This page describes the controls we run today to protect data.
It describes controls that are actually in place in production — not plans. For a countersigned DPA, a security questionnaire, or details for your district's security review, contact ryanhallford@admysterium.com.
All traffic is served over HTTPS with TLS 1.2 or 1.3 only, with HSTS. The database, its backups, and our logs are encrypted at rest (AES-256) on Amazon Web Services.
Each district's data is isolated by PostgreSQL row-level security policies on every district-owned table, enforced by the database for every request — in addition to server-side permission checks on every endpoint. An automated authorization regression test verifies that low-privilege accounts are denied every administrative page and API.
District owners, district and school admins, deans, and platform super admins must sign in with a second factor (an authenticator app, with backup codes for recovery). A session without one does not receive administrative permissions — enforced by our servers, not just the user interface.
Sign-in, passwords, and MFA are handled by Clerk, a dedicated authentication provider. Accounts are invitation-only: signing in without an invitation grants no access to any district. Application secrets live in AWS Secrets Manager, database credentials rotate automatically, and the application connects to its database with short-lived identity tokens instead of a stored password.
Sessions for administrators, deans, counselors, and attendance clerks end after 30 minutes of inactivity; other staff sessions after 8 hours. Signing out clears the session and cached data.
Sensitive actions — such as role grants and revocations and platform-administrator changes — are recorded in a per-district audit log with the acting user and time. The application can add audit entries but can't change or delete them — enforced by database permissions.
The application and API sit behind AWS load balancers with AWS WAF (managed rule sets for common web attacks, plus rate limiting). The database runs in private subnets with no public access.
Error monitoring (with personal data scrubbed before anything is sent), infrastructure alarms, external uptime checks, an AWS CloudTrail audit trail of account activity, and Amazon GuardDuty threat detection — all alerting our team directly.
The database is backed up continuously with point-in-time recovery for the last 14 days. Backups are encrypted, the production database is protected against accidental deletion, and restores are tested: our latest drill restored a full copy of production and verified it in under an hour.
Every change goes through a pull request and must pass automated checks — type checking, linting, the test suite, a dependency vulnerability audit, and a production build — before it can merge. Production deploys are manual and approved. Dependencies are monitored for known vulnerabilities.
We publish our subprocessor list and give districts at least 30 days' notice before adding a new subprocessor that handles district data. A signed DPA is available on request.
Habitus runs on Amazon Web Services (AWS) in the US East (N. Virginia) region: the application in managed containers, data in Amazon Aurora PostgreSQL. AWS's own certifications and attestations (such as SOC 1/2/3 and ISO 27001) cover the underlying cloud infrastructure and are published on the AWS compliance programs page. Habitus does not currently hold its own SOC 2 report.
Security is shared between our providers, Habitus, and each district:
District data is stored in the United States, in AWS's US East (N. Virginia) region. Database backups are kept in the same region.
Habitus does not use analytics, advertising, or third-party tracking cookies — on the website or in the app. The only cookies are those our sign-in provider (Clerk) needs to keep you signed in.
We maintain an incident-response plan covering detection, containment, evidence preservation, and district notification. In a confirmed security incident affecting district data, Habitus will notify district administrators without undue delay, with a target of 72 hours, and cooperate with the district's response and any state breach-notification obligations.
We welcome coordinated disclosure of suspected security issues. Please send reports to ryanhallford@admysterium.com with enough detail to reproduce the issue. Please don't access or modify other users' data, and don't run denial-of-service or social-engineering tests. We aim to acknowledge reports within two business days and will work with you on a reasonable disclosure timeline. See also our security.txt.
Parents and eligible students should contact their school district directly to exercise FERPA or state privacy rights. District administrators can reach us at ryanhallford@admysterium.com for help with data export, correction, or deletion requests.
Last updated: 2026-10-08. For a countersigned DPA or a security questionnaire, contact ryanhallford@admysterium.com.