For most people, Plaid is safe to use. It's the established, independently audited plumbing that connects your apps to your bank. Plaid encrypts data with AES-256 at rest and TLS in transit. At most major U.S. banks, you log in on your bank's own site, so your password doesn't pass through Plaid. Below: how Plaid secures the connection, what its privacy track record actually shows, and the two separate steps (revoke, then delete) that put you in full control of any app's access.

Where we stand: Truthifi also connects through Plaid, so we have a business interest in Plaid being trustworthy. That's why the key claims below link to primary sources you can check yourself.

What is Plaid?

Plaid is a financial data network that connects the apps you use to your bank or brokerage. With your permission, those apps can then read your balances and transactions. It's the "plumbing" behind budgeting apps, brokerages, payment apps and Truthifi alike. Plaid's own site describes a network of thousands of apps and financial institutions (Plaid). You've probably used it without noticing: it's the screen that pops up when a budgeting app like Mint or a payment app like Venmo asks you to link your checking account. The detail that matters for safety: after you link, the app holds a revocable token from Plaid rather than your bank login.

Because it sits between your bank and your apps, people search for whether Plaid is safe. The checkable record points one way. Plaid publishes its security controls and reports an annual SOC 2 Type II audit (Plaid security), and its public track record — including the court-approved 2022 privacy settlement covered below — is that of an accountable company that has strengthened its user controls over time. The more useful question is what Plaid does with your data day to day, so the rest of this guide answers it: how your data is protected, what it does with it, and how you stay in control.

Comparing networks? See Is Yodlee safe? and Is Finicity safe? for the other major aggregators.

How does Plaid protect your data?

Is Plaid secure? In short, yes, and it comes down to three things: encryption, audits and how your login is handled. According to Plaid's security page, Plaid encrypts data with AES-256 at rest and TLS in transit, is audited annually under SOC 2 Type II (Plaid security), and gives apps an access token instead of your login.

• OAuth at major banks: at Chase, Bank of America, Capital One, Wells Fargo and most large institutions, you authenticate on your bank's own site, and your username and password aren't shared with Plaid or the app.

• Smaller institutions: where a bank doesn't support OAuth, you may enter your credentials once; Plaid encrypts them and hands the app a token instead of your login, and you can still review or revoke that connection at my.plaid.com.

• Transparency on incidents: Plaid files breach notices with regulators when something goes wrong, which is how you can check its track record rather than take it on trust. The one such notice on record, a data-breach notice filed with the Maine Attorney General (2026), stemmed from what Plaid described as a technical issue rather than a malicious actor, affected a small number of people, and Plaid offered everyone affected 24 months of identity protection. For a network connecting thousands of apps and banks, that is a reassuringly small footprint. Good connection hygiene, which we cover below, keeps your own list of linked apps lean and current.

So for anyone asking "is Plaid safe to link bank account": at major banks, linking through Plaid doesn't hand your password to Plaid or the app. Plaid's data-handling page describes its encryption and security controls in its own words. Get started with Truthifi

Does Plaid sell my data?

No, by Plaid's own account. Plaid states it does not sell or rent your financial data to third parties. It uses the data it collects to operate and improve its products, fight fraud and develop services.

Plaid says it shares only the data the connecting app needs (even if your bank returns more), and before you authorize, it shows you the app, Plaid's role and the accounts involved. Those two scopes differ: according to Plaid's own privacy policy, its own uses (running and improving its products, fighting fraud, developing services) go beyond the slice it passes to the connecting app, and the policy lists the details.

There's also a public record worth knowing, and it's reassuring. In 2022, Plaid resolved a privacy class action, Cottle v. Plaid Inc. (N.D. Cal.), over claims it collected more data than some users understood. Plaid denied liability, and the court granted final approval of the settlement on July 20, 2022. The lasting result was pro-consumer: Plaid agreed to delete certain data and to give users more visibility and control, including featuring the Plaid Portal prominently so you can see and manage every connection. Any "selling" language from that period was the plaintiffs' allegation, not a court finding.

If that history makes you want more visibility, we'd read Plaid's privacy policy and the connecting app's policy before linking. Truthifi doesn't sell your personal information either, and its plans run on a flat monthly or yearly price rather than a cut of your data.

How do I see and remove Plaid connections?

To revoke or delete a connection, sign in to the Plaid Portal (my.plaid.com), which lists the apps you've linked and lets you revoke any app's future access. Revoking is not deletion:

• Revoking stops future access, but an app may keep data you've already shared until you ask that app to delete it.

• Deletion is a separate step. Use the Portal's delete option or Plaid's data-request form at my.plaid.com/data-subject-request-form.

One default to know before you connect an AI assistant: unless you narrow it, your AI assistant can see all the accounts you've linked in Truthifi. The same revoke-and-delete logic applies. To restrict an assistant's view, select it under Settings → Sharing; revoke its access whenever you like under Connections → Agents → ⋯ → Revoke. Our guide to connecting Truthifi to your AI agent walks through the setup.

1. Sign in to the Plaid Portal. Sign in at my.plaid.com to see the apps you've linked through Plaid.

2. Revoke an app's access. Revoke any app's future access from the Portal. Revoking stops future access but is not the same as deletion.

3. Request deletion from Plaid. To have Plaid erase data it already holds, use the Portal's delete option or Plaid's data-request form.

4. Ask the app to delete its copy. Ask the connected app to delete the data it already received, since an app may keep shared data until you ask.

What Truthifi adds on top of Plaid

Plaid moves your account data; Truthifi is the layer on top. Connect once through Plaid, and Truthifi standardizes what each institution sends. If one brokerage reports a payout as "DIV" and another as "Cash dividend," both show up under one dividend label. Hold the same fund at two brokers, and it appears as one position with your combined holding. You and your AI assistant end up working from the same consistent numbers, as the table below shows.

That standardizing is the job of Truthifi's correction-and-verification engine, the Refinery, which reruns its data-quality corrections, such as the label and position matching above, each time a connected account refreshes.

Truthifi's access to those accounts is read-only. It can read what Plaid sends, but it can't move money, place trades or change anything at your bank. You sign in on your bank or broker's own site through Plaid, not through Truthifi, so Truthifi doesn't see or store your banking username or password. You can read how it handles and protects your data on its security and privacy page.

Truthifi connects through Plaid, Yodlee and ByAllAccounts, so it isn't tied to a single network. Its own count of reachable institutions (18,000+, per internal Truthifi platform data that no outside body verifies) matters less than whether yours is among them. Look up your bank or broker at truthifi.com/connections before you link it. Truthifi isn't a Plaid alternative; it builds on the Plaid connection you already have.

Ask your own AI assistant about your accounts

Current consumer plans, including the free ones, come with Truthifi's MCP server. MCP (Model Context Protocol) is an open standard that lets your AI assistant connect to outside tools and data, separate from the Plaid connection that moves your bank data in. To set it up, pick Truthifi from an assistant's own connector menu, sign in, then click Authorize. There's no API key to enter for most assistants, and you don't need spreadsheets or code.

Then ask something like "Which of my accounts costs me the most in fees?" and Truthifi answers from your own accounts. Which questions you can ask depends on your plan; see how Truthifi Connect works for what each plan includes.

One picture for investors, advisors and firms

When you share accounts with an advisor or firm, you both see the same standardized Truthifi view, built from what Plaid and your other data partners send. It shows how your money splits by asset class, sector, industry and country, and Truthifi checks it for fees, concentration and other issues. Truthifi schedules an automatic refresh of this view once a day, and that refresh depends on the same Plaid link covered above. If a bank's Plaid connection stops working, or you revoke it at my.plaid.com, the refresh can't pull new data from that bank until you reconnect it.

If you work with an advisor or a firm, you can choose to share accounts with them. Your advisor sees everything you've chosen to share, and you can stop sharing whenever you want.

It's worth asking how any company handling your financial data makes money. Truthifi is paid through subscription fees rather than commissions or ads, and it doesn't tell you what to buy or sell. Beyond the free checkup (limits apply), the Monitoring plan is $79.99 a year. Monitoring Plus+ is a separate tier; its current price is listed on the Truthifi pricing page. Both Monitoring and Monitoring Plus+ include the built-in Truthifi AI agent. → How Truthifi Connect works

Truthifi for financial advisors

Advisors and firms can sponsor their clients. A sponsored client's Truthifi plan is free, paid for by the advisor or firm, and the client decides what to share and can turn sharing off at any time, so you're both working from the same numbers. See how Truthifi keeps your accounts secure

→ Truthifi for Advisors · Request a demo

The bottom line

Before you link anything through Plaid, run three quick checks: make sure you're signing in on your bank's real website rather than a lookalike, share only the accounts the app actually needs, and bookmark my.plaid.com so you can see or revoke any connection later. Those checks cover the parts you control, and Plaid's own encryption, independent audits and breach transparency cover the rest. If you'd like a checked view of the accounts you do link, Start a free Truthifi checkup → (limits apply)

One habit most people skip: when you stop using an app, revoke it at my.plaid.com the same day, because a forgotten connection can keep its access until you remove it. Once a year, open the Portal next to your phone's app list. Any app you've deleted from your phone but still see in the Portal should come off there too. Do that once, and you'll see something no single app shows you: every company that still holds a link to your bank, listed in one place.

Frequently asked questions

Is Plaid legit?

Yes. Plaid is an established, SOC 2 Type II-audited data network used by thousands of regulated apps and banks to connect accounts securely. It encrypts data with AES-256 at rest and TLS in transit, and at most major U.S. banks you log in on your bank's own site, so your password doesn't pass through Plaid or the app. A public, court-approved 2022 settlement that strengthened its user controls, and the breach notices it files with regulators, both covered below, show an accountable company you can verify rather than take on trust.

Can Plaid be trusted with your bank login?

At major banks, Plaid uses OAuth: you log in on your bank's own website, so your username and password aren't shared with Plaid or the app. Plaid is SOC 2 Type II audited and encrypts data with AES-256, and the connected app receives a revocable access token rather than your banking login.

Can Plaid move money from my account?

Plaid's data connections to your bank are read-only. Moving money requires a separate, explicit payment authorization; it isn't something a data connection does on its own. Connected apps receive an access token, not your raw banking login, and you can revoke any app's future access at my.plaid.com. (Plaid)

Does Plaid sell my data?

No. Plaid says it does not sell or rent your financial data. It uses collected data to operate and improve its products, fight fraud and develop services. A 2022 privacy class action was resolved with a court-approved settlement that strengthened Plaid's user controls, with no court finding that it sold data.

How do I remove or delete Plaid?

You do this in two steps, and both are at my.plaid.com. Manage and revoke app connections there; to delete data Plaid already holds, submit a request at my.plaid.com/data-subject-request-form, and ask the connected app to delete its copy too. Revoking stops future access, but it is not the same as deletion.

What do people on Reddit say about whether Plaid is safe?

Opinions in forum threads vary, and individual posts aren't a reliable guide to how Plaid actually handles your data. The checkable facts are these: at major banks Plaid uses OAuth so your password isn't shared, it's SOC 2 Type II audited, and you can revoke any connection at my.plaid.com.

Why use Truthifi and Plaid together?

Plaid and Truthifi do different jobs. Plaid securely connects your accounts and moves the data, while Truthifi cleans and reconciles it into one household-level picture, refreshes it automatically once a day, and lets you connect your own AI assistant to it. You aren't choosing between them: Truthifi connects through Plaid, Yodlee and ByAllAccounts rather than replacing any of them.

Does Truthifi reach accounts Plaid doesn't?

Truthifi isn't limited to Plaid. It also connects through Yodlee and ByAllAccounts, and together those partners let it reach more than 18,000 financial institutions. If one network can't reach your bank or broker, another often can, so check your institution's status at truthifi.com/connections before you link it.

---

About the author

Written by Truthifi Bot, Truthifi's research engine, which drafts these guides from Truthifi's data and public sources. Every page is reviewed by the Truthifi Team before publishing.

Reviewed by Truthifi Team

Read next from the Truthifi blog

• How Truthifi Connect works: the read-only, credential-free way to put your accounts to work

• Connect Truthifi to your AI agent: read-only and revocable

• Is it safe to connect your bank accounts?: the parent guide (Plaid, Yodlee, Finicity, MX, ByAllAccounts)

• Is Yodlee safe? · Is Finicity safe?: the other major aggregators

---

This is general information, not legal or financial advice. Truthifi is not an investment adviser and doesn't give investment, tax or legal advice. Check Plaid's current policies before you decide. Questions: support@truthifi.com.

Plaid is a trademark of Plaid Inc. This is independent editorial content and is not endorsed by, affiliated with, or sponsored by Plaid; the Plaid name is used nominatively for identification and commentary only.