NIC.IO, the registry that provides .IO domains, does not offer locking functionality, so those domains cannot be locked at the customer level. This is fairly common among the ccTLD registries (the ones that provide the two-letter country code domain extensions).
However, there is what is called a registrar lock, which we can add or remove for you. This locks the domain against unauthorized transfers among other registrars that use the same backend system we do.
To request this (or check if it's in place), just login to your account and send us a quick authenticated request from our support form: https://iwantmyname.com/support
As an additional note, gTLDs like .COM, .ORG, etc., and the new ones, like .PIZZA, .PHOTOS, etc., are regulated by ICANN, so transfer locking at the user level is available for them.