Trust & Security

This page describes the controls we run today to protect data.

This page is maintained by Habitus. It describes controls that are actually enabled in the product — not aspirations. If you need a countersigned DPA, a subprocessor list, or details for your district's security review, contact security@habitusvia.com.

Encryption in transit and at rest

All traffic to Habitus is served over TLS 1.2+. Application data, database backups, and file storage are encrypted at rest with AES-256 by our infrastructure provider.

Role-based access & tenant isolation

Every district's data is isolated with row-level security enforced in the database, not just the app. Roles (teacher, dean, school admin, district admin, super admin) are stored in a dedicated privileged table and checked by security-definer functions on every read and write.

Enforced multi-factor authentication for admins

District admins, school admins, deans, and super admins are required to enroll a TOTP authenticator (Google Authenticator, 1Password, Authy, etc.) before they can access the app. Sessions without a verified factor are redirected to enrollment.

Password hygiene

New and changed passwords are checked against the Have I Been Pwned breach corpus and rejected if they've appeared in a known breach. Open self-signup is disabled; users are provisioned by district administrators or an approved SIS sync.

Idle session timeout

Admin and dean sessions time out after 30 minutes of inactivity. Other staff sessions time out after 8 hours. Sign-out clears both the session and cached protected data.

Append-only audit log

Sensitive actions — role changes, data exports, impersonation, referral edits, safety alerts — are written to an audit log protected by database triggers that block update and delete operations.

Threat & impersonation alerts

Threat-keyword detection on student communications, impersonation-session logging for admin support, and automated security alerts on privileged role changes.

Backups & restore verification

The database is backed up continuously by our infrastructure provider with point-in-time recovery. We log periodic backup verification runs internally so we know restores actually work — not just that backups exist.

Change management

Every code change is peer-reviewed via pull request, runs through an automated test suite (authorization regression tests, load tests, end-to-end tests), and ships behind CI checks before it reaches production.

Vendor & subprocessor discipline

We keep a public list of subprocessors and give districts at least 30 days' notice before adding a new one that handles student data. A signed DPA is available on request.

Built on a security-minded platform

Habitus is built on the Lovable platform. Lovable maintains a security and compliance program, and publishes its current certifications, attestations, and data-processing practices on its Trust portal and Security page. Habitus runs on Lovable's managed infrastructure and benefits from the platform's encryption, tenant isolation, and operational security controls. If your district needs a product-specific security questionnaire or a countersigned DPA, contact security@habitusvia.com.

Shared responsibility

Security is a shared effort between the platform provider, Habitus, and each district. Responsibilities break down as follows:

  • Lovable platform — cloud infrastructure, managed database, authentication service, file storage, CDN, DDoS mitigation, and the platform-level certifications listed above.
  • Habitus — application logic, role and permission enforcement, audit logging, feature-level security controls, incident response, and district support.
  • District — user provisioning and deprovisioning, access reviews, enforcing MFA policy, accurate data entry, and notifying affected families or regulators when required by law.

Data handling

  • Habitus acts as a school official / service provider under FERPA and processes district data only on the district's documented instructions.
  • Student data is never sold, never used to train third-party advertising models, and never used for marketing.
  • Districts can export their data or request deletion at any time. On subscription end, data is returned or deleted within 30 days.
  • Deletes are soft-deletes with a retention window; a scheduled purge removes data permanently after that window.

Data residency

Habitus stores district data in the United States through our infrastructure provider. Backup and disaster-recovery copies are also maintained in US regions.

Cookies and analytics

The public Habitus website uses minimal cookies for navigation and basic analytics. The Habitus app uses session cookies required for authentication. We do not use advertising or third-party tracking cookies inside the app.

Incident response

We maintain an internal incident-response runbook covering detection, containment, forensic preservation, and district notification. In a confirmed security incident affecting district data, Habitus will notify district administrators without undue delay, with a target of 72 hours, and cooperate with the district's response and any state breach-notification obligations.

Vulnerability disclosure

We welcome coordinated disclosure of suspected security issues. Please send reports to security@habitusvia.com with enough detail to reproduce the issue. We aim to acknowledge reports within two business days and will work with you on a reasonable disclosure timeline.

Privacy rights and access requests

Parents and eligible students should contact their school district directly to exercise FERPA or state privacy rights. District administrators can reach us at security@habitusvia.com for assistance with data export, correction, or deletion requests.

Where to go next

Last updated: 2026-07-13. This page is maintained by Habitus and describes controls that are enabled in the product. For a countersigned DPA, product-specific questionnaire, or current platform compliance documentation, contact security@habitusvia.com.