The problem
First-year medicine and law students spend hours rewriting handouts into revision notes, then revise without structure. The tools they use are generic: flashcard apps don't know their course, and chatbots answer from the whole internet instead of their lecturer's material.
Cortex starts from the student's own course and never leaves it.
The system
- Ingestion. A PDF (parsed in memory) or text becomes a structured study sheet and 10 multiple-choice questions.
- Course-grounded tutor. One chat agent per course, answering only from that course's content.
- Spaced repetition. Reviews scheduled at day 1, 3, 7, 14 and 30, with flashcards and a timed exam mode.
- Freemium. 3 free sheets, then a Stripe subscription (checkout and webhook, in test mode).
- Admin from a phone. Theme, copy, pricing, SEO and sign-ups are edited in a mobile admin panel and go live on the public site in about 30 seconds. Waitlist CRM with CSV export and an audit log.
- Accessible by default. Installable PWA, dark mode, a dyslexia-friendly font and a Pomodoro focus mode.
Decisions worth telling
- A mock AI provider as a fallback. The whole product can be demoed end to end with no API key and no cost. Claude is plugged in behind the same interface.
- Business logic out of the routes. The
server/layer is separate from Next.js routes so it can become a standalone backend later. - Configuration in the database, not in code. Validated with Zod, so a non-developer can run the site from a phone.
- Honest beta trade-offs. In-memory rate limiting and a CSP that still allows inline styles are documented, not hidden.
Security and quality
bcrypt (cost 12), lockout after 5 failed logins, per-route rate limits, origin-checked CSRF protection, strict CSP and HSTS, every query scoped to its user, quiz answers graded on the server, PDF magic-byte checks, revocable sessions and a least-privilege database role. CI lints, tests and builds both apps on every push.
What's next
Cortex runs in production in demo mode: real Claude generation and real payments are built but not switched on, and there are no paying users yet. The next step is a cohort of real students, then turning generation on for them.