Subprocessors
The data controller is Trepeat, a Malta sole trader, which operates Trepeat using the third-party providers listed below. We engage each subprocessor under a data processing agreement and rely on each provider's published DPA — including, where applicable, the EU Standard Contractual Clauses — for any transfer of personal data outside the European Economic Area. Each subprocessor processes personal data only on our documented instructions, in accordance with the commitments in our Privacy Policy.
Current Subprocessors
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase (Postgres + Auth) | Database, authentication, file storage | Email, magic-link session data, optional TOTP 2FA factor + bcrypt-hashed recovery codes, profile data, broker account metadata, broker credentials (encrypted in Supabase Vault), repeater configurations, trade history, subscription records, support tickets, and files you upload (profile pictures, journal screenshots) | US (AWS us-east-1) |
| Amazon Web Services (Lambda + ECS Fargate + Amplify + CloudWatch + Secrets Manager) | Compute (serverless functions + the trade-repeating engine on ECS Fargate), website hosting (Amplify + CloudFront), logs, encrypted secret storage | Request and response payloads (no broker credentials in logs), structured operational logs | us-east-1 |
| MetaAPI | MetaTrader connectivity, trade execution | MT4 / MT5 login, password and server (MetaAPI stores these to keep the account connected; our own copy is in Supabase Vault), account number, positions, balances, trade history | Region assigned by MetaAPI per broker server (commonly London) |
| Spotware Systems (cTrader Open API) | cTrader sign-in (OAuth), cTrader account data, trade execution | The authorisation you grant on cTrader's site (access and refresh tokens), cTrader account numbers, positions, balances, orders | Spotware's cTrader Open API servers |
| Stripe | Subscription billing, payment processing, tax calculation, customer portal | Email, billing address, last four digits of card (held by Stripe; shown to you in the app, not stored in our database), subscription status, number of paid accounts, and a business name and tax ID if entered at checkout | US and EU (PCI SAQ A) |
| Cloudflare | DNS, CDN, DDoS protection; Turnstile bot protection on the sign-up and waitlist forms | Request metadata (IP, user-agent), no payload; for Turnstile, your IP address and browser signals | Global |
| Resend | Transactional email (sign-in links, billing and subscription notices, security and repeater alerts, policy change notices, and product-update emails if you opted in) | Email address, plain-text and HTML email body | EU |
| PostHog | Product analytics (consent-gated, opt-in only) | Supabase user id, email, display name, subscription type + status, named product events, page views and page-leave events, page addresses and referrers, page-load performance, error reports with stack traces | EU (Frankfurt) |
Changes to This List
We may update this list from time to time. When we make a material change we will revise the "Last updated" date above and notify registered users by email before the change takes effect. Continued use of Trepeat after the effective date constitutes acceptance of the revised list.
Contact
Questions about our subprocessors or data-processing arrangements? Email privacy@trepeat.com.