Data Processing Addendum (template)

This is the standard template Habitus offers to districts. The binding version is the countersigned PDF stored with your district record. District administrators can request the latest signed copy from support.

1. Roles

The district is the data controller / educational agency. Habitus is the service provider / school official under FERPA and processes data only on the district's documented instructions.

2. Scope of processing

• Categories of data: student records, guardian contacts, staff directory, behavior and attendance records, parent communications, safety event records.
• Purpose: providing the Habitus platform features the district has enabled.
• Duration: for the term of the subscription plus a 30-day return/deletion window.

3. Security commitments

• TLS (1.2 or 1.3) for data in transit; AES-256 encryption at rest for the database, its backups, and logs.
• Database-enforced row-level security tenant isolation; per-district audit log of sensitive actions.
• Role-based access controls; multi-factor authentication required for district and platform administrators; least-privilege access for Habitus personnel.
• When enabled, push, text-message, and email notifications are opt-in per user.

4. Subprocessors

Habitus maintains a public list of subprocessors. Any new subprocessor handling district data is announced to district administrators at least 30 days before it is used.

5. Incident response

Habitus will notify district administrators without undue delay (target: within 72 hours) of any confirmed security incident affecting district data, and will cooperate with the district's response.

6. Audits

Habitus will provide reasonable information to demonstrate compliance, such as a completed security questionnaire (for example, the HECVAT) and its hosting provider's attestations (AWS SOC reports). Habitus does not currently hold its own SOC 2 report. Districts may request additional information at reasonable intervals.

7. Return and deletion

On termination, the district has 30 days to export data from the platform. Habitus will then delete or return remaining data, except where retention is legally required.

8. FERPA acknowledgment

Habitus acts as a school official under 34 CFR 99.31(a)(1)(i)(B), has a legitimate educational interest in the data accessed, is under the direct control of the district with respect to the use and maintenance of education records, and is subject to the re-disclosure and re-use requirements in 34 CFR 99.33(a).

Template version: 2026.10.08. Districts may negotiate amendments before signature.