Who Holds the Keys? Custody, Permissions and Order Control at Algo Trading Firms in India

Most traders ask the wrong first question when they look at a firm that will "run the algo for you". They ask about returns. The better first question is simpler and duller: after I sign up, who can do what to my account?
That question has a real answer, and the answer differs a lot from one setup to the next. In one setup the firm can only send orders. In another it can also cancel them. In a third your money is no longer in your name at all. All three get described with the same friendly phrase, "we run it for you".
This article breaks the phrase into parts. It covers where the money sits, what an API key can and cannot do, why the cancel permission matters more than most people think, and a list of questions you can put to any provider in writing. It is written for a trader who already has a broker account and some option-selling experience, and who wants to hand over the routine work without handing over more than needed.

"We run it for you" has at least four meanings

Start by pulling the phrase apart. When a provider says it will run a strategy for you, it usually means one of four things.
The first is software only. You pay for a tool. You log in, build or pick a strategy, link your broker, and press start. The provider's servers send orders to your broker on your behalf, but you chose every setting. The provider never decides anything. It is a remote hand on your keyboard.
The second is a managed setup on your own account. A team picks the strategy, sets the parameters, watches it, and changes things when conditions change. The orders still go into your broker account, under your client code. The team uses some form of access that you granted. You can see every order in your own broker app.
The third is a pooled arrangement. Your money goes to an entity that trades one combined book, and you hold a claim on the result. Your broker app shows nothing, because the trades are not in your account. This is a different legal and operational animal from the first two.
The fourth is a signal service. Someone sends you entries and exits, and you place them yourself, or a plug-in places them for you. The "running" is really advice delivered as a message. Who may legally send such messages for a fee is a regulatory matter, and it is worth checking before you go further.
These four carry different risks and different rules. Make the provider say which one it is, with one sentence in an email: "Do orders for my strategy go through my own broker account, in my client code, or through an account in your name or a pooled account?"

Where your money sits decides most of the risk

In India, the basic structure is that your funds sit with your broker, or in the clearing system through your broker, and you hold a trading account that is yours. A provider that connects to that account through a normal interface does not take possession of the money. It can send instructions. It cannot, by default, move cash to itself.
That is the property to protect. If your funds stay in your broker account, the worst thing a bad or careless provider can do is trade badly with them. That is a serious harm, but it is bounded by your margin and by what the broker's risk system allows. If your funds leave your account and enter someone else's, the worst case is that you have a claim against a company, and nothing more.
Here is the practical test. Ask where a rupee goes on the day you deposit it. Does it go from your bank to your broker, in your name? Or does it go from your bank to the provider? If the second, you are in pooled territory, whatever the brochure says.
Pooled money has its own legal framework, and managing other people's money for a fee is a regulated activity in India. The details sit with SEBI and are not something a blog post should summarise for you. The useful step is simple. Take the exact legal name of the entity asking for your money, and look it up on the regulator's own website at sebi.gov.in. Check what category it holds, if any, and what that category allows. Do the same for any company that says "SEBI-approved" about itself. An approved product, an approved exchange, a registered broker and a registered adviser are four different things, and the phrase can be true of one and meaningless for the others.
Not every legitimate business in this space is registered for managing client money, and that is fine, because many do not manage client money at all. A software company, or a proprietary trading desk that trades its own capital, does not need to. What matters is that the business is clear about which one it is, and that its behaviour matches. A software company should never ask you to send money to it. A desk that trades only its own capital should not be taking yours.

Own-account execution: what you get, and what you still have to watch

Execution on your own broker account is the arrangement most retail option sellers should look for first. The orders appear in your order book, the positions appear in your position list, and the contract notes come from your broker in your name. If the provider disappears tomorrow, the account is still yours and the positions are still there.
It does not give you automatic safety, though. Two things still need attention.
The first is the connection itself. To place orders in your account, a provider needs some credential. Usually that is an API key and secret, or a login token generated each day, or in some cases your actual login. These are very different. A key that your broker issued to a registered app, with its own permission scope, is a narrow tool. Your username, password and TOTP seed handed to a stranger is a master key. Ask which one it is. If the answer is "we log in as you", think hard.
The second is mismatch. When the provider's dashboard and your broker's order book disagree, the broker is right. Get in the habit of looking at the broker app at least twice on a trading day, once after entry and once near the close, and compare it with what the provider says it did. This takes two minutes. It has caught more problems for ordinary traders than any contract clause.

Pooled execution: what changes, and where the firms are

Pooled execution is a legitimate model when the entity running it is properly set up for it, and its trade-offs mirror own-account execution. You cannot see individual orders in your own app. You depend on statements from the operator. You cannot square off by hand. And exit means a redemption process, with its own timing and its own rules, rather than switching off a connection.
So the questions change. Who is the custodian of the assets? Who audits the books? How often do you get statements, and are they reconciled to broker contract notes? What is the redemption timeline in days, and what happens in a fast market if many people ask at once? These are the questions you would ask of any pooled vehicle, and a firm that is proper about it will have written answers ready.
The broader point is that the sector is not one thing. Some firms sell software. Some run managed accounts. Some are proprietary desks that trade their own money and publish research. A reader trying to understand who does what can compare them side by side. One place to start is EliteAlgo's published comparison of algo trading firms in India, which sorts them by what they actually do rather than by marketing label. Whatever list you use, treat it as a starting point and run the custody questions in this article against each name yourself. Business models and policies change, and only the firm's current written terms count.

The permission ladder, and why cancel matters most

When people talk about "access", they picture one switch, on or off. In practice there is a ladder, and each rung adds a new power. It helps to name each rung.

Rung one: view

Read-only access to positions, orders, margins and trade history. The provider can see everything and change nothing. This is useful for reporting and for risk monitoring. It is the lowest risk, though it does expose your trading data, so privacy still matters.

Rung two: place

The power to send new orders. This is the core of what an algo does. The risk here is straightforward: a bug or a bad parameter can open positions you did not intend. Your broker's own risk limits, such as the maximum order value, the quantity freeze limit on an index option order, and your available margin, are the outer wall. Know what your limits are, because the provider's software sits inside them.

Rung three: modify

The power to change the price, quantity or trigger of an order that is already working. This is how a trailing stop moves. It is also how a stop can be loosened without anyone noticing. A modify permission on a resting stop-loss order is a quiet power.

Rung four: cancel

The power to remove a working order. More on this in the next section, because it is the rung that gets least attention and carries more weight than it looks.

Rung five: withdraw or transfer

The power to move money out. Under a normal broker API this does not exist. The funds can only go back to your own linked bank account, and the broker, not the provider, controls that. If any arrangement asks for the ability to move funds, to a third-party account, from your trading account, stop and treat it as a different product with different rules.

Why cancel deserves its own conversation

An option seller's protection lives in resting orders. A stop-loss sits at the exchange or at the broker's system, waiting. It is the thing that limits the damage when a short strike goes the wrong way. Whoever can cancel that order can remove your protection in one call.
That makes the cancel permission more sensitive than the place permission in one specific way. A bad entry opens risk, but the stops that come with it are still there to catch it. A bad cancel strips the stops from a position that is already open. The loss that follows is not limited by the logic that was supposed to limit it.
There are two common ways this goes wrong, and neither needs bad intent.
The first is a software bug during a restart. A process crashes at 13:40, restarts, does not recognise the orders it placed before the crash, and "cleans up" by cancelling everything open. The positions stay. The stops are gone. A well-built system reconciles against the broker's order book on startup and does not cancel what it cannot match. A badly built one does the opposite. You should ask which one you have.
The second is a human operator. A support person or a trader on the provider's side sees an order that looks odd and cancels it, meaning well. If the provider's staff can reach your account through an admin panel, that is a human with a cancel button on your stops. It does not make the firm bad. It makes it a thing to ask about: who on your team can reach my account, and is every action logged and visible to me?
A clean design separates the two jobs. One credential places and modifies. Another, tighter one, can only cancel and square off. Some firms set up a "flatten" path, where the only way to cancel is to exit the position, so a stop is never removed without the position going with it. Others require a second approval for any cancel on a working stop. You will not find these details in a brochure. Ask for them in writing.

A useful rule of thumb: you should be able to answer, in one sentence, "what is the worst thing that can be done with the access I gave?" If the sentence has the word "anything" in it, the access is too wide.

Reading the evidence in your own order book

You do not have to take any of this on trust. The order book tells you what happened. After the first week of any managed or software-run setup, sit down with your broker's order history for one full day and read it like a log.
Look at the order sequence for a single leg. A normal short option leg on a stop-loss system looks like this: an entry order, a fill, a stop-loss order placed soon after, maybe some modifications as a trail moves, then either a stop trigger and fill or an exit order near the end of the day. Every step should have a time stamp that makes sense. If a stop disappears with no matching fill, ask why. If the quantity on the stop does not match the quantity filled, ask why. If orders appear at hours when your strategy should be idle, ask why.
A second check is about size. EliteAlgo's desk study of 163 NIFTY and SENSEX weekly expiry sessions between January 2025 and July 2026 measured peak notional exposure against entry exposure for a short straddle entered at 09:20. It used a margin proxy built from spot and the day's VIX, not live SPAN margin. The mean ratio was 1.007 and the maximum 1.025.
A well-behaved fixed-size strategy does not suddenly double its exposure at 13:30. If your own account shows extra lots, a second set of legs or a missing hedge, the strategy is no longer doing what you signed up for. Call the provider that hour, not at month end.
A third check is about outcomes versus intent. The same desk study found that a short ATM straddle entered at 09:20 gave back a median 42.8% of its peak profit before the close, and that on 48 of 159 usable days (30%) a position that had been in profit at some point finished the day at a loss. This is how expiry-day option selling behaves, and it explains why many people want to step in by hand. It also shows why access rules matter. If you or a provider's staff intervene by cancelling or modifying at the wrong moment, the intervention itself becomes a source of results, good or bad, that has nothing to do with the strategy. Ask whether manual overrides are allowed, who may do them, and how they are marked in the records so that you can tell the strategy's result from the override's.

Questions to ask before you hand over access

The table below is a working list. Send it by email so the answers are in writing. A clear firm will answer in a few lines. A vague answer is also an answer.
Two of these deserve a few more words. The "stops" row matters because there are two places a stop can live. In one design the stop is an actual order sitting at the broker or exchange, so it survives a provider outage. In the other the stop is a rule inside the provider's software, which watches the price and sends an exit order when the level is hit. The second design is common, and it is not wrong, but it only works while the software is up. If your provider's servers fail at 14:00, a software-held stop does nothing. Ask which design is in use, and what the outage plan is for the other one.

Your side of the fence: limits, alerts and leaving

Some of the safety is yours to build, and most of it costs nothing. Use a broker account that holds only the funds the strategy needs, so a mistake cannot touch your long-term savings. Set limits at the broker where it allows them, such as segment restrictions and maximum order size, because those sit below anything a provider's software can override. Turn on fill alerts, so you have a second view that does not depend on the provider's dashboard. Use a unique password and the broker's two-factor method, and never share an authenticator seed. If the broker supports restricting API access to fixed network addresses, switch that on.
Keep the exchange side in view too. Lot sizes and freeze quantities change from time to time, and the current numbers live on the exchange sites such as nseindia.com, not in a provider's old brochure. The same goes for the regulator's retail algo framework, which has been revised more than once. Read the current circulars, and ask any provider through which broker or exchange-approved route your orders travel.
Plan the exit on day one. Pause the strategy rather than deleting it, so the logs stay. Look at open positions in your own broker app and decide by hand whether to hold or square off. Then revoke the credential at the broker, not just in the provider's dashboard, because the broker's setting is what shuts the door. Check the order book afterwards, ask the provider in writing to delete stored credentials, and export the full order log for tax work and your own review. A provider that makes any of this difficult has told you something about itself.

Frequently Asked Questions

Can an algo provider withdraw money from my broker account?
Under a standard broker API arrangement, no. The API does not carry a withdrawal power, and money can only return to your own linked bank account through the broker. If any provider asks for a way to move funds out of your account, treat that as a different, regulated kind of arrangement and look the entity up on the regulator's site before you go on.
Is it safe to give my broker login and password to an algo firm?
It is the widest form of access you can give, and it is better avoided. A scoped API key or token issued by the broker is narrower and can be revoked on its own. If a firm insists on your password and authenticator seed, ask why a key will not do, and consider walking away.
What is the difference between own-account execution and a pooled account?
In own-account execution, orders go into your broker account under your client code, and you see everything in your own app. In a pooled account, your money joins a combined book run by an operator, and you hold a claim on the result. The second needs the operator to be set up to handle client money, so check its status first.
If my algo provider's server crashes, what happens to my open positions?
It depends on where the stop-loss lives. If it is an order resting at the broker or exchange, it stays in force. If it is a rule inside the provider's software, it stops working with the server. Ask which design is used and what the written outage procedure is, and keep your broker app ready to square off by hand.
Who is responsible if an algo places a wrong order in my account?
That is set by the written terms you accepted, and by the broker's rules. Read the terms for liability, and for what the provider says about errors and downtime. Do not rely on a verbal promise. Ask for the limits of liability in writing before you start.
How do I stop a strategy immediately?
You should have two routes. One is a stop control in the provider's tool. The other, which does not depend on the provider, is your own broker app, where you can cancel working orders and square off positions. Practise the second route once on a small size so you know the steps when it counts.

Conclusion

"We run it for you" is a starting point for questions, not an answer. The useful details are about the plumbing: where the money sits, which credential is used, what each permission allows, and what happens when something breaks. Own-account execution keeps the facts in your hands and the exit simple. Pooled execution can be legitimate, but it asks for more trust and more paperwork.
Pay special attention to cancel and modify rights on stop-loss orders, because those are the permissions that decide whether your protection survives a bad day. Ask in writing, check the order book yourself, and set limits at your own broker so that a provider's software always works inside a box you control.
Algo trading carries a real risk of loss, including the loss of more than you expected on a fast expiry day. EliteAlgo is analytical software and not an investment adviser, and nothing in this article is investment advice. Verify every regulatory point against the regulator's and the exchanges' current publications before you act.