Subprocessors

These are the third parties that process district data on Habitus's behalf. We give district administrators at least 30 days' notice before adding a new subprocessor that handles district data.

Last reviewed: 2026-10-08. To be notified of changes, email ryanhallford@admysterium.com.

Active

SubprocessorPurposeDataLocation
Amazon Web Services (AWS)Cloud hosting: application servers, the primary database (Amazon Aurora PostgreSQL), backups, logs, secrets, and network protection (AWS WAF).All district data stored in Habitus: students, staff, guardians, behavior, attendance, safety events, messages.United States (US East, N. Virginia)
ClerkAuthentication: sign-in, password handling, and multi-factor authentication.Staff names, email addresses, sign-in and MFA metadata, IP address and browser of sign-in requests.United States
SentryApplication error monitoring.Error stack traces and technical metadata. Request bodies, query strings, cookies, credentials, and email addresses are scrubbed before anything is sent.United States

Only when a feature is enabled

These are built into Habitus but process no district data until the feature is turned on.

SubprocessorPurposeDataLocation
Amazon Web Services — email & SMSAmazon SES for transactional email and AWS End User Messaging for text messages (safety alerts, notifications), once those features are enabled.Recipient email addresses or phone numbers, and message content, for opted-in recipients.United States
StripePayment processing for district subscriptions, once online billing is enabled.Billing contact and payment details. Stripe is the card processor of record; Habitus never stores card numbers.United States
CleverOptional SIS rostering and single sign-on, if a district connects it.Roster data the district chooses to share through Clever.United States
CheckrOptional volunteer background checks, if a district enables them.Information a volunteer applicant submits for their background check.United States