Security

How a bank connection works

When you connect an institution, Plaid opens its own secure window and collects your credentials there. Plaid returns an access token to us — a key that reads that one institution’s data and nothing else. We encrypt it and store the ciphertext. We request Plaid’s Transactions product, and Liabilities where your institution supports it, so we can show interest rates and minimum payments on cards and loans. Both are read-only.

Encryption

Traffic between your browser and the app is encrypted with TLS. Data is encrypted at rest by our database provider. Plaid access tokens get a second layer on top of that, applied by us with an authenticated cipher, so tampering is detected rather than silently accepted.

No master key in the application

Our database provider issues an administrative key that bypasses every access rule. That key is deliberately not present in the running application. For everything you do in the app, we use a public key constrained by exactly the same per-account rules your own session is, so a flaw in that code cannot be escalated into reading the whole database.

One narrower credential does exist, because some work has to happen while nobody is signed in — overnight syncing with your bank, and the summary emails you have asked for. It can read the records those jobs need across accounts, and it is limited to that: it cannot bypass the database’s rules the way the administrative key would, it cannot decrypt the token that connects your bank, and it is used only by scheduled jobs and by verified webhooks from Plaid, never by anything a visitor can reach.

Our support tools cannot see your money

When we look up an account to help with a problem, we can see that it exists, who it belongs to, and whether its bank connection is healthy. Those screens cannot show your balances, your amounts, or a single transaction. They do not exist, and there is no back channel that fetches them either. Looking up your account at all is written to a log we keep.

Two things are deliberately not walled off from the owner of this company, because running it requires them: the key that decrypts the token connecting your bank, and the profile photos and receipt images you upload — receipts carry a merchant and an amount on their face. That second one exists so deleting an account can remove the files that belong to it. Nobody else, at any access level, can reach either — there is nobody else. We would rather name these than let you infer a guarantee we cannot make.

Two-factor reaches the database

Once you turn on two-factor sign-in, the database itself refuses your data to any session that has not entered the code — not only the app’s screens. A password alone reads nothing, even when pointed straight at the database’s own API rather than at the app. Accounts without two-factor keep working exactly as before; the rule applies from the moment you enrol.

Sharing your account with your Spouse

Family Sharing lets you invite one person — your Spouse — to see your account with a sign-in of their own, and to change it only if you say so. The database decides, not the app: a Spouse’s session is admitted to your records only while it has satisfied two-factor sign-in, and only to the access you chose. Read Only is a rule the database enforces — a Read Only session is refused every write, whatever a screen might offer. The key that connects your bank is never readable by a Spouse, and only you can add, reconnect, or remove a bank or set an account alert. You can change or end the sharing at any time from Settings → Family Sharing, your Spouse can leave at any time, and each of you is told by email when it starts, changes, or ends.

Deleting your account actually deletes it

You can delete your account yourself, from Settings → Security, after re-entering your password. Deletion runs in a deliberate order: your uploaded photo, then every bank connection released at Plaid, and only then your profile, accounts, transactions, debts, budget and goals. The Plaid step has to happen before the database rows are removed — the keys that release those connections live on the rows being deleted, so doing it the other way would strand the connections open forever. It is permanent and we cannot undo it. One precondition: while a Spouse is attached to your account or an invitation is pending, deletion is refused before anything is touched — remove them, or cancel it, first.

Disconnecting a single bank

You can cut off any one institution at any time from Settings → Bank Connections. Be aware that this is destructive by design: it removes the connection at Plaid and permanently deletes that institution’s accounts, their transaction history, and any debts imported from it — including interest rates, minimum payments, and names you edited by hand. The app asks you to confirm, and it cannot be undone.