Your data
What Firmtrack reads from a connected account, and what it never does
Read-only, by construction. Firmtrack pulls account names, balances and fills. It has no code path that places, changes or cancels an order.
Sources last checked
What is read
- The list of accounts under your login, their names and current balances.
- Executions: time, contract, side, size, price, fees, and where the platform reports it, realized profit or loss.
- On a schedule (about once a day) and whenever you press Sync now.
What is never done
- No orders are placed, modified, or cancelled. The venue clients in Firmtrack contain no order call at all.
- No withdrawals, transfers, or account settings are touched.
- Firmtrack never asks for your TopstepX or Tradovate password: TopstepX uses an API key and Tradovate uses its own sign-in page. Rithmic issues neither, so a Rithmic connection, when it is available, will take the firm-issued login, validate it before saving, and store it encrypted. Nobody from Firmtrack will ever ask for a password or key by email or chat.
Where it lives
Credentials are stored encrypted (AES-256-GCM) so the database alone cannot read them. Disconnecting deletes the credential and every account and fill record it produced. Trades, purchases and payouts you add by hand stay in your browser, as in the demo.