RightUni

Outcome

A free study-abroad organiser for students, with an end-to-end encrypted vault and a fair, prepaid-credit lead system for vetted partner agencies.

Overview

RightUni follows a student from the first university search to the first day on campus. Anyone can search about 30,000 universities without an account. Students then shortlist universities, record each application whichever route they use (UCAS, Common App, uni-assist, a university portal or an agency), tick off offer conditions and follow ready-made UK visa steps. Passports, transcripts, offer letters and bank statements live in a private vault that only the student can open. Students from the same country going to the same university can find each other through an opt-in Students like you feature. When a student wants help applying, they can follow a free self-guide or choose a vetted partner agency.

Problem

Students applying abroad, mostly from Bangladesh, India and Pakistan, juggle deadlines, offer conditions and visa steps across many universities and portals, and send passports and bank statements around by email and WhatsApp. Many sites in this space are lead funnels that sell student details to agencies without the student choosing. RightUni needed to be free for students, keep their documents unreadable to anyone else, and only pass a student’s details to an agency the student picked, while still earning money from agencies fairly.

My contribution

• Turned the brief into a product spec and PRD for four kinds of user, the student journey, the agency credit model and the data and privacy rules.
• Designed the data model and built the NestJS API, the Next.js website for students, agencies and admins, and the BullMQ background jobs.
• Built the end-to-end encrypted vault: keys are made and used only in the browser, with a passphrase, a recovery key and per-file keys.
• Built the agency portal and prepaid credit ledger, agency vetting, fraud flags and the admin panel.
• Wrote the privacy policy, terms and data-retention rules with the client, deployed RightUni to the VPS and wrote the illustrated system guide.

Technical approach

One NestJS API makes every decision, and the website (and the Android and iPhone apps to come) only talk to it through a published OpenAPI contract. Every endpoint is denied by default; roles are checked in a guard and ownership in the service, so another student’s data returns “not found”. Student, agency and admin tokens have separate audiences and cookies, refresh tokens rotate on every use, and passwords are stored with argon2id. Vault files are encrypted in the browser with AES-256-GCM: each file has its own key, locked by a random vault key, which is locked by a PBKDF2 passphrase key (600,000 rounds) and a recovery key, so the server never sees a readable file or key. Agency credits are spent in one locked transaction with the ledger row, and the database refuses a negative balance. Emails, the monthly university data build, credit expiry and clean-ups run on BullMQ so pages stay fast.

Engineering highlights

• End-to-end encrypted vault: AES-256-GCM per file, PBKDF2 passphrase key and a recovery key; not even RightUni can read a document.
• Fair agency model: 1 prepaid credit per lead, spent only when the student chooses the agency and ticks consent; random order, never ranked by spend.
• Security in layers: deny-by-default API, separate token audiences, rotating refresh tokens, Redis rate limits and a nonce-based CSP.
• University directory built from open data (ROR, Wikidata, Wikimedia Commons, the Home Office sponsor register), rebuilt monthly.

Key features

• Free university directory with search by name, country and city, UK visa-sponsor ticks, credited campus photos and country pages with official links.
• Shortlist and application tracker for any route, with status history, offer conditions, deadlines and a Next up card on the dashboard.
• Ready-made UK visa steps after an offer (deposit, CAS, TB test, ATAS, funds, visa, eVisa, enrolment), each with official links.
• Private vault for passports, transcripts, English tests, bank statements and offer letters, with versions and links to applications.
• Students like you: an opt-in, 18+, give-to-get list of students from the same country going to the same university, with reports and blocks.
• Get help applying: free self-guides for UCAS, Common App, uni-assist and OUAC, or a vetted partner agency the student chooses.
• Agency portal with leads, credit balance, expiry and full history; agencies apply, are vetted and only appear on universities they officially represent.
• Admin panel for agency vetting, credits, leads and fraud flags, Students like you reports, delete requests, dataset builds and SMTP settings.
• Email sign-up with confirmation, password reset, change email, and sign out everywhere; data export and account deletion in Settings.
• App-like phone layout with a bottom tab bar and Add to Home Screen.

Result

RightUni went live on rightuni.co.uk in October 2026, operated by Roy & Associates Limited. Students can search the directory without an account, then sign up free to track applications, store documents in the encrypted vault and ask for help. Native Android and iPhone apps are planned on the same API.

Development timeline

• Spec & design
  Turned the brief into a PRD: four kinds of user, the student journey, the encrypted vault, the agency credit model and the privacy rules.
• Build
  Built the NestJS API, the Next.js website for students, agencies and admins, the encrypted vault and the university data pipeline.
• Agencies & legal
  Added the agency portal, credit ledger, vetting and fraud checks, plus the privacy policy, terms and retention rules.
• Live
  Went live on rightuni.co.uk in October 2026, with an illustrated system guide for the client.