Subprocessors
These are the third parties Habitus uses to deliver the platform. New subprocessors that handle student data are announced to district administrators at least 30 days in advance.
Last reviewed: 2026-08-19. To subscribe to change notifications, email security@habitusvia.com.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Supabase (managed Postgres, Auth, Storage) | Primary application database, authentication, and file storage. | All district data: students, staff, guardians, behavior, attendance, safety events, messages, files. | United States |
| Cloudflare | Edge hosting, CDN, DDoS mitigation for the web application. | Request metadata, IP addresses (transit). | Global edge, US primary |
| Twilio | SMS delivery for safety alerts, parent communications, opt-in staff notifications. | Phone numbers and message content for opted-in recipients. | United States |
| Resend | Transactional email (referrals, receipts, safety alerts, digests). | Recipient email addresses and message content. | United States |
| Stripe | Payment processing for district subscriptions and add-ons. | Billing contact and payment details. Stripe is the card processor of record; Habitus does not store card numbers. | United States |
| Clever | Optional SIS rostering integration (student, teacher, section, enrollment sync). | Roster data explicitly shared by the district through Clever. | United States |
| Sentry | Application error monitoring. | Error stack traces and minimal contextual metadata. PII is scrubbed before send. | United States |