Last updated: 2026-06-12
Subprocessors
The data controller is Trepeat, a Malta sole trader, which operates Trepeat using the third-party providers listed below. We engage each subprocessor under a data processing agreement and rely on each provider's published DPA — including, where applicable, the EU Standard Contractual Clauses — for any transfer of personal data outside the European Economic Area. Each subprocessor processes personal data only on our documented instructions, in accordance with the commitments in our Privacy Policy.
Current Subprocessors
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase (Postgres + Auth) | Database, authentication, file storage | Email, magic-link session data, optional TOTP 2FA factor + bcrypt-hashed recovery codes, profile data, broker account metadata, repeater configurations | US (AWS us-east-1) |
| Amazon Web Services (Lambda + ECS Fargate + S3 + CloudWatch + Secrets Manager) | Compute (serverless functions + the trade-repeating engine on ECS Fargate), logs, asset hosting, encrypted secret storage | Request and response payloads (no broker credentials in logs), structured operational logs | us-east-1 |
| MetaAPI | MetaTrader connectivity, trade execution | MT4 / MT5 login (encrypted in Supabase Vault), server name, account number, real-time positions | London (default; other MetaAPI regions — New York, Tokyo, Singapore — may be used if a broker requires) |
| Stripe | Subscription billing, payment processing, customer portal | Email, billing address, last four digits of card (Stripe-hosted, never seen by Trepeat), subscription status, extra-slot quantity | US and EU (PCI SAQ A) |
| Cloudflare | DNS, CDN, DDoS protection | Request metadata (IP, user-agent), no payload | Global |
| Resend | Transactional email (login alerts, billing receipts, security + repeater-stopped alerts) | Email address, plain-text and HTML email body | EU |
| PostHog | Product analytics (consent-gated, opt-in only) | Supabase user id, email, display name, plan + subscription status, closed-set product events | EU (Frankfurt) |
Changes to This List
We may update this list from time to time. When we make a material change we will revise the "Last updated" date above and notify registered users by email before the change takes effect. Continued use of Trepeat after the effective date constitutes acceptance of the revised list.
Contact
Questions about our subprocessors or data-processing arrangements? Email privacy@trepeat.com.