Why self-hosted document editing for education is a different build
A school or university building browser editing for students and staff has to design for two pressures at once: a sharp spike in concurrent editing when term starts, and a population that includes minors and education records protected by FERPA. The editor and the file store both hold that data, so the build is shaped less by the editor's feature list and more by who counts as a school official, who may edit rather than only view a document, and how each access is recorded. Under 34 CFR 99.31(a)(1)(ii), the institution must use reasonable access controls so that school officials see only the records in which they have a legitimate educational interest. In practice that means group-based edit rights in the file platform, view-only shares for most students, and an audit trail that can answer who opened which record and when.
On the platform question, the short answer is that Collabora Online and ONLYOFFICE Docs both fit education, and the choice turns on three things: how faithfully the editor handles the Office files your teachers and administrators actually exchange, what licensing your user count requires, and how your load balancer routes traffic. Collabora is integrated through WOPI and is licensed under MPL-2.0, while ONLYOFFICE Docs is AGPL-3.0 and offers different edition tiers. Confirm the editions, support terms and fidelity results with each vendor against your own templates before you commit. Whichever you choose, plan peak capacity deliberately. The official Collabora Online Helm chart disables horizontal pod autoscaling because scaling breaks collaborative editing, so replica counts are set by hand and must be sized for term-start load, not average use.
Which education rules shape the editing design
This table maps the US federal education and safeguarding rules that touch browser editing of student and staff documents to the specific design decisions they force. Read each row as a question to answer before choosing an editor, identity layer or retention setting. The main takeaway is that FERPA access control and recordkeeping, not the editor itself, usually determine how the deployment is built.
| Rule | What it requires | What it means for the build |
|---|---|---|
| FERPA school official exception (34 CFR 99.31) | Outside parties may see education records only as school officials, under direct institutional control and with redisclosure limits. | Confirm the editing host is run under contract and direct control. Keep the document server inside the institution's accounts and avoid third-party editing clouds. |
| FERPA legitimate educational interest (34 CFR 99.31) | Institutions must use reasonable access controls so staff see only records tied to their legitimate educational interest. | Use directory-based identity and per-group edit and view rights on folders that hold records. Do not grant campus-wide edit rights by default. |
| WOPI traffic to known hosts | Access to records must be controlled across the network, not only inside the file platform. | Restrict WOPI endpoints and the editor's callback paths to named hosts. Confirm this with your chosen platform's WOPI configuration. |
| FERPA access and disclosure records (34 CFR 99.32) | Each request for and disclosure of personally identifiable information must be recorded with the parties and their interests, for as long as the records exist. | Enable audit logging of document opens, edits, shares and downloads. Confirm the logs can be exported and retained for the life of the records. |
| FERPA inspection window (34 CFR 99.10) | Parents and eligible students may inspect records within a reasonable period, and not more than 45 days after the request. | Make documents findable by student identifier and version. Confirm that retrieval and export of editable copies can meet the 45-day limit. |
| COPPA duties for under-13 users (16 CFR Part 312) | Operators collecting personal information from children under 13 need a written security program, annual risk assessments and a written retention policy with deletion timeframes. | If elementary users edit documents, confirm which personal data the editor and file platform store. Set deletion schedules and keep the written program current. |
| GLBA Safeguards Rule for Title IV institutions (16 CFR Part 314) | A written information security program, multi-factor authentication for anyone accessing an information system, and FTC notice within 30 days of a qualifying event. | Require MFA at the identity provider for every editing session. Include the editor and document server in the written program and incident response plan. |
| Retention for documents tied to student records | Records must be kept for as long as FERPA and institutional policy require, and COPPA data must not be kept indefinitely. | Set version and trash retention per folder class. Confirm with counsel which document types are education records before applying deletion rules. |
Which editing platforms fit a campus
A campus usually pairs a browser editor with a file platform that already holds student and staff storage. The choice of editor sets licensing, support and per-user cost, while the file platform decides how identity, sharing and LMS links work. Check both halves together before signing anything.
Collabora Online for campus editing
Collabora Online is licensed under MPL-2.0 and connects to file platforms through WOPI, with listed integrations including Nextcloud and Seafile. The Business plan is priced for up to 99 users, so a district or university with a larger headcount will be quoted on the Enterprise plan, which adds integration support and customization services. Ask whether the edition you are quoted includes signed security updates and long-term support, since the free CODE build is not recommended for production.
ONLYOFFICE Docs for Office-heavy classrooms
ONLYOFFICE Docs is licensed under AGPL-3.0 and is built around Office Open XML, which suits campuses that exchange .docx, .xlsx and .pptx files with students, funders or outside partners. Confirm which edition, support tier and clustering features your user count requires, since clustering is limited to paid editions. Test fidelity on your own coursework templates, grading sheets and accreditation forms before committing.
Nextcloud as the campus file platform
Nextcloud Server is licensed under AGPL-3.0 and can bring Collabora or ONLYOFFICE into its file interface. Its LDAP app lets directory accounts log in, and OpenID Connect and SAML backends are documented, which matters when students and staff sign in through a campus identity provider. Enterprise tiers start at a 100-user minimum, so compare that support and maintenance terms against the free community release and your own patch capacity.
Seafile as a lightweight file platform
Seafile server is released under GPLv2 with an additional permission to link with OpenSSL, which should be reviewed by the campus legal team if it is combined with other components. It supports WOPI integration with Collabora, so the editor can run alongside a simpler sync and share service. Ask the vendor or partner which authentication options, LMS connectors and vendor-backed support tiers are available for your deployment, since these are not covered by the license.
CODE is for evaluation only
CODE, the free Collabora Online Development Edition, is released roughly monthly as a rolling build and is described as suited to testing, home use or small teams, not production. A pilot in a single course or department can use it to check formatting, WOPI routing and LMS links. Plan the move to a supported edition before term start, because a rolling build gives no long-term support or signed security commitments.
How to size editor pods for term-start peaks
Editor pod capacity for a school or university is planned around the busiest days of the year, not the average day. Concurrent editing load rises sharply at term start, when students open shared course templates and staff prepare materials, and again around assignment deadlines when many students edit the same group documents in the final hours. Your sizing exercise should start by measuring how many distinct documents are open for editing at once during the last two or three peaks, using the logs and usage reports your file platform already produces. Ask your platform partner to confirm which metrics the editor server exposes and how they are retained, because a planning figure is only as good than the peak you actually captured.
Collabora's official Helm chart disables horizontal pod autoscaling, and its README states that scaling breaks collaborative editing and copy and paste. Replica counts are therefore set manually in the chart values, and someone must change them ahead of known peaks. The chart's README recommends production limits of 8 CPU cores and 8000 MiB of memory per pod, with requests of 4 cores and 6000 MiB. Treat these as the vendor's starting point, then confirm them against your own load tests on representative course documents, since document size, embedded images and the number of simultaneous editors per file all change the footprint. Plan a schedule that raises the replica count before term start and lowers it afterwards, and write down who has the authority to change it during a deadline week.
Every editor of one document must reach the same pod, because the editing session lives in that pod's memory. The chart README says load balancers must route by the WOPISrc parameter so that all users editing one document are sent to the same pod. Confirm that your ingress (the chart supports Nginx, HAProxy and OpenShift Router) is configured for this routing before the peak, and test it with two accounts editing one file during a rolling restart. Remember that a student who opens a document while a pod is being replaced may lose a session, so schedule replica changes outside active class hours where you can.
Integration points that campuses ask for
Campus document editing rarely stands alone. It connects to the file platform, the learning management system, the directory and the retention rules that already govern student records. The cards below cover the integration points that most often decide whether a rollout passes review.
LMS and file sharing links
Students and instructors usually reach documents from course pages, so the LMS links to files stored in the file platform, and the editor opens from that link. Check whether the LMS can deep-link to a file and whether the link respects the viewer's permissions. Confirm which LMS features open documents in an embedded frame, since that affects which browser sessions and cookies the editor depends on. Test with a real course shell before committing to a link pattern.
Directory sync through LDAP, SAML or OIDC
Campus identity usually lives in Active Directory or a central identity provider. Nextcloud's LDAP app lets directory users appear in the platform and sign in with their directory credentials, and Nextcloud also documents OpenID Connect and SAML backends. Decide which system owns account creation and removal, since departed students and staff should lose editing access promptly. Ask how group membership maps to edit rights for courses and departments.
WOPI trust between file platform and editor
The file platform and the editor trust each other through the WOPI protocol, and the file platform hands the editor a short-lived access context for each session. Campus teams should confirm that only the file platform can reach the editor's WOPI endpoints and that the editor cannot be opened to arbitrary hosts. Ask the partner how the WOPI host address is configured, how certificates are rotated and how traffic between the two services is encrypted inside the campus network.
Backup and retention for documents
Documents, version history and the database that tracks them all need backups, and the restore process must be tested against the same version. Nextcloud All-in-One bundles BorgBackup-based backups, which is one option to evaluate. Retention is a policy decision: confirm how long student work, coursework and staff records must be kept under the institution's own schedule, and whether deleted files and older versions fall inside that window. Ask who can restore a file and how restores are logged.
Nextcloud All-in-One and upgrade rules
Nextcloud All-in-One is the official installation method and bundles Redis and APCu caching, PostgreSQL, optional Nextcloud Office, Talk with recording, backups, ClamAV and full-text search, with a Helm chart for Kubernetes. Upgrades follow strict rules: Nextcloud does not allow skipping major releases, so each upgrade moves one major version at a time, a backup must be taken before every upgrade, and third-party apps stay disabled until their compatibility is confirmed. Build these steps into the change calendar before term start.
Optional self-hosted AI endpoint
Collabora Online 26.04 adds an optional AI assistant across Writer, Calc and Impress. It is off by default, and administrators choose the provider and whether it runs externally or on their own infrastructure. For education, keep it disabled until the institution has decided which student data may reach a model, whether a self-hosted endpoint is used, and what prompts and outputs are logged. Confirm these settings with the vendor for the version you deploy.
How a campus rollout moves from pilot to term start
The sequence turns an editing pilot into a supported service for the whole campus, with each phase closing on a written output that the next phase depends on. Privacy, identity, load and retention decisions are settled before students arrive, not after the first busy week.
Scope the service and map education records
The institution's privacy office, registrar, IT lead and DeployOpen agree which user groups, file locations and courses are in scope, and which records the editors will touch. The team maps where education records, student files and directory data sit, and which staff act as school officials with a legitimate educational interest. The output is a signed scope document and a records map that the privacy office has reviewed, including whether any contractor access is covered by the institution's direct control.
Run a pilot with one faculty group
A single faculty group works in a non-production instance of the file platform and the editor, using real coursework templates and the Office files they already exchange. DeployOpen records formatting problems, font substitutions, co-authoring issues and access surprises in a shared log, and the group reports whether it would use the service for grading and feedback. The output is a defect list with owners and a decision on which fixes must land before load testing.
Load test against projected peak concurrency
The team builds a load profile from the registrar's enrollment figures and the expected term-start pattern, then drives simultaneous editing sessions against the editor pods behind the load balancer. Results show CPU and memory use per pod, how often a session reconnects, and whether all editors of one document land on the same pod. The output is a documented replica count and resource setting for each pod, with the peak the environment was shown to handle and the margin the institution has agreed to hold.
Integrate identity, file sharing and the LMS
Campus directory accounts are connected to the file platform through LDAP, OpenID Connect or SAML, and the editor is registered with the file platform through WOPI so that launch links open in the right session. The LMS integration is tested with instructor and student roles, including which users can edit and which can only view submitted work. The output is a test record showing each role can open, edit or read the documents it should, and cannot reach the ones it should not.
Configure access logging and retention
The team enables audit logging for file access and sharing, sets the retention schedule for versions and deleted files with the privacy office, and confirms that disclosure requests can be answered from the logs. Ownership of the logs, who can read them, and how long they persist are written down. The output is a configuration baseline and a retention schedule that the privacy office has approved, along with a sample log extract reviewed for the fields it needs.
Cut over in stages
Access is opened in groups, starting with staff and a limited set of courses, then extended to further departments and to students once monitoring stays within the load test results. Support staff have a runbook for escalations, and the team watches pod health, error rates and login failures during each stage. The output is a written go-live record for each stage and a confirmed support path before the full student population is enabled.
Hold a post-term review
After the first term runs, the team compares observed peak concurrency with the load test, reviews support tickets and access logs for patterns, and checks whether the retention and access settings still match the privacy office's decisions. Upgrade plans for the file platform and editor are reviewed against the vendor's supported release lines. The output is a review report with a list of changes, owners and dates for the next term.
Evidence a registrar or auditor will request
This table lists the records a registrar, privacy officer or auditor is likely to ask for when reviewing browser editing of education records, and names the component that produces each one. Read it as a preparation checklist: the platform generates some items automatically, while others depend on the institution's own identity, network and governance processes. DeployOpen prepares this evidence, but FERPA compliance and any other determination rest with the institution, independent auditors and regulators.
| Evidence item | Component that produces it | What the reviewer checks |
|---|---|---|
| Access and disclosure log for education records (34 CFR 99.32) | Nextcloud audit logging plus the editor's document access records, exported to the institution's log store | Each access or disclosure of student PII is recorded with the party and legitimate interest, kept as long as the records are kept |
| Group-based edit and view permission exports | Nextcloud group membership and share settings, with directory groups from LDAP or OIDC | Only school officials with legitimate educational interests can edit or view records (34 CFR 99.31(a)(1)(ii)) |
| WOPI host allowlist and network configuration | Collabora Online or ONLYOFFICE Docs configuration, reverse proxy and firewall rules | Editor traffic reaches only known file platform hosts, and the editor does not reach external services |
| Signed update and version records | Editor and file platform release records, plus the institution's own change tickets | Updates come from the vendor's signed releases and were applied within the institution's change process |
| Upgrade and backup logs | Nextcloud upgrade records (one major version at a time), backup job reports and restore test results | Backups were taken before each upgrade and restores have been tested on the data that matters |
| Data retention policy with deletion timeframes | Institutional policy, with deletion jobs in Nextcloud and the storage layer | Retention periods for records and document versions are written down and deletions are logged |
| Written information security program | Institution's governance documents, with DeployOpen supplying architecture, control mapping and test results | The program names owners for access control, monitoring and incident response for the editing stack |
| Third-party contractor agreement and access scope | Institution's contract, plus DeployOpen's access records for implementation and support | Any contractor is under the institution's direct control for the use and maintenance of the records (34 CFR 99.31(a)(1)(i)(B)) |
Questions education buyers ask before hiring a partner
What drives the cost of self-hosted document editing for a university or district?
Cost is driven by user count, the editor edition, server sizing for peak concurrent editing, integration work with your file platform and LMS, and the support plan you choose. Software licences are only one line. The institution pays the partner for scoping, installation, integration, testing and documentation, and pays its own staff or hosting provider for the servers, storage, backups and network capacity the editors run on. Collabora Online's published pricing shows one example of the licence side: the Business plan costs 3 euros per user per month for up to 99 users, and the Enterprise plan for 100 or more users is quoted with volume discounts. Ask every vendor and partner for a quote that separates one-time work from recurring licence, support and hosting costs, and that states the peak concurrency it was sized for.
Is editing licensing for thousands of students charged per user?
For Collabora Online's commercial plans, pricing is published per user, with the Business plan covering up to 99 users and the Enterprise plan quoted for 100 or more users with volume discounts. Other platforms and file platforms use different metrics, such as named users, concurrent sessions or tiered bands, so the answer depends on the product and edition you choose. Student counts also change the picture: a term-based license may cover only enrolled accounts, while guest or alumni access may count differently. Ask the vendor to state in writing what counts as a licensed user, how seasonal changes are handled, and whether the price applies to students who only view documents. Nextcloud's Enterprise pricing, for example, starts with a 100-user minimum, so confirm that threshold against your enrolment numbers.
How long does a self-hosted editing rollout take in a school system?
Duration depends on the number of platforms to connect, how many identity sources and storage locations exist, whether the team is building on existing infrastructure, and how much load testing the institution requires before term start. Fixed-scope work starts with agreed scope, deliverables and timelines in writing before any work begins, so the schedule should come from that document, not from a generic estimate. Plan time for the file platform integration, pilot classes or departments, testing of Office files your staff actually use, and load testing at the peak concurrency you expect in the first week of term. Confirm these milestones with any partner before signing.
What must our IT and privacy staff provide before implementation starts?
The partner will need several inputs from your side before work begins:
- Identity source details, such as the directory or identity provider and the groups that map to students, teachers and staff, which Nextcloud documents for LDAP, OpenID Connect and SAML.
- Storage and file platform access, including the version and administrative rights needed to connect the editor.
- Network rules that define which hosts may reach the editor and document server.
- Infrastructure details for hosting, backups and monitoring.
- A data classification and retention position from the privacy office, covering education records, the applicable FERPA obligations and any data about children under 13 that COPPA may cover.
- A named owner who can approve changes and sign off on test results.
Write these inputs into the scope so the quote reflects who does which task.
Can our internal IT team build and run this without a partner?
Many institutions can run parts of the work in-house, especially if they already operate a file platform and container infrastructure. The harder parts are sizing editor pods for peak concurrent use, configuring load balancers so all editors of one document reach the same pod, testing fonts and Office file fidelity, and maintaining upgrades across both the file platform and the editor. Collabora's Helm chart documentation states that horizontal pod autoscaling is disabled because scaling breaks collaborative editing, so replicas are set manually and load balancers must route by the WOPISrc parameter. Ask whether your team has done this at your peak load before, and whether it has a tested backup and rollback procedure. A partner can deliver part of the work, such as testing, documentation or integration, while staff keep ownership.
How do FERPA and COPPA change the design of the editing platform?
FERPA applies to educational agencies and institutions that receive funds under a program administered by the US Secretary of Education. Under 34 CFR 99.31, an outside contractor may receive education records as a school official only if it performs a service the institution would otherwise perform with employees, works under the institution's direct control, and follows the redisclosure limits. The institution must also use reasonable access controls so staff see only records they have a legitimate educational interest in, and must keep a record of disclosures under 34 CFR 99.32. COPPA applies to operators that collect personal information from children under 13, and it requires a written information security program, annual risk assessments and a written retention policy. These rules change the build: they affect who can see which documents, how logs are kept, and where the service is hosted. Ask counsel to confirm the scope before design begins.
How are upgrades to the editor and file platform handled over time?
Upgrades cover both the editor and the file platform, and each has its own release rules. Nextcloud publishes a new major version every four months and supports each for one year with monthly maintenance releases. Nextcloud does not allow skipping major releases, so administrators must upgrade one major version at a time, back up before every upgrade, and disable third-party apps until they are confirmed compatible. Collabora's 25.04 branch, for example, was still receiving point releases in 2026. Ask any partner for its written upgrade procedure, how it tests the editor against your file platform version, how long each support window lasts, and who pays for upgrade work. Ongoing support and upgrades are available as retainers, so the cost of this work should be quoted separately from the initial build.
What support terms should we require from an editor vendor or partner?
Support terms decide who responds when a fault appears during term start, and they should be written into the contract. Ask what response times apply, which hours are covered, whether security updates are signed and delivered to you, and whether long-term support is included. Nextcloud's pricing describes tiers that differ in maintenance length and support hours, so the tier you buy determines these answers. Collabora's Business plan lists long-term support, a service level agreement, signed security updates and customer portal access, while its free CODE edition is described as not recommended for production. DeployOpen does not publish a price list, and any retainer follows from written scope, so request a quote that names the support hours, escalation path and update process.
What to ask an implementation partner before signing
Start with how the partner sizes editor pods for term-start peaks. Ask for the concurrent editor count they assumed, the per-pod resource figures they plan to run, and the replica count they will set by hand. The official Collabora Online Helm chart disables horizontal pod autoscaling because scaling breaks collaborative editing and copy and paste, so a partner that proposes autoscaling for an editor tier should explain how it avoids that problem. Ask how the load test was built, which documents and user actions it covered, and whether the test used campus-style templates. Ask them to show the sizing worksheet, not only the conclusion.
Next, ask how sticky WOPI routing is configured. The load balancer must send every user editing the same document to the same pod, and the Helm chart README says it must route by the WOPISrc parameter. Ask which ingress they will use (the chart supports Nginx, HAProxy and OpenShift Router), how they test that two students opening one shared essay land on the same pod, and what happens when a pod restarts during a lecture. Ask for the edition and support plan too: the Collabora Business plan is listed at 3 euros per user per month for up to 99 users, and the Enterprise plan for 100 or more users is quoted, so confirm which applies to your headcount and whether student accounts are counted.
Ask how FERPA access logs are produced and retained. Under 34 CFR 99.32, the institution must record each disclosure of personally identifiable information from education records, and the partner should show where editing and WOPI access events land, how the audit trail links a document to a user and a time, and who holds retention decisions. Ask how school official access is limited to records with a legitimate educational interest. Finally, ask how fonts and Office formats are tested on campus templates, how updates are signed and applied, and for a written scope and a fixed deliverable list covering each item above.
