Subprocessors
Last updated July 10, 2026
SignalForge uses the following third-party service providers to operate the Service. Each is bound by contractual data-protection terms. This list supplements our Privacy Policy and Data Processing Addendum.
Controller: B&K Investment Group LLC (Michigan, USA). Customers with a signed DPA receive at least 15 days' notice before we add or replace a subprocessor.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Lovable Cloud (managed backend) | Application hosting, database, authentication, storage, and serverless functions. | Account data, usage logs, encrypted broker credentials, trading configuration. | United States / Global edge |
| Stripe, Inc. | Payment processing for subscriptions. | Billing name, email, card token (card details never touch SignalForge), plan, invoices. | United States (global processing) |
| Google Analytics 4 (Google LLC) | Aggregate product analytics with IP anonymisation and Consent Mode v2. | Pseudonymous device/session identifiers, pages viewed. Loaded only after cookie consent in EU/UK. | United States / EU |
| Google OAuth (Google LLC) | Sign in with Google. | Google account email and OAuth token, only when the user chooses this sign-in method. | United States |
| Connected brokers and exchanges | Executing orders and reading balances when the user connects an account (e.g. Alpaca, Coinbase, Binance, Kraken, OANDA, IBKR, Bybit, Tradier). | API key/secret, order and balance data — only for accounts the user explicitly connects. | Varies by broker |
Changes to this list
We will update this page when subprocessors are added, removed, or replaced. Customers with a signed DPA can subscribe to change notifications by emailing privacy@signal4ge.com.