How we use sub-processors
This register includes current, optional, and retained legacy relationships. A written Data Processing Agreement ("DPA") is required where applicable under GDPR Article 28, the DPDP Act §11, the UK GDPR, or the California CCPA. The recorded execution status is shown below; a pending or unconfirmed agreement is not presented as executed.
Before we add a new sub-processor, we notify affected account holders at least 30 days in advance via email and via an updated commit to this page. To object to a new sub-processor, email [email protected] and we will work with you in good faith on an alternative. You may also stop using the service and delete your account under the Cancellation Policy before the new sub-processor's processing begins. Pro is a one-time payment through Razorpay that never renews automatically, so leaving needs no cancellation.
The full vendor inventory (with SOC2 / ISO attestation status, last review date and risk-assessment notes) and the DPA register are internal records. For vendor-specific DPA references applicable to your account, email [email protected].
Brokers are not sub-processors
TradeLoop does not connect to brokers: you export price history from MetaTrader 5 yourself and import the file. Broker names in retained legacy integrations include Zerodha Kite Connect, Upstox, Angel One, Dhan, MetaTrader 5 brokers, Tradovate, cTrader, MatchTrader and TopstepX. These names are not a list of currently supported connections. A stored adapter or historical record does not grant live access or order authority.
Brokers are not TradeLoop sub-processors under GDPR Article 28 — you (the trader) are the data subject, and your broker is the source of the history you export. Brokers operate under their own regulatory and privacy frameworks, and their own privacy policies apply to your relationship with them.
Current sub-processor register
The register below is canonical. The columns are: vendor (with a link to their public privacy policy); the processing purpose; the categories of data they receive; their primary hosting jurisdiction; the risk tier we assign (CRITICAL / HIGH / MEDIUM / LOW, from our internal vendor register); the DPA execution status, as our DPA register recorded it on 2026-05-23; and the date we last reviewed the vendor's posture.
Recorded purposes can include legacy functionality. They do not confirm that intervention delivery or a connected-account provider is available in this release. Pro payments are processed by Razorpay.
| Vendor | Purpose | Data categories | Jurisdiction | Risk tier | DPA | Last reviewed |
|---|---|---|---|---|---|---|
| Render | Application hosting (FastAPI + Postgres + Redis + MT5 worker) and encrypted backups | All user data, including retained legacy broker tokens (encrypted at rest) | Singapore (primary) · US (Render HQ) | CRITICAL | Executed 2026-05-23 (EU SCCs and UK IDTA addendum included) | Not yet reviewed |
| Vercel | CDN for the React/Vite frontend; edge static asset serving | IP addresses, request headers, static asset cache | Global edge (CDN) | CRITICAL | Not executed: not available on Vercel's Hobby plan; needs a plan upgrade | Not yet reviewed |
| Cloudflare | DNS, WAF, TLS termination, DDoS protection, and cookie-free aggregate Web Analytics | IP addresses and request/TLS metadata at the edge; aggregate page views and Web Vitals in Web Analytics | Global edge | CRITICAL | Executed 2026-05-23 (EU SCCs and UK IDTA included) | 2026-07-11 (analytics disclosure review) |
| Razorpay | Payment processing (UPI / cards / wallets) for Pro purchases | Email, billing name, GSTIN, billing address, payment IDs (no raw card data — Razorpay tokenises) | India | CRITICAL | Requested 2026-05-23; awaiting Razorpay's reply | Not yet reviewed |
| Resend | Transactional email (email confirmation, password reset, data-ready messages) | Email addresses, email content | United States | HIGH | Executed 2026-05-23 (EU SCCs and UK Addendum included) | Not yet reviewed |
| Sentry | Error monitoring + session replay (PII-scrubbed before send via app/main.py::_scrub_string) | IP, browser metadata, scrubbed error payloads, replay (consent-gated, masked text by default) | United States | HIGH | Executed 2026-05-23 (version 5.1.0; EU SCCs and UK Addendum included) | Not yet reviewed |
| BetterStack | Uptime monitoring and public status page | Public endpoint probe responses; no user PII | European Union (Germany) | HIGH | Not started | Not yet reviewed |
| PostHog | Optional authenticated product-event mirror; inactive unless a server API key is configured | When enabled: user ID and scrubbed event properties; no production deploy key is currently declared | US + EU regions available | MEDIUM | Executed 2026-05-23 (countersigned; EU SCCs and UK Addendum included) | 2026-07-11 (inactive configuration verified) |
| Plausible | Legacy marketing-analytics integration; browser shim is disabled and retained only for compatibility | None while disabled | European Union (Germany) | MEDIUM | Not started (EU-based; integration disabled) | 2026-07-11 (disabled shim verified) |
| Crisp | Live chat support (consent-gated post-Wave 0.1 cookie banner) | Visitor IP, email if provided, chat transcripts | European Union (France) | MEDIUM | Not required while no data flows to Crisp (recorded 2026-05-23) | Not yet reviewed |
| GitHub | Source code, CI, dependency scanning | Code, CI logs, secrets metadata (no production user data transits GitHub) | United States | LOW | Covered by GitHub Customer Agreement | Not yet reviewed |
Last updated · 2026-10-10. We aim to review each vendor every quarter; the last column shows the latest review, or that none has happened yet.
How we handle sub-processor changes
When we add or remove a sub-processor we follow a predictable, customer-friendly process. The exact procedure is documented in our internal vendor register (additions and offboarding); the commitments surfaced here are the customer-facing summary:
- 30 days' email notice to affected account holders before a new sub-processor begins processing. The notice is sent from
[email protected]with the subject "TradeLoop sub-processor update — effective <date>". - Public page update on this page at the same time as the email notice. Customers who don't open the email can still see the change here.
- Right to object by emailing [email protected]. We will work with you in good faith on an alternative or, where no alternative is possible, you may stop using the service and delete your account before the new sub-processor takes effect. Existing refund and data-rights remedies remain available.
- Vendor offboarding includes API-key revocation, request for confirmation of data destruction per the DPA's data-deletion clause, and a follow-up confirmation email to customers when the vendor's deletion certificate is on file.
Change history
The dated history below, newest first, complements the live register above. When we add or retire a sub-processor, or a DPA status changes, we add an entry here so a customer auditing the change can reconstruct the timeline.
- 2026-10-10: DPA statuses now match our DPA register (recorded 2026-05-23): executed with Render, Cloudflare, Resend, Sentry and PostHog; Vercel's needs a plan upgrade; Razorpay's awaits the vendor's reply; BetterStack's and Plausible's have not started; none is needed for Crisp while no data flows to it.
- 2026-07-11: analytics rows reviewed: Cloudflare Web Analytics, PostHog (inactive) and Plausible (disabled).
- 2026-05-15: initial publication of this page. The sub-processor list represented the live set of vendors as of this date; it pre-existed but had not been published in this customer-facing format.
Older changes pre-dating this page are kept in our internal vendor register and are available on request from [email protected].
Contact
Questions about a specific sub-processor, the DPA terms we have with them, or your right to object to a new sub-processor — email [email protected]. Our broader privacy notice (data categories, rights, complaint channels) is at /privacy; security disclosure at /security.