Every open, modify, and close is scored against the program in memory — violations, news windows, scalping/HFT, grid/martingale, multi-account, and IP/geo. Breach, flag, or clear with the same latency budget as the terminal. Replay is a first-class admin action.
These are parallel detectors on the same account, not six products. Thresholds and actions are fields on the program and phase. We name the signal so you can explain the fail.
This is not a nightly batch. Login, terminal connect, pending placement, and every fill hit the same graph. Phase-2 rules that do not match the site lose arguments you should have won.
Open, modify, partial, close, pending, auth, and terminal connect — from native terminals and bridges. Delayed streams are labeled delayed.
Equity, floating P&L, open book, pending geometry, identity graph. Daily and max drawdown can sit on independent bases.
Program + phase objects. Hot-swap parameters without a deploy. Rule chaining: three mediums in 24h → review; news window AND exposure cap.
A named class and a severity — not a mystery score. Composite HFT is only the six listed signals.
Warn, flag, reject the next add, flatten, read-only, fail, or hold payout. Per rule and per phase.
Immutable event log the trader can also see. Webhook out. Admin replay with the fill list that tripped it.
Typical operator mapping — not fake trader names. You can warn on challenge and fail on funded for the same class.
| Class | What trips it | Typical action |
|---|---|---|
| Daily / max drawdown | Independent bases: trail, static, equity, pip/absolute, weekly. Warning rungs before hard breach. Optional grace window. | Flatten rest of day, or fail |
| News window | Mapped event, independent pre/post minutes, instrument map (USD release need not lock GBP). Hold-through is a separate class — no double-count vs drawdown. | Reject / flag / flatten |
| Weekend / session | Friday cut-off with symbol exceptions; London / NY / Asia / custom windows. Thin-session harvesting is a policy, not a vibe. | Flatten or block new |
| Min / max hold | Cannot close before N seconds (per symbol group). Force-close after a duration on funded books that should not carry a hedge forever. | Flag / HFT score / flatten |
| HFT burst | Rolling 1 / 5 / 60 minute frequency caps plus tick-scalp repeats. Score decays so one fast session does not brand the account forever. | Block / review |
| Latency arb | Fill vs mark (or LP) timestamp gap. Hit-rate over a window — not one lucky fill. Especially on CFDs. | Block |
| Martingale / averaging | Classic 2×, Fibonacci, fuzzy 1.8× / 2.1×, and adds to a loser without a clean double. Cross-session and cross-symbol lookback. | Reject the next add |
| Grid geometry | Equidistant pending cluster (typically 5+ workings), bi-directional “hedge” grids, max concurrent per symbol and direction. Caught before they fill. | Flag / reject |
| Copy / hedge pair | Timing, instrument, side, size overlap. Opposite-side pairs on the same tick. Evidence pack: fills, identity, timeline. | Review / payout hold / lock |
| VPN / TOR / geo | Path class (VPN, proxy, TOR, datacenter vs residential), declared KYC vs resolved geo, shared-IP farms, device/terminal ID across logins. | Warn, case, or block |
| Size / instrument | Max lot, min size, aggregate exposure, single-symbol concentration, allow/deny lists, per-symbol caps on the names they actually blow up. | Reject at the gate |
| EA / target games | Algo policy per program; stop/swap abuse; one-tick scalp into a pass; correlated hedges; overnight gap lottery. Logged as its own class. | Flag or fail |
Per-event windows 1–60 minutes. Instrument maps: NFP can lock USD pairs and XAU and leave GBP open. Hold-through on positions opened before the window. Override one event without restarting the engine. Calendar is your feed or a connected calendar — not a retail widget we pretend we own.
Min hold, burst windows, tick-scalp repeats, latency-to-mark, news-spike scalp, duration-threshold gaming. Composite only from those. False positives go to a review queue before a hard fail. Tighter as they approach payout. One short trade is not HFT; a 47-fill burst in three minutes is.
Lot-step after losses, pending geometry, averaging-down, Fibonacci, bi-directional grids. Fuzzy ratios catch 1.8× and 2.1×, not only textbook 2×. Cross-symbol recovery when they hop pairs to hide the ladder. Catch the fourth rung.
Copy rings, challenge-to-funded mirrors, long/short hedge pairs, farm clusters, loss allocation, credential sharing. Timing, instrument, direction, size, and identity are separate dimensions. A 94% overlap is a review. A guaranteed long/short pair on the same tick is a hold.
VPN/proxy, TOR exit, datacenter vs residential, geo vs KYC, shared-IP (N accounts, same network, your window), device and terminal identifiers when the IP hops. Whitelist the office. Counsel owns the restricted-geo list.
Lot spikes vs history and caps, leverage per program, instrument bans, behavioral clusters you name. Review queue — not a score you cannot defend in a payout dispute.
Drawdown, position, time, strategy, instrument, network, and custom chaining. Filter a category, hover a rule, pin the spec. Parameters hot-swap. Code is not required to change a threshold.
Tiered alerts (80 / 95 / breach), webhook out, trader-visible gauges, and an immutable event log. Daily and max drawdown can use different bases on the same account.
We give you real-time exposure, named detectors, and the fills you need to hedge. We do not staff a shadow risk department or warehouse your book.
Illustrative event stream. Your production ruleset is the source of truth.
No. We compile and enforce the rules you write, surface exposure so you can hedge, and keep an immutable log. We do not warehouse your book or staff a shadow desk. If someone sells “our risk team as an extension of yours,” that is a service contract — price it separately from the license.
No. Detectors are named signals: hold time, burst windows, fill-vs-mark gaps, lot steps, pending geometry, copy overlap, VPN/TOR/datacenter class, geo vs KYC. A composite is only those fields. We will not sell a black-box score you cannot defend to a trader or a regulator.
On the fill path, with the same latency budget as the terminal — not an end-of-day CSV. We do not invent a sub-50ms SLA. If a venue only gives us a delayed stream, that ingest is labeled as delayed.
Yours, or a connected calendar you attach. We do not pretend Forex Factory or a retail widget is our product. Per-event pre/post windows and instrument maps are first-class; a global “no news” toggle is how you punish the wrong book.
We classify the path: VPN/proxy, TOR exit, datacenter vs residential, geo vs declared KYC, shared-IP clusters. Policy is yours — whitelist the office, warn on challenge, block at payout. We do not sell a “1000 VPN brands” slide.
Yes. Challenge, verification, and funded can use different thresholds and actions on the same account. Daily and max drawdown can sit on independent bases. That is how real programs are written.
We configure detectors to the strategies you actually see — not a generic antivirus slide.
