Data Processing Agreement

1. Subject matter, nature and duration

We process personal data only to provide the Service: connecting the MetaTrader 4/5 accounts you add, executing the API requests your software sends, and returning the results. Processing lasts for the term of your subscription and ends with the deletion described in section 9.

2. Categories of data and data subjects

• Data subjects: the holders of the MetaTrader accounts you connect, and your users whose data your software sends through the API.
• Data: MetaTrader login and server, broker password (encrypted), account and trading data (balances, positions, orders, deal history), and any other data your software transmits.
• We do not ask for special categories of data (Art. 9 GDPR) and you must not send them.

3. Your instructions

We process the data only on your documented instructions. The Terms, your configuration of the Service and the API requests your software sends are your instructions. If we believe an instruction infringes data-protection law, we will tell you. We process data for another purpose only where EU or member-state law requires it, and then we tell you first unless the law forbids it.

4. Confidentiality

Everyone we authorise to process the data is bound to confidentiality. Access is limited to what each task requires.

5. Security (Art. 32)

We maintain the technical and organisational measures described in Annex 2 and on our Trust Center (https://www.metatraderapi.net/en/trust/). We may improve them over time, but never so that the overall level of protection drops.

6. Subprocessors

You give general authorisation for the subprocessors listed in Annex 3. We bind each subprocessor in writing to data-protection obligations equivalent to this DPA and remain responsible to you for them. We announce a new or replacement subprocessor at least 30 days in advance by email or in the dashboard; you may object on reasonable data-protection grounds within that period, and if we cannot resolve the objection you may terminate the affected part of the Service without penalty.

7. International transfers

Where data is transferred to a country outside the EEA without an adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, or by the EU-U.S. Data Privacy Framework where the recipient is certified. The SCCs are incorporated into this DPA by reference.

8. Assistance, audits and breaches

• Data-subject requests: we help you answer them with the tools in the Service and, where needed, on request.
• Data-protection impact assessments and consultations: we provide the information we reasonably can.
• Personal-data breaches: we notify you without undue delay, and in any case within 48 hours of becoming aware, with the information available at that time, and we update you as we learn more.
• Audits: we make available the information needed to demonstrate compliance, primarily through our Trust Center and written answers to security questionnaires. On-site audits are possible with 30 days' notice, during business hours, at your cost, at most once a year unless required by a supervisory authority or after a breach.

9. Deletion and return

When you delete a connected account, its connection and stored broker credentials are removed; when your subscription ends, we delete the personal data we process on your behalf within 30 days unless the law requires us to keep it. Encrypted backups expire on their normal schedule (currently 14 days). You can export your data through the API before the end of the term.

10. Liability and precedence

Liability under this DPA is subject to the limitation of liability in the Terms, except where data-protection law does not permit it. If this DPA conflicts with the Terms, this DPA prevails; the SCCs prevail over both.

Annex 1 — Processing details

Annex 2 — Technical and organisational measures

• Encryption in transit: TLS on every public endpoint; HSTS on all hosts.
• Encryption at rest: broker passwords and two-factor secrets with AES-256-GCM; account passwords stored only as salted scrypt hashes; database backups encrypted with AES-256.
• Isolation: every connected MetaTrader account runs in its own container with its own memory and CPU limits.
• Access control: server administration only over a private network with personal keys (no public SSH); admin panel behind the private network, password and time-based one-time code.
• Customer accounts: optional two-factor authentication; API keys scoped to a single account where you choose; rate limits per key.
• Least privilege: internal tools read customer data through a read-only database role limited to the columns they need; no access to passwords or broker credentials.
• Availability: automatic health checks of every server, automatic replacement capacity, nightly encrypted database backups.
• Monitoring: service status and incident history published at https://status.metatraderapi.net/.
• Data minimisation: we do not analyse the content of your API requests.

Annex 3 — Authorised subprocessors