Is it safe to connect your bank account through Plaid?

What Plaid is

Plaid is a company that sits between apps and banks. A budgeting app, a payment app or a lender that wants to read your account data does not build a separate connection to thousands of banks. It asks Plaid, and Plaid maintains the connections.

You have probably used it without noticing. The screen where you pick your bank from a list and sign in, inside some other app, is very often Plaid's screen and not the app's.

What happens when you tap Connect

The steps are the same in almost every app, and knowing them tells you who holds what.

• The app opens Plaid's window. You choose your bank there.
• For many large banks you are sent to the bank's own website or app to sign in and approve the connection. The bank then hands Plaid a token, and your password never leaves the bank.
• For banks without that kind of connection, you type your bank sign-in into Plaid's window, and Plaid uses it to fetch your data.
• Plaid gives the app a token of its own: a long random string that stands for 'this app may read these accounts'. The app stores that token, not your password.
• From then on the app uses its token to ask Plaid for balances and transactions.

What the app receives, and what it does not

An app only receives the kinds of data it asked Plaid for, and you see that list on the consent screen before you agree. For a budgeting app that is typically account names and types, balances, transactions, and details of loans and cards such as the interest rate and minimum payment.

What a well-built app never receives is your bank username and password. Those stay with your bank or with Plaid. That matters because it limits what a breach of the app could expose: an attacker who stole the app's database would find tokens for reading data, not the keys to sign in to your bank.

The honest risks

Connecting is not risk-free, and anyone who says it is should not be trusted. The realistic risks are these:

• You are trusting one more company. Plaid holds connections to a very large number of accounts, which makes it a target, and you rely on its security as well as the app's.
• Your transaction history is revealing. Even without a password, a list of where you spend money says a lot about your life. It deserves the same care as the money itself.
• Fake connection screens. Because people are used to typing bank details into a window inside another app, a scam app can imitate that window. Only connect from apps you chose deliberately, never from a link in a message.
• Forgotten connections. An app you stopped using two years ago may still be able to read your accounts unless you disconnected it properly.

How to connect with less risk

• Prefer the path that sends you to your bank's own site or app to approve. If your bank offers it, Plaid uses it automatically.
• Read the consent screen. If a budgeting app asks for more than it could plausibly need, stop.
• Turn on two-factor authentication at your bank and in the app.
• Review your connections once or twice a year and remove the ones you no longer use.
• Check that the app says plainly what it does with the token and what happens when you disconnect.

How My AI Fin App handles it

You sign in on Plaid's screen, so your bank username and password never reach our servers and are never stored by us. The token Plaid gives us is encrypted before it is saved, with a key that is kept outside the database, so the database alone is not enough to use it.

The app asks for balances, transactions, loan and card details and investment holdings. It does not ask for the ability to move money. Disconnecting a bank in settings removes the connection at Plaid as well, not only in our database, and deleting your account does the same for every bank you linked.

If you would rather not connect anything, everything in the app also works with numbers you type in by hand.