Questions

One tap closes every open position, cancels every working order, and locks out trading across every account you have connected — from your phone.

It is not a trading tool. It is a safety device, and the useful comparison is a smoke alarm: you don't buy it hoping to use it. It sits there costing very little, and the one time it matters it is the only thing that does.

What it does not do is decide anything for you. It has no strategy, no signals and no opinion. It acts when you tell it to, and it acts everywhere at once.

Because every trader has a line, and almost nobody can hold it at the moment it matters. The moment you most need to be flat is the moment you are least likely to click through four platforms and do it — and that is before anything has gone wrong technically.

• You are not at your desk. Phone in hand, position open, nothing else you can do about it.
• The platform froze. Your charts are up and your orders are not going anywhere.
• The connection dropped on the machine you trade from, and the position did not drop with it.

You've always had a rule. You've never had a switch.

It depends on the firm, and you should check yours.

We have written to firms asking for their policy in writing, and we will name the ones that answer. Until a firm has answered, we are not going to tell you it is fine — that is exactly the kind of assurance that costs somebody an account.

What we can tell you is what the software does, which is what the rules are actually about:

• It closes and cancels only. It cannot open a position, cannot place an entry, and cannot modify a working order into a new trade.
• It does not automate a strategy, copy trades between accounts, or trade without your instruction.
• It runs on our servers, so it is not a VPS you rent or a bot on your machine — the two things firm rules most often name.

Some firms have rules about third-party software touching an account at all, regardless of what it does. If yours does, read them, and ask your firm directly if you are not sure. If they answer in writing, send it to support@masterlockoutsync.com and we will add them to the list.

The useful thing to understand first: your chart is not what we connect to. Your account routes through an infrastructure layer, and your chart is what you look at while it does. Lockout Sync attaches at that routing layer.

That is why the answer is short. Keep your charts. We connect underneath them. Quantower, ATAS, DeepCharts, Tradesea, Sierra Chart, MultiCharts, Bookmap and Jigsaw all keep working exactly as they do now, because we are not in their way.

Today: accounts that route through Tradovate, including those issued by prop firms. NinjaTrader has owned Tradovate since 2022, so a NinjaTrader account on Tradovate routing connects the same way.

In build: Rithmic. That one step also covers a NinjaTrader account issued on Rithmic rails rather than Tradovate. CQG, Trading Technologies and ProjectX follow.

If you are not sure which of those your account uses, your firm can tell you in one email — or send us the firm name and we will find out.

No, and that is the whole point.

Your connections live on our servers, not on your machine. Nothing has to stay running at home, you do not need a VPS, and it makes no difference whether your trading platform is open, closed, frozen or on a laptop that just went flat. If your phone can reach the internet, the switch works.

This is the difference between a kill switch and a script. A script needs the machine that is having the problem to still be working.

Three monthly plans: Starter $4.99, Standard $9.99, Pro $19.99. The difference between them is how many accounts you can monitor at once, and you can move between plans at any time.

72 hours free. Card required, nothing charged.

We say the second half plainly because hiding it is what generates the angry email. Your card is attached at sign-up so the subscription can start without a second visit, and nothing is charged until the 72 hours are up. The trial is the full product — every account your plan allows, the lockout, all of it. Not a demo.

• Upgrades are prorated. Move up mid-month and you pay the difference, not a fresh month. Your renewal date does not move.
• Downgrades take effect at the end of the period you have already paid for. Nothing is clawed back and nothing is charged.

One trial per card.

No person at FIBORB LLC can look at your account. No admin panel, no support console, no internal dashboard — not restricted ones, none at all. Your positions are visible to your own signed-in session and to nothing else.

Your positions and orders are never written to disk. The server keeps five files about you: your encrypted credentials, your account record, a sign-in guard, the encryption key, and your journal — one encrypted row per account per trading day, holding that day’s P&L, its closing balance and any note you wrote on it, and nothing else. Positions and orders exist in memory while you are connected and are gone when you disconnect. The journal is deleted with your account, and no record of individual trades is kept.

While you are connected our servers do hold that data in memory, because it is what the app is drawing and what the flatten acts on. There is no way to build this product without that being true, and anyone who says otherwise has not built one.

• It is displayed to you, and acted on when you press the button. That is the entire list.
• Not sold, not shared, not pooled into any aggregate product. The money comes from the subscription. That is deliberate.
• Every record is keyed to your user ID and every route filters by it, including the live feed. No query in this product returns another user’s data, or everyone’s.

There is no screen, anywhere, that shows a stored credential. Not to you, not to support, not to anyone. The only connection list the app can ask for comes back with no password field — the code path that would return one does not exist in the product. There is no admin panel to bypass it, because there is no admin panel.

• Credentials are encrypted at rest with AES-256-GCM, never written as plain text.
• They are used for exactly one thing: authenticating to your broker’s own endpoint. Never sent anywhere else. Never sold, never shared.
• Your Lockout Sync account password is separate, hashed with scrypt and a per-user random salt, and cannot be read back by anyone at all.
• You can delete a stored credential whenever you like — remove the connection in the app and the record goes with it. No cancelling, no email, no asking.

Where your broker issues a scoped API credential instead of a full login, use that. It is revocable by you, from your broker, without touching your password. That is what we would rather hold.

Why we hold them at all: a switch that needs you to type a password at the moment you press it is not a switch. The alternative is not a more private product — it is a slower one, and slow is the whole thing this exists to solve.

No. It closes and cancels. There is no code path in the product that opens a position, and no button for it because there is no feature for it.

The complete list of what it can do to your account: close an open position, cancel a working order, and ask the broker to refuse new orders for a short window. Every one of those makes your exposure smaller or unchanged. None of them can make it larger.

This is also the answer to give your firm if they ask what it is.

The honest version, because a reassuring one is worthless.

What an attacker cannot reach: your money. We are not a broker, we hold no funds, and there is no instruction in this product that moves money out of a brokerage account. The worst realistic case is somebody closing your positions or reading what you hold. Bad — and not the same as theft.

What is not there to take: your trades. Positions and orders are never written to disk. Someone who took the whole machine would find encrypted credentials, account records and an encrypted journal of daily totals and day notes — one P&L figure, one closing balance and whatever you typed, per account per trading day — and no record of the trades behind them.

What happens the moment we know: every stored credential is destroyed. Every session revoked, every cached broker token invalidated — those authenticate with no password, so leaving them would close the door and leave the window open. Your account, your plan and your settings survive. You sign back in and re-add your connections: fifteen minutes for you, and everything for whoever was holding them.

What that cannot do, said plainly: it cannot un-copy something already taken. A wipe shortens the window; it does not rewrite the past. Anyone who tells you their breach plan makes a breach harmless is selling you something.

What we would do besides: tell you. Quickly, in plain language — what was reached and what was not — before anyone else tells you.

What you can do now: where your broker issues a dedicated API credential, use one here rather than your primary login. Revoking it then costs you one form instead of your account.

Only somebody signed in as you. The app has a PIN and fingerprint lock on top of your sign-in, which is worth turning on — a lockout is a deliberate action with real consequences, and it should take more than a borrowed unlocked phone.

Sign-in itself is rate limited, repeated failures escalate, and a suspicious sign-in pattern trips a challenge with a cooldown that survives a server restart.

1. A confirmation. It is not a hair trigger.
2. Every open position on every connected account is closed — every firm, every account, at once, not one after another while you watch.
3. Every working order is cancelled. Stops, limits, brackets, anything resting.
4. The broker is asked to refuse new orders for a short cooling-off window, and anything that appears in that window is cancelled independently.
5. The app shows you the result per account, including any account where something did not go through. It does not report a clean sweep it did not get.

Accounts you have switched off in the monitored-accounts list are not touched. One prop login commonly carries an evaluation account and a funded account, and switching one off means exactly what it says.

If you do not need the big red button, there is a per-account flatten and a per-firm flatten for the same job at a smaller scope.

There are two layers, and they are different lengths on purpose.

The broker-side refusal is short — a cooling-off window measured in seconds, during which the broker is asked to reject new orders and anything that slips through is cancelled. It is deliberately not something you can undo instantly.

The lockout state in the app lasts until you release it. There is a Release control, and it works per connection, so a lockout on one firm can be lifted without touching the others.

Yes, you can release it early. A switch that traps you is a different product with different risks — if the market moves against a position you are now unable to manage, a cage is worse than a switch. The friction is real: a confirmation to enter, a deliberate action to leave, and the fact that you have to decide to undo it rather than just drift back in.

One thing you cannot do is release a lockout by changing your billing plan. A downgrade is refused outright while a lockout is live. A guard you can release from the billing screen is not a guard.

That is the case it exists for.

All three are on one screen, and one press covers all three. Each firm is handled independently — a firm that is slow to respond does not hold up the other two, and a firm that fails does not silently take the others down with it. You get a per-firm result, so you know which one needs a second look rather than assuming all or nothing.

Nothing changes. The lockout is not running on your phone.

Your phone sent an instruction; the lockout lives on our servers alongside your connections. It stays in force with the phone off, flat, lost, or on airplane mode in a pocket. Positions do not quietly reopen and the cooling-off window does not end early because a screen went dark.

Sign in from any device and you will see the same state and can release it from there.

Straight answer first: if our server is unreachable, the app cannot flatten anything. There is no local fallback and we are not going to invent one — your phone is a control surface, and the broker connections live on our servers. Any vendor’s “works offline” claim on a product shaped like this deserves a hard question.

That is the limit. What is actually done about it is more than that sentence suggests:

• A lockout your broker has already accepted is held by your broker, not by us. A cooling-off window the broker has taken does not end early because our server did. If we go dark mid-lockout, the lockout stays.
• The process is supervised and a health monitor watches the API continuously. A crash or a reboot brings it back on its own, with nobody awake. It also reports to a service outside our infrastructure on every check, so if something is wrong, or if our server stops reporting at all, that reaches us rather than waiting for a customer to notice.
• The app tells you when it cannot reach us. No confident green screen assembled from a stale cache. An unreachable server looks unreachable.
• There is a status page at masterlockoutsync.com/status.html. It asks the API from your own browser rather than showing a badge somebody set by hand — and it says plainly that if the page itself will not load, assume everything is down.

And the part that is on you, said plainly because it is true of every single point of failure in a trading setup: keep your platform’s own flatten reachable. This is a second switch. A second switch that is honest about being second is worth more than a first one that lies.

You are told, on that account, immediately. The app reports per-account results, and a rejection is shown as a failure — never rolled into a green summary. A false confirmation is worse than an error, because you act on it.

Rejections happen for reasons usually outside anyone's control: the market is closed, the position is already flat, the broker's own session has dropped, or the broker is refusing everything at that moment. The app retries what is sensible to retry, and if it still cannot get through it says so and leaves the account visibly unresolved.

If a rejection looks wrong to you, send it to support@masterlockoutsync.com with the time and the firm and we will look at what the broker returned.

Before. Accounts approaching their drawdown limit raise an alert, so the app is not purely something you reach for after the fact.

On prop accounts the drawdown figure comes from your broker's own numbers, or from the rule you set where your broker publishes none. For a trailing drawdown, Lockout Sync also tracks the account's high itself, and where its figure and your broker's differ it shows the tighter of the two. A setting you choose can tighten the figure, never loosen it past your broker's. You see the amount remaining and the price level it sits at. If that data cannot be read, the app says so plainly instead of showing a reassuring bar — a drawdown number you cannot trust is worse than no number.

Yes, and for a different reason than a prop trader.

A funded trader installs a kill switch because a firm has a rule that will fail them. You do not have that rule. What you have instead is the reason most retail accounts get given back: nobody is going to stop you, so the stopping has to be something you set up in advance, at a calm moment, and can trigger in one tap when you are not calm.

Everything mechanical works identically on a live account: every account on one screen, one-tap close and cancel across all of them, the cooling-off window, per-account and per-firm flatten, and accounts you switch off staying untouched.

Trailing drawdown is a prop firm's rule, not a market mechanic, so on a retail account the drawdown card has much less to tell you.

The number to watch on a live account is your own: the loss you decided in advance was the end of your day. The switch is what you press when you reach it. Decide the number when you are calm, because you will not be calm when it matters.

We deliberately do not lead with "amount until liquidated". On most retail accounts liquidation is a long way off, so that figure sits comfortable and green while a month goes back — which makes it worse than useless.

Cancel any time from Account & Plan, or from the billing portal. No email, no retention call, no maze.

You do not have to cancel to remove a credential. Delete a connection in the app whenever you like and the stored record goes with it. Worth knowing before the rest of this answer.

If you do cancel:

• You keep access to the end of the period you paid for. Cancelling on day 2 of the month does not end it on day 2.
• At period end your connections stop being monitored — suspended, not deleted.
• Your connections stay attached to your login. Come back and everything is where you left it, with nothing to re-enter.
• Do not want them kept? Delete the connections before you cancel, or delete the account and it all goes at once.

To erase everything immediately: Manage → Account & Plan → Delete account, type DELETE, and enter your password. It is also available at masterlockoutsync.com/delete-account without signing in to the app.

There is a free tier, it is limited on purpose, and it is not something you can sign up for on day one.

What it does: one monitored account, with per-account flatten still working. What it does not do: LOCKOUT ALL. The lockout is the product, and it is what the subscription pays for.

Your other connections are disabled, not deleted — the credentials stay, you pick which single account stays active, and the rest come straight back if you move to a paid plan again.

When it appears: after you have been on a paid plan for a month. There is nothing to apply for and nobody to email — the option shows up in Account & Plan on its own once your account qualifies. It is deliberately not offered at sign-up or during the trial.

Yes. Sign in on both.

Your connections live in your account on our servers, so a second device shows the same firms, the same accounts and the same lockout state without re-entering credentials. A lockout triggered on one is visible and releasable on the other.

Two things are per-device rather than per-account: the PIN and fingerprint lock and the order you have dragged your cards into. Set those on each device.

Sharing one login with another person is not what this is for — you would both be able to flatten each other's accounts, which is exactly as bad as it sounds.

The app is on Google Play for Android today. If you are on iOS, tell us at support@masterlockoutsync.com — the volume of that request is what decides when it gets built, and right now it is a real question rather than a promise.

support@masterlockoutsync.com. Include the firm, the account, and the time it happened — with those three things a server-side log can be found; without them it usually cannot.