Privacy and security
Is Plaid safe?
Mostly, yes. Plaid encrypts data, has never reported a hack, and at most large US banks it now connects through the bank's own API instead of storing your password. The real risks are elsewhere: the apps you share data with keep their own copy, old connections keep sharing until you remove them, and Plaid itself paid $58 million in 2021 and had a small data exposure in 2026. Below is what Plaid can see, what went wrong, and how to check and cut your connections in five minutes.
What Plaid is, and why you have probably used it
Plaid is the company in the middle when an app says “connect your bank”. You pick your bank in a Plaid window, sign in, and Plaid fetches the data the app asked for: account and routing numbers, balances, transactions, sometimes your name and address. The app never sees your bank password. Payment apps like Venmo and most US budgeting and net worth apps work this way, so many people have Plaid connections they never knowingly set up.
A disclosure before you read on:NetWorthTrackr does not use Plaid or any other aggregator. You type balances in yourself. We have tried to be fair below, and the answer is not “never link your bank”.
How a connection works today: bank APIs, not your password
The old worry about Plaid was screen scraping: you typed your bank password into Plaid, Plaid stored it and logged in as you. That is still how it works at some smaller banks. At the large ones it has changed. Chase, Wells Fargo, Citi, Truist and many others now give Plaid a token through their own API. You sign in on the bank's page, the bank decides what to share, and Plaid never holds your password.
In 2025 JPMorgan moved to charge aggregators for that access, and by November it had paid deals with Plaid, Yodlee, Morningstar and Akoya (Reuters, November 2025). The US rule meant to guarantee free, standard access to your own data (the CFPB's “Section 1033” open banking rule) was blocked by a court in October 2025, and its rewrite had not been published as of October 2026. So the rules here are still moving.
How to tell which kind you have:if the connect screen sends you to your bank's own website or app to approve, it is an API connection. If you type your bank username and password into a window inside the app, Plaid is storing credentials for that bank.
What has actually gone wrong
| When | What happened | Were bank passwords exposed? |
|---|---|---|
| 2021 to 2022 | Class action settled for $58 million. It claimed Plaid took more data than apps needed and that its login screen looked like the bank's own. Plaid denied wrongdoing and agreed to collect and keep less data. | Not alleged |
| Dec 2024 to Apr 2026 | When phone carriers gave an old number to someone new, Plaid sometimes matched the new owner to the old owner's profile. Names, addresses, Social Security numbers and bank account numbers could be seen. Plaid says it was a bug, not an attack, and notified affected people in April 2026 (294 people, per its Maine filing as reported in the press). | No, per Plaid's notice |
Sources: the settlement website and Plaid's notice to the New Hampshire attorney general. No breach by an outside attacker has been reported.
Our reading: for a company connecting accounts for thousands of apps, that is a good record. The 2026 issue still matters, because it shows the data Plaid holds about you goes beyond transactions, and that a phone number is part of how it recognises you.
The real risk is the app, not the pipe
Plaid moves your data. The app you connect is where it ends up, and that app is usually smaller, younger and less audited than Plaid. Four things are worth checking:
- Copies outlive the connection. Disconnecting stops new data flowing. It does not delete what the app already stored. Plaid says this itself in its help pages.
- Forgotten connections keep sharing. The budgeting app you tried for a week in 2022 can still be pulling transactions today.
- Apps ask for more than they show. A net worth app may only display your balance but request transactions and identity data too. The connect screen lists what is requested; read it.
- Free often means you are a lead. Some free dashboards make their money from advisory or loan offers built on the data you linked.
How to check and cut your Plaid connections
- Go to my.plaid.com (Plaid Portal) and sign in with the phone number you use for your apps.
- Open the Overview tab. Every app you have connected through Plaid is listed.
- Pick an app you no longer use, scroll to Manage connections, choose Disconnect app, then pick the bank and confirm (Plaid's steps).
- Ask that app to delete the data it kept. Plaid cannot do this part for you. In the US most apps have a privacy request form; in the UK and EU you can make a GDPR erasure request.
- Optionally, delete your data from Plaid itself, also from Plaid Portal.
Many large banks also list connected apps in their own security settings, which catches connections made through other aggregators like Yodlee or MX.
If you live in the UK or Europe
Most of the above is a US story. In the UK and EU, apps that read your accounts must be regulated, and banks must offer them an API, so you approve access on your bank's own screen and nobody stores your password. Plaid works this way in Europe too, as do Tink, TrueLayer and GoCardless.
In the UK you now confirm your consent with the app every 90 days, instead of signing in to your bank again (FCA). If you stop confirming, access lapses on its own, which makes forgotten connections less of a problem than in the US.
When to skip linking altogether
Linking is a fair trade if you want spending categorised automatically and you are happy for one more company to hold your transactions. It is a poor trade if you only want to know your net worth. That is a handful of balances, updated monthly, and most of it (property, pensions, money in another country) no bank feed can see anyway.
That is the case we built NetWorthTrackr for: you enter balances, shares and crypto price themselves, and there is no connection to check, cut or forget. See tracking net worth without a bank login for how it works, or try the demo on sample data.
Common questions
Generally yes. Plaid encrypts data, has never reported a breach by an outside attacker, and at most large US banks connects through the bank's API rather than storing your password. The bigger risk is the app you share data with, which keeps its own copy, and old connections you have forgotten about.
It depends on the bank. Where your bank offers an API (Chase, Wells Fargo, Citi and many large US banks; in the UK and EU banks must offer one), you sign in on the bank's own page and Plaid gets a token, not your password. At banks without one, Plaid still logs in with the credentials you enter.
No hack has been reported. In April 2026 Plaid notified a few hundred people that a bug involving recycled phone numbers let some users see another person's profile, including Social Security and account numbers. Plaid said bank passwords were not exposed. In 2021 it also paid $58 million to settle a privacy class action, without admitting wrongdoing.
Sign in at my.plaid.com, open the Overview tab, choose the app, and select Disconnect app under Manage connections. Then ask the app to delete the data it already holds, because disconnecting only stops future sharing.
Yes. Manual trackers such as NetWorthTrackr never connect to a bank: you enter balances, and market holdings like shares and crypto update from public prices. A spreadsheet works too, at the cost of more upkeep.