This page describes the controls we run today to protect data.
This page is maintained by Habitus. It describes controls that are actually enabled in the product — not aspirations. If you need a countersigned DPA, a subprocessor list, or details for your district's security review, contact security@habitusvia.com.
All traffic to Habitus is served over TLS 1.2+. Application data, database backups, and file storage are encrypted at rest with AES-256 by our infrastructure provider.
Every district's data is isolated with row-level security enforced in the database, not just the app. Roles (teacher, dean, school admin, district admin, super admin) are stored in a dedicated privileged table and checked by security-definer functions on every read and write.
District admins, school admins, deans, and super admins are required to enroll a TOTP authenticator (Google Authenticator, 1Password, Authy, etc.) before they can access the app. Sessions without a verified factor are redirected to enrollment.
New and changed passwords are checked against the Have I Been Pwned breach corpus and rejected if they've appeared in a known breach. Open self-signup is disabled; users are provisioned by district administrators or an approved SIS sync.
Admin and dean sessions time out after 30 minutes of inactivity. Other staff sessions time out after 8 hours. Sign-out clears both the session and cached protected data.
Sensitive actions — role changes, data exports, impersonation, referral edits, safety alerts — are written to an audit log protected by database triggers that block update and delete operations.
Threat-keyword detection on student communications, impersonation-session logging for admin support, and automated security alerts on privileged role changes.
The database is backed up continuously by our infrastructure provider with point-in-time recovery. We log periodic backup verification runs internally so we know restores actually work — not just that backups exist.
Every code change is peer-reviewed via pull request, runs through an automated test suite (authorization regression tests, load tests, end-to-end tests), and ships behind CI checks before it reaches production.
We keep a public list of subprocessors and give districts at least 30 days' notice before adding a new one that handles student data. A signed DPA is available on request.
Habitus is built on the Lovable platform. Lovable maintains a security and compliance program, and publishes its current certifications, attestations, and data-processing practices on its Trust portal and Security page. Habitus runs on Lovable's managed infrastructure and benefits from the platform's encryption, tenant isolation, and operational security controls. If your district needs a product-specific security questionnaire or a countersigned DPA, contact security@habitusvia.com.
Security is a shared effort between the platform provider, Habitus, and each district. Responsibilities break down as follows:
Habitus stores district data in the United States through our infrastructure provider. Backup and disaster-recovery copies are also maintained in US regions.
The public Habitus website uses minimal cookies for navigation and basic analytics. The Habitus app uses session cookies required for authentication. We do not use advertising or third-party tracking cookies inside the app.
We maintain an internal incident-response runbook covering detection, containment, forensic preservation, and district notification. In a confirmed security incident affecting district data, Habitus will notify district administrators without undue delay, with a target of 72 hours, and cooperate with the district's response and any state breach-notification obligations.
We welcome coordinated disclosure of suspected security issues. Please send reports to security@habitusvia.com with enough detail to reproduce the issue. We aim to acknowledge reports within two business days and will work with you on a reasonable disclosure timeline.
Parents and eligible students should contact their school district directly to exercise FERPA or state privacy rights. District administrators can reach us at security@habitusvia.com for assistance with data export, correction, or deletion requests.
Last updated: 2026-07-13. This page is maintained by Habitus and describes controls that are enabled in the product. For a countersigned DPA, product-specific questionnaire, or current platform compliance documentation, contact security@habitusvia.com.