Is Plaid safe? What it sees, keeps, and how to remove its access

Is Plaid safe? Safe enough for many people, but the better question is what you are trading. Plaid is a large, well-run company that encrypts its connections and gives you a portal to see and cut off what you shared. Connecting an app through it still means a third party gets ongoing read access to your transactions, keeps data under its own policy, and passes it to the app you picked. If you would rather skip that trade, you can budget without linking your bank, and our guide to budget apps that don't connect to your bank compares the options.

What Plaid is, and who uses it

Plaid sits between your bank and an app. The app does not talk to your bank. Plaid does, and hands the data over through its API. Plaid says it supports more than 12,000 financial institutions and that more than 9,000 digital financial services are built on it (Plaid, company page).

So you are not trusting one company. You are trusting the app, Plaid, and the link between them.

How a connection works

There are two kinds of connection, and they are not equally private.

OAuth, at banks that support it. Plaid sends you to your bank. You sign in on the bank's own site or app, approve what it shares, and come back. Plaid names Chase, U.S. Bank and Wells Fargo among its OAuth banks, and says these connections stay up longer and need fewer re-logins. Consent at many US OAuth banks has to be renewed every 12 months (Plaid docs, OAuth guide).

Credentials, at banks that do not. You type your bank username and password into Plaid's own window, and Plaid signs in for you. Plaid says it does not pass that username and password on to the app (Plaid, how it works). Its privacy policy says it collects login data when your bank requires it, plus security answers and one-time codes when needed to connect (Plaid End User Privacy Policy).

The practical test: watch the window. If it hands you to your bank's own login, your password stays with your bank. If you type it into Plaid's window, Plaid now holds a way into your bank account. That is the bigger thing to trust.

What Plaid receives and keeps

Plaid's End User Privacy Policy (effective 8 December 2025) lists what it can collect from a connected account:

• account details: the institution, the account type, account and routing numbers
• current and available balances
• transaction history
• depending on what the app asks for, credit, loan and investment data, and payroll or tax data
• who you are: name, email, phone number, date of birth, address and, in some cases, a Social Security number

Two details matter more than the list. The data can come from every account reachable with that one login, not only the account you meant to share. And Plaid's uses include improving its services, building new ones and training AI systems, and making aggregated or de-identified data for research and new products (Plaid End User Privacy Policy).

On keeping it, Plaid says it holds data only as long as it is needed. When an app removes your connection, Plaid says its systems are designed to delete your personal data automatically, with exceptions: you still have another active Plaid connection with a different app, the law requires it, it is needed against fraud, or it has been de-identified.

On sharing, Plaid's consumer privacy notice (on the same legal page) says it shares for its everyday business purposes, which you cannot limit, and does not share for its own marketing. Sharing with other companies so they can market to you happens, it says, only with your consent or at your direction.

The policy is explicit about one gap: it does not cover what the app does with your data. That is the app's privacy policy, and you need to read both.

The 2022 settlement

In In re Plaid Inc. Privacy Litigation, in the Northern District of California, users alleged that Plaid collected bank data without proper consent through apps such as Venmo, Coinbase and Cash App, used login screens that looked like their banks', and sold transaction histories. Plaid agreed in August 2021 to pay $58 million, delete some data, store less, and improve its disclosures. It did not admit liability and said it had never sold data (CyberScoop). Judge Donna M. Ryu granted final approval on 20 July 2022 (Lieff Cabraser, class counsel).

The case was not about a breach. It was about data being collected more widely than people understood when they clicked "connect". That is still the risk to weigh.

How to see and remove Plaid's access

There are three places to look, and you may need all three.

1. Plaid Portal, at my.plaid.com. For users in the United States. You verify your phone number and email and set a password. The dashboard lists your connected accounts and the types of data each app receives. From there you can end a connection and delete the data Plaid holds for it. Plaid also offers a request form and privacy@plaid.com (Plaid End User Privacy Policy).
2. Your bank. OAuth connections often show up in the bank's own security settings. Chase, for example, began a phased rollout of a Data Security Center in its mobile app on 25 September 2026: you can see connected apps, choose which accounts each one reaches, set how long access lasts, and unlink (Chase). Other banks use other names. Search your bank's help for "connected apps" or "linked apps".
3. The app itself. Disconnect there too, and ask it to delete what it already has. Cutting Plaid off stops new data. It does not erase the copy the app already received.

Section 1033: the rule that would set the terms is on hold

The CFPB issued its Personal Financial Data Rights rule, under section 1033 of the Dodd-Frank Act, on 22 October 2024, effective 17 January 2025 (CFPB, final rule). It would require banks to make your data available to you and to third parties you authorize, with limits on how those third parties use it.

As of 24 October 2026 it cannot be enforced:

• On 29 October 2025, Judge Danny Reeves of the Eastern District of Kentucky issued a preliminary injunction barring the CFPB from enforcing the rule while it reconsiders it (ABA Banking Journal).
• The CFPB opened that reconsideration on 22 August 2025, asking about four things: who may act for a consumer, fees, data security and data privacy (CFPB).
• The federal regulatory agenda estimated a proposed rule for July 2026 (reginfo.gov). No proposal has appeared in the Federal Register as of today.

For now, what an app or an aggregator may do with your data is set by its own policy and by older laws, not by this rule.

What to ask an app before you connect

• Which aggregator do you use, and will I sign in on my bank's own screen?
• Is the access read-only, or can you move money?
• What do you store, where, and is the access token encrypted?
• When I disconnect, what happens to the transactions you already imported?
• Do you sell or share transaction data, show ads, or train AI on it?
• Does the app work fully without a bank?

How Tavala does it

Tavala uses Plaid only for an optional add-on to Tavala Plus, for banks in the United States and Canada. It is read-only: Tavala can see transactions and balances and can never move money (connect a bank account). Tavala never sees your bank password. The access token Plaid issues is stored encrypted on Tavala's server and never reaches your device, so it is never in your data export either. Disconnecting removes the connection at Plaid straight away, and you choose whether the imported entries stay as ordinary entries or are deleted (disconnect a bank). Everything else in Tavala works with no bank at all (what Tavala stores).