Is It Safe to Link Your Bank to a Budgeting App? What Plaid Actually Does

The most common question we get is some version of: I want the app to track my spending automatically, but I am nervous about giving it my bank login. That is the right instinct. Your bank login is the most valuable credential you have, and you should not hand it to anyone who asks.

The good news is that a well-built budgeting app does not ask for it. The connection runs through an intermediary, most often Plaid, and the app never sees your username or password at all. This post explains exactly what that means, what the app can and cannot do with the connection, and the questions to ask any app before you link.

What Plaid is

Plaid is a company that sits between banks and apps. It maintains connections to roughly twelve thousand financial institutions in the United States and Canada, and it provides a standard way for an app to ask, with your permission, for a copy of your account data. Most of the finance apps you have heard of use Plaid or a close equivalent for bank connections, including large budgeting, investing and payment apps.

The reason apps use Plaid rather than connecting to banks directly is that every bank's systems are different, and the banks themselves prefer one audited intermediary to thousands of individual apps. Plaid has agreements with the major banks that define what data can be shared and how.

What happens when you click "Connect bank"

Here is the flow in Money Manager, which is the same flow in any app that uses Plaid properly.

1. The app asks Plaid for a link token. Money Manager's server requests a short-lived token from Plaid that says, in effect, "a user of this app wants to start a connection". Nothing about your bank is involved yet.
2. Plaid Link opens. This is a screen served by Plaid, not by the app. You search for your bank and pick it.
3. You sign in with your bank. For most large banks today this hands you to the bank's own login page, where you enter your credentials and complete any two-factor step. The bank then asks you to confirm which accounts to share. For some smaller institutions Plaid collects the credentials itself to pass to the bank, but either way the budgeting app is not part of this step and does not receive what you type.
4. Plaid returns a public token. Plaid sends the app a one-time code that means "this user authorized a connection".
5. The app exchanges it for an access token. Money Manager's server trades the one-time code for a long-lived access token and stores it, encrypted, against your account. This token is what the app uses from then on to ask Plaid for your transactions.
6. Transactions sync. The app fetches recent history, categorizes it, and keeps fetching new transactions on a schedule.

At no point in that flow does your bank password reach the app's servers. There is nothing to leak because there is nothing stored.

What the connection can and cannot do

The access token is scoped. When Money Manager requests it, it asks for transactions and balances, and that is what the token permits. Specifically:

It can:

• Read the list of accounts you chose to share, with their names, types and masked numbers.
• Read current and available balances.
• Read transactions, including merchant, amount, date and the bank's own category.

It cannot:

• Initiate a transfer, a payment or a withdrawal.
• Change any setting at your bank.
• See accounts you did not choose to share.
• Read your bank username or password, because it never had them.

Plaid does offer products that let apps move money, used by payment apps. Those require a separate authorization and a separate product scope. A budgeting app that only requested transactions cannot quietly upgrade to moving money; it would have to send you back through the consent screen for a different permission.

How to revoke a connection

A connection you can cancel is a connection you control. There are two ways:

• From the app. In Money Manager, open the linked account and choose Disconnect. The app tells Plaid to revoke the token. Transactions already imported stay in your ledger unless you delete them.
• From Plaid Portal. Plaid runs a site at my.plaid.com where you can see every app connected through Plaid with your bank and revoke any of them. This works even if you have deleted the app or lost access to it.

Your bank may also show connected third-party apps in its own security settings and let you remove them there.

Where the risk actually is

Linking a bank through Plaid is not zero-risk. Honest accounting of where the risk lives:

• The app's servers. Your transaction data, once imported, sits in the app's database. The question is how it is protected, who can see it, and what the app does with it. This is why the app's privacy policy matters more than the Plaid connection.
• Your own device and account. If someone has your phone unlocked and your app open, they can see your spending. Use a device passcode and, if the app offers it, a lock on the app itself.
• Data use. Some free apps have monetized transaction data through aggregated or anonymized sales, or by showing offers based on your spending. That is legal when disclosed, but you should know whether it is happening.

The thing people most worry about, their money being moved, is not on this list, because a read-only token cannot do it.

Questions to ask any app before you link

Five questions, and the answers you want:

1. Is the connection read-only? Yes, and it should be stated plainly in the app and the privacy policy.
2. Do you store my bank credentials? No. If the app collects your bank login on its own screen rather than the bank's or Plaid's, close it.
3. Can I export and delete my data? Both, at any time, without emailing anyone to beg for it.
4. Do you sell or share my transaction data? The privacy policy should say what is shared with whom and why. Analytics providers for crash reports is normal; selling spending data to third parties is not something you should accept silently.
5. What happens if I leave? Disconnecting should revoke the token, and deleting the account should delete the data.

Money Manager's answers are on the Security page and in the Privacy Policy. The short version: read-only, no credentials stored, export in three formats, delete any time, no sale of personal data, no ads on the web.

If you still would rather not link

That is a perfectly reasonable place to land, and the app should work without it. In Money Manager you can:

• Add transactions by hand in about ten seconds each.
• Scan receipts with the receipt scanner.
• Upload a PDF or CSV statement from your bank's website and import up to twelve months at once. The statement never leaves your control until you choose to upload it, and the file is deleted after processing.

Bank sync is the convenient path. It is not the only one, and a budgeting app that cannot work without it is making a choice for you that should be yours.