Security & Reliability

For brokers that support it (e.g. Tradovate), accounts are connected through the broker’s official OAuth flow - your password is never sent to or stored by Qloner, and you can revoke access at any time from your broker or by deleting the connection. For brokers that require credentials, those credentials are encrypted at rest and used only to maintain your trading session - never stored or transmitted in plain text.

Each connected account’s automation runs with its own isolated network identity, so your accounts don’t share a footprint. This keeps multi-account setups cleanly separated - a deliberate design choice for prop-firm traders who run several evaluations and funded accounts side by side.

Secrets (broker tokens, credentials) are encrypted and held in a managed secrets store with least-privilege access. We store only what’s needed to mirror your trades and enforce your risk rules. Internal services authenticate to each other with signed service keys, not shared passwords.

Copying runs server-side, so it keeps working with your browser closed. Account P&L is monitored in real time; daily loss and profit limits are enforced automatically and can auto-lock an account on breach. Broker sessions are refreshed and reconnected automatically, and execution events are logged so you can audit exactly what was copied.

You stay in control of every account:

• Per-account copy on/off - no all-or-nothing switch
• Per-account daily loss / profit limits with automatic lock on breach
• One-click flatten to close open positions
• Disconnect any account at any time to revoke access

Found a security issue, or have a due-diligence question? Email support@qloner.com and we’ll respond promptly. Please don’t publicly disclose a suspected vulnerability before we’ve had a chance to address it.