Every company that could touch your information

Not a supplier in the usual sense — S2 Funding LLC is the second half of the transaction itself, and is named on your agreement and in every disclosure on this site. Dollar Loans LLC arranges the funding; S2 Funding LLC provides it.

Whoever serves these pages sees the request itself — an IP address and a page path. There is no analytics tag on this site, so that request log is the whole of it.

Whoever hosts the database holds the tables, but not the contents: every personal field in an application or a message is encrypted by this application before it is written, with a key the host never receives, so what sits on their disk is ciphertext plus the dates and stages needed to run the queue. Log-in records hold no personal information at all — opaque identifiers and one-way hashes. No database is contracted yet; until one is, nothing is stored anywhere but in memory.

Nobody holds your documents today, because the application flow is not accepting real applications yet. The store is contracted and named here before the first one is.

The check that stops somebody else getting title funding on your car. It requires showing a third party your identity document, which is exactly why the third party gets named here.

This one is live today, and it is the only thing on this list that is. Put a VIN or a plate into the free recall checker and that identifier is sent from our servers to NHTSA’s public vPIC and recalls services to get the answer back. Nothing about you travels with it — no name, no contact details, no application — and there is no contract behind it because a federal agency does not offer one. It is on the register anyway, because "we have no agreement with them" is not the same as "they never see anything".

Separate from the identity lookup above, and not live: every valuation on this site today is generated locally and labeled as an estimate. When a real valuation source is contracted it is named here, and it will receive a VIN and mileage rather than anything about you.

Card and bank details should reach a processor directly and never be stored by us. That is the architecture; the processor is not selected yet.

The certificate behind an e-signature is what makes the agreement stand up later, so this one is chosen on evidence quality rather than on price.

Your email address and phone number reach whoever sends the message. The content of what we send is deliberately thin — a one-time code, or a note asking you to log in and read the rest here.

Whatever you write to us lands in it, which is why it is on this list even though it feels like an internal tool.

Configured to strip personal information before a report leaves, because the most common way a company leaks data to a monitoring vendor is by accident, in a stack trace.

Counts how many times one address has tried to ask for a code, present one, use a passkey or refresh a session, so the limit means the same thing on every server. The address itself never reaches it: what is stored is a truncated one-way hash and a number, and the counter expires with the window — minutes, not days. Until a host is contracted the counter lives in the process itself, which is why a production deployment refuses to start without one.

Holds the private key that signs your log-in session and nothing else: it never sees your name, your account or anything about you. What reaches it is an opaque session record to sign and what comes back is a signature. It is on this register because a company that holds our signing key can, in principle, mint a session — so it is chosen and named here before it holds one. Until then the key lives in the process itself, which a production deployment refuses.