-600, one time) plus a license, replacing all of it — eventually. Only Level 1 and 2 of that stack (network security, one curriculum) exist today; everything else is the roadmap below.
The market reframe this implies: not a ~$3B school-security niche, but the ~$89.49B global K-12 EdTech market (2023 figure, ~13.4% annual growth, operator-supplied and not independently verified this session) — every school, every subject, every grade, if the full vision is realized.
The most critical real-time student data a school has is attendance: who is in the building right now. Nemesis SL Phase 2 adds a native attendance module that becomes the integration hub for emergency management, parent communication, and compliance reporting.
Teacher dashboard: attendance, curriculum progress, and any security events in one view. Parent contact written from the same screen — no switching between systems, no re-entering information.
Class analytics: attendance patterns by class, curriculum completion by cohort, comparison across classes, intervention flags when patterns change.
District compliance: ADA reporting for state funding, federal compliance data, real-time district-wide headcount, emergency management at scale.
For schools that won't convert: custom connectors to existing attendance systems (PowerSchool, Skyward, Infinite Campus) available as a paid service. The integration works either way — the incentive to convert is the included price.
A connector is a maintenance liability by nature — a separate integration per vendor, breaking every time that vendor changes their API, with accountability split between two companies whenever something goes wrong. Nemesis doesn't compete with connectors by building a better one. It removes the need for one: attendance, security, and curriculum share the same database, the same real-time data, the same agent heartbeat already running on the device. Once a school is on that single system, a connector to a second, separate attendance product stops solving a problem the school still has.
Connectors are available. Most schools stop needing them by year two.
This is not a separate product. This is Nemesis SL becoming the infrastructure schools run on.
Zero code exists yet — same status as the rest of Phase 2. Named here in detail because the design is worked out, not because any of it is built.Nemesis is designed to scale to district deployments. Multi-school management is not built today — it's parked on the roadmap. Three deployment tiers share one codebase: a school buying Tier 2 today receives Tier 3 capability when it ships, at no additional license cost.
How district reporting would work: the district dashboard wouldn't store data from schools — it would query it, in place, on demand, with permission. "Show me all alerts across the district today" becomes the district node asking each school "what alerts did you have today?" Each school answers from its own data. The district sees a unified view. The data never moved.
FERPA by architecture: this wouldn't be a policy — it would be the design. Student data physically couldn't leave a school's appliance because the district node would have no database to put it in.
For parents with children at multiple schools: one parent login, one unified view. The district broker would query each school for that parent's permitted view, aggregate it, and return it — without storing it. Each school would control what parents can see. No school would see another school's data.
For home users: connect a home Nemesis dashboard to a child's school, if that school runs Nemesis, and see the child's permitted school activity from home. The home appliance would be a window — it stores nothing.
None of this is built. This is the design intent behind PRIMARY (Tier 3) above — federated query, not central storage — described precisely rather than left vague. The closest thing in the codebase is a roadmap stub explicitly marked "do not build yet" until district customers are actually in the pipeline.
Scaling — two different numbers, not one: the design principle is to size for the district number, not the school number (10 schools × 2,500 devices = a 25,000-device design target; a large district could reach 50,000+). That's separate from the 50,000-device benchmark quoted elsewhere in this document, which measures one appliance's database throughput (1,467 commits/second measured capacity) — not a multi-node district mesh, which hasn't been built or tested at any scale. Multi-district (spanning several independent districts) is further out still — tracked in the same roadmap stub as "v3+ / possible separate SKU," not yet scoped beyond that.
Privacy by architecture — the Nemesis ID system: this is design intent for the same unbuilt district tier above, not a shipped capability — most of what follows does not exist in the codebase today (one schema-only exception is noted below).
NEMESIS_STUDENT_ID would be generated when a student enrolls, stored at the school only — no student name attached at any level above the school. NEMESIS_PARENT_ID would be generated when a parent registers, verified by school IT staff, linking to student IDs only after administrator verification — self-service linking would not be possible.
The multi-campus parent: a parent with children at different schools would have one NEMESIS_PARENT_ID. The district broker would match it to each school's student records — one login, all children, all schools, with no student data ever leaving any school building.
Most of this is still unbuilt. A parent_links database table now exists (schema only, live as of today, zero rows, no write path yet) — the first real building block for this design — but the IT-verification linking workflow, the parent portal, and the district broker are all still unbuilt. One real building block already ships too: a PARENT capability tier at the single-school level, governing real things like quarantine review under parental vicarious consent — but it's a role on an ordinary account, not the anonymized cross-school identity system described here.
Every answer below is checked against what the platform actually does today, not what's planned. Where something isn't built yet, it's listed separately as "Coming soon" rather than folded into a confident answer.
Q: Does this protect my child at school?
A: Yes. The Nemesis SL agent on managed devices blocks threats before they reach the device. Suspicious activity is flagged in real time and the IT administrator is alerted immediately.
Q: Who can see what my child does?
A: Only school staff authorized by your IT administrator — access to student data is restricted by role. Administrative changes to that access (a grant, a change, an override) are logged with a timestamp and the name of who made it.
Q: Does Nemesis Software see our school's data?
A: No. Nemesis SL is self-hosted on hardware the school owns. The Nemesis SL software does not transmit any data to Nemesis Software or any third party. Your data stays on your hardware.
Q: What if there's a school network security incident?
A: Nemesis SL detects threats in real time and alerts IT immediately. Every device on the network is visible, including ones that haven't been enrolled. An unrecognized device is automatically flagged for IT to review — quarantining it is an action IT takes, not something that happens without a person looking at it.
The Nemesis data volume is encrypted at rest.
Nemesis protects student data with hardware-backed encryption. Student work is reviewed by teachers, not algorithms or a technology company — the school owns the hardware, the school owns the data.
For districts with multiple schools: data travels between school appliances and the district dashboard exclusively over Tailscale VPN — encrypted end to end, never touching the public internet.
Hint comprehension, lesson translation, and the teaching assistant process content via Anthropic's API.
What is sent: lesson text and anonymized student responses.
What is NOT sent: student names, IDs, grades, or any identifying information.
API calls are governed by Anthropic's data processing agreement. Under current terms, API inputs are not used to train Anthropic's models. Schools should review Anthropic's API privacy policy for their own compliance requirements.
AI features can be disabled globally today. Per-feature controls (Lesson Assistant, Hint Comprehension Check, Lesson Translation, Auto-Marker Placement, each independently) are in active development and will be available before release.
Nemesis uses a three-pool budget system so students are never refused a hint or lesson response because of a budget limit.
Nemesis tracks every overage event: which AI feature triggered it, time of day and day of week, how many calls went over the limit, and its estimated cost and duration.
Patterns are surfaced automatically from that history — peak usage hours and days, the most common trigger feature, average overage duration, and monthly overage cost — so IT directors can tune the base limit from real data instead of a guess.
Nemesis is built to enterprise standards from day one. Here is our honest assessment of where we are and what we are actively building:
Schools that deploy Nemesis today receive all future capabilities as they ship — at no additional license cost.
Unknown devices are automatically placed in a restricted network segment. They cannot reach school resources through the guaranteed enforcement path — that specific guarantee is what the Visitor Network Policy below adds. Full visitor policy controls are on the roadmap.
What's confirmed live today: a device without an enrollment tag is placed into a distinct, restrictive DHCP scope. What's on the roadmap: the linked firewall/routing enforcement that formally guarantees a segmented device can't reach internal resources — see Visitor Network Policy, below.This is a genuine differentiator, not a slogan: every competitor sends student data to their own servers. Nemesis doesn't — it's self-hosted, with hardware-backed encryption live today and granular AI controls in active development.
Building all of this in one product requires expertise across network security, artificial intelligence, education technology, and translation — all at the same time.
Large companies build one piece well and charge a lot for it. They have no incentive to combine everything into one affordable, self-hosted package.
Small developers rarely have the security expertise to build the network protection layer correctly.
We believe Nemesis improves outcomes. We need funding to prove it.
These are answerable questions. No one has answered them yet, because no one has had a platform that could ask them. Until now.
Paul is an independent software developer based in Houston, Texas. He built Nemesis because he believes every school — regardless of budget — deserves the same protection as the wealthiest districts.
Certified ELA and ESL Teacher and Instructional Coach, M.Ed., Texas A&M University 2026. She has tested and reviewed the curriculum platform throughout development, and her feedback has shaped every education feature in the system.
Nemesis is not venture-funded. It was built by one person, with one goal: make enterprise-level school protection accessible to every school in America.
135 days.
357,186 lines of code.
One developer.
Zero outside funding.
The platform you are reading about was built by one person.
Paul Lozelle designed and architected every system in Nemesis — the security platform, the education center, the AI assistant, the data-driven teaching engine. Every product decision, every standard, every rejection of work that didn't meet the bar. That was Paul.
Every line of code was written by Claude AI. Not assisted by AI. Not reviewed by AI. Written by AI — under continuous human direction, judgment, and quality control. 15,000+ lines of Python, JavaScript, and SQL. A Windows agent with TPM-backed attestation. A quiz system with server-side scoring. 57 lessons across four grade bands. A unified AI assistant that works across every surface of the platform.
The curriculum was designed by Angela Campbell-Lozelle — a Certified ELA and ESL Teacher and Instructional Coach, M.Ed., Texas A&M University 2026. The research basis, the lesson structure, the age-appropriate content decisions for each grade band — that is her expertise. Claude AI built 57 lessons to her standard. Every lesson was reviewed against her design rules. Her judgment was the quality gate.
This is not a story about AI replacing human expertise. It is a demonstration of what happens when human expertise and AI capability work together correctly.
The platform you are evaluating was built exactly the way it teaches. The method and the message are the same thing.
That is intentional.
Students who complete the Nemesis curriculum read this same statement before their first lesson — in language appropriate for their age.
They begin their AI education already experiencing the principle they are about to learn.
Nemesis's current build sprint — one developer and three AI sessions working toward the October 6 demo — runs eleven days. (The platform itself started earlier than that; this is the sprint that carried it from mid-build to demo-ready.)
Every decision about what to build first was a prioritization decision. We built what students need to learn. We built what teachers need to teach. We built what IT directors need to trust the platform. We built what parents need to understand their child's safety.
We did not build district-level reporting, because there is no district yet. We did not build fleet-scale validation, because there is no fleet yet. We did not build full malware corpus validation, because there is no corpus budget yet.
Those are not omissions. They are correct sequencing: build what proves the concept, validate with real users, scale with real funding.
Takes 2 minutes. Nothing here is stored on our end until you hit send in your own email — see the note below.
A pre-filled email just opened in your email app. Hit send there to actually deliver your feedback — this page can't send it for you.
A pre-filled email just opened in your email app. Hit send there to actually submit your request — Paul will be in touch within 48 hours of receiving it.