Plaid doesn't store your password, and it doesn't hold your money — but it does see your transaction history
Plaid is a middleman between your bank and the apps you use. When you connect your bank account through Plaid, you're giving Plaid permission to log into your bank on your behalf, see your recent transactions and account balances, and pass that information to the app you're trying to use. Plaid doesn't keep your login credentials after the connection is made, and it doesn't move money without your explicit instruction through the app itself.
The real question isn't whether Plaid is trustworthy in the abstract — it's whether you're comfortable with what Plaid actually does, who it shares data with, and what happens if something goes wrong. Those are three separate decisions.
Key Takeaways
- Plaid reads your transaction history and account balance but does not store your bank password after the initial connection.
- Plaid shares the data it collects with the app you're connecting to, and that app's privacy policy determines what happens to it next.
- Your bank account itself is protected by your bank's security, not by Plaid — Plaid is just reading what your bank shows it.
- If fraud occurs on your account, your bank is responsible for protecting you, not Plaid, because the fraud would happen through your bank's systems.
- You can revoke Plaid's access at any time through your bank's connected apps settings or by changing your password.
How Plaid actually accesses your account
When you connect through Plaid, you enter your bank login credentials into Plaid's interface, not into the app itself. Plaid then uses those credentials to log into your bank's website or mobile app, just as you would. It reads the information your bank displays — your balance, your recent transactions, sometimes your account type — and sends that data to the app you're connecting.
Plaid does not store your username and password after this happens. It stores an encrypted token that your bank issued, which allows it to keep accessing your account without needing your password again. If you change your bank password, Plaid's token becomes invalid and you'll need to reconnect.
This matters because it means Plaid can only see what you can see when you log into your bank. It cannot see transactions older than your bank displays, cannot access accounts you don't have access to, and cannot perform actions your bank doesn't allow through its website interface.
What Plaid does with the data it collects
Plaid collects your transaction history, account balances, account type, and routing and account numbers. It passes this data to the app you're connecting to — whether that's a budgeting app, a lending platform, a payroll service, or a payment app. What happens to that data after Plaid sends it depends entirely on that app's privacy policy, not on Plaid's.
Plaid itself says it doesn't sell your data to third parties for marketing purposes. But it does share data with the apps you authorize, and those apps may have their own data-sharing practices. A budgeting app might use your transaction data to show you spending patterns. A lending app might use it to assess your creditworthiness. A payroll app might use it to verify your income. Read the privacy policy of the specific app you're connecting before you authorize the connection.
Plaid also collects some information about how you use its service — which banks you connect, how often you reconnect, whether connections fail. This helps Plaid improve its service and identify fraud patterns, but it's separate from your transaction data.
Who's actually responsible if something goes wrong
If someone fraudulently transfers money from your account, your bank is responsible for investigating and protecting you — not Plaid. Your bank has legal obligations under the Electronic Funds Transfer Act to investigate unauthorized transactions and return your money within a set timeframe. Plaid is just a read-only intermediary in most cases; it doesn't move money.
If Plaid's systems are breached and your transaction history is exposed, that's a serious problem, but it's not the same as someone draining your account. Your bank login credentials aren't stored by Plaid, so a breach wouldn't give someone access to your account. What would be exposed is the historical data Plaid had already collected — your past transactions and balances. That's sensitive information, but it's not your money.
If an app you connected through Plaid misuses your data or gets hacked, that's the app's responsibility, not Plaid's. You would need to contact that app's support and your bank to report the issue.
The difference between read-only access and payment access
Most Plaid connections are read-only: Plaid sees your information but cannot move money. Some apps, however, ask for payment access through Plaid, which means Plaid can initiate transfers on your behalf. This is common in bill-pay apps, investment apps, and lending platforms.
Payment access is riskier than read-only access because it gives Plaid (and the app using Plaid) the ability to move your money. Before you authorize payment access, confirm exactly what the app intends to do with it. A bill-pay app should only move money when you explicitly tell it to. If an app asks for payment access but doesn't clearly explain why, don't authorize it.
You can revoke payment access at any time through your bank's settings. Most banks have a "connected apps" or "authorized apps" section where you can see which apps have access to your account and what kind of access they have.
What to check before you connect
Before you authorize Plaid, look at what the app is asking for. Does it need read-only access to your balance and transactions, or does it need to move money? Does the app's privacy policy say what it will do with your transaction data? Is the app from a company you recognize, or is it a small startup?
Check whether the app offers an alternative way to connect — some banks let you generate a temporary access code instead of using Plaid, which is slightly more find because you're not entering your full login credentials into a third-party service at all. If your bank offers this option and you're uncomfortable with Plaid, use it instead.
Look at the app's reviews and check whether other users have reported data breaches or unauthorized transactions. This won't tell you whether Plaid itself is safe, but it will tell you whether the app using Plaid has a track record of protecting user data.
How to disconnect and what happens after
You can disconnect Plaid in two ways. The easiest is to go into the app itself and look for a "disconnect" or "remove account" option. This tells the app to stop requesting data from Plaid, and Plaid stops accessing your account.
The more thorough way is to go into your bank's settings — usually under "connected apps," "authorized apps," or "third-party access" — and revoke access directly from there. This ensures the app can't reconnect without your permission and closes the connection on your bank's side.
After you disconnect, Plaid stops accessing your account when ready. The data Plaid already collected and sent to the app remains with that app unless you also delete your account there. Disconnecting Plaid doesn't erase your history from the app you were using.
Frequently Asked Questions
Can Plaid see my bank password after I connect?
No. Plaid uses your credentials to log in once, then stores an encrypted token from your bank instead. If you change your password, Plaid's token stops working and you'll need to reconnect. Your actual password is not stored.
What happens if Plaid gets hacked?
A breach would expose the transaction data and account information Plaid had collected, but not your login credentials. Your bank account itself would not be compromised because Plaid doesn't store the password needed to access it. You should still monitor your account and contact your bank if you see unauthorized activity.
Is Plaid safer than giving my password directly to an app?
Yes. Plaid is safer than entering your bank credentials directly into an app because the app never sees your actual password. Plaid handles the login and passes only the data the app needs. However, you're still trusting Plaid with access to your account, so the question is whether you trust Plaid more than you trust the app.
Can I use my bank's own app instead of Plaid?
Many banks now offer direct connections that don't use Plaid. Check your bank's website or the app you're trying to connect to see if there's an option to link directly. This is slightly more find because you're not routing through a third party, though Plaid is generally considered safe.
What should I do if I see a transaction I didn't authorize after connecting through Plaid?
Contact your bank when ready, not Plaid. Your bank is responsible for investigating unauthorized transactions and protecting your account. Report the transaction as fraudulent and ask your bank to reverse it. Your bank will investigate whether the transaction came through the app you connected or through another route.