Security

How a bank connection works

You pick your bank. Plaid opens its own secure window and takes your password there.

Plaid then hands us an access token. That token reads one bank’s data and nothing else. We scramble it and store the scrambled copy.

We ask Plaid for your transactions. Where your bank shares them, we ask for your loan details too. That is how we show interest rates and minimum payments (the Transactions and Liabilities products). Both are read-only.

How your data is locked

Everything between your browser and the app travels locked (TLS). The company that hosts our database locks what it stores, too.

Your bank token gets a second lock on top of that one, added by us. That lock also spots tampering instead of quietly accepting it.

We do not keep the master key

Our database company issues one key that skips every rule. That key is not in the running app. We left it out on purpose.

Day to day, the app uses a limited key instead. It obeys the same per-account rules your own sign-in does. So a bug in our code cannot be turned into a way to read everybody’s records.

One more login exists, because some work happens while you are asleep. It syncs your bank overnight and sends the summary emails you asked for.

It can read the records those jobs need, and it can read them across accounts. That is all it can do. It cannot skip the database’s rules the way the master key would. It cannot unscramble your bank token.

Only two things use it: our scheduled jobs, and messages from Plaid that we check are genuine. Nothing a visitor can reach uses it.

Our support tools cannot see your money

When we look up an account to help you, we see three things. That it exists. Who it belongs to. Whether its bank connection is working.

Those screens cannot show your balances, your amounts, or a single transaction. They do not exist, and there is no side door that fetches them either. Every time we look up your account, it goes in a log.

Two things are not walled off from the owner of this company, because running it needs them. One is the key that unscrambles your bank token. The other is the photos and receipts you upload, and a receipt shows a shop and an amount right on it.

That second one exists so that deleting your account can delete your files. Nobody else can reach either one, at any level — there is nobody else. We would rather name these than let you assume a promise we cannot keep.

Two-factor protects the data, not just the screens

Turn on two-factor sign-in and the database starts asking for it too. A sign-in that has not entered the code gets nothing back — whether that code comes from an authenticator app or by email.

That holds even if someone skips our app and asks the database directly. A password alone reads nothing.

Accounts without two-factor keep working as before. The rule starts the moment you turn it on.

Sharing your account with your Spouse

Family Sharing lets you invite one person — your Spouse — to see your account. They get a sign-in of their own. They can change things only if you say so.

The database decides this, not the app. Your Spouse gets in only after passing two-factor sign-in, and only as far as you chose.

Read Only is a database rule. A Read Only sign-in is refused every change, whatever a screen seems to offer.

Your Spouse can never read the key that connects your bank. Only you can add, reconnect, or remove a bank, or set an account alert.

You can change or end sharing at any time from Settings → Family Sharing. Your Spouse can leave at any time. You are both emailed when sharing starts, changes, or ends.

Deleting your account really deletes it

You can delete your account yourself, from Settings → Security, after you type your password again (and, if you use an authenticator app, its code).

It happens in a set order. Your photo goes first. Then every bank connection is released at Plaid. Only then do your profile, accounts, transactions, debts, budget and goals go.

The Plaid step has to come first. The keys that release those connections sit on the rows being deleted. The other way round would leave your bank connections open forever.

Deleting is permanent. We cannot undo it. One catch: if a Spouse is attached, or an invitation is still waiting, we stop before touching anything. Remove them, or cancel it, first.

Disconnecting one bank

You can cut off any one bank at any time from Accounts → Connections. This one throws things away on purpose.

It ends the connection at Plaid. It also deletes that bank’s accounts for good, with their transaction history and any debts that came from it. That includes interest rates, minimum payments, and names you typed in yourself.

One thing can stay, and only if you choose it. The app asks whether to keep each account’s balance history: its name, its type, and its balance on each past day. Keeping it means your past totals do not change, and you can delete it later in Settings → Removed accounts.

The app asks you to confirm. It cannot be undone.