Is it safe to connect your bank to an app?

It is the right question to hesitate over, and "yes, we use bank-level encryption" is not an answer to it. Encryption is about the pipe. What you actually want to know is what comes out of the other end and what it is permitted to do.

So here is the mechanism, the questions that separate a safe connection from a risky one, and the risks that are left over after all of them. I build one of these apps, so read the last section with that in mind. The first four sections are true regardless of who you pick.

What actually happens when you connect an account

You are almost never handing your bank password to the app. The normal flow in the US goes through an aggregator, usually Plaid, and works like this:

1. The app opens a window it does not control. What you type there goes to the aggregator, and for most large banks the window is your bank's own login page.
2. You authenticate with your bank, not with the app.
3. The bank issues an access token scoped to specific permissions.
4. The app stores the token. It never sees your username or password.

The token is the important object. It is revocable, it is scoped, and it is not a password. If the app is compromised tomorrow, an attacker gets a token that does whatever that token was scoped to do, which is why the scope is the whole question.

The question that actually matters: read or write

Bank connections are not one permission. They are a menu, and apps request specific items from it.

Roughly, in Plaid's vocabulary:

Permission	What it grants
transactions	See transaction history and balances
auth	See your account and routing numbers
identity	See the name, address, phone on the account
transfer / payment_initiation	Move money

An app that only holds transactions cannot move your money. Not "promises not to". It has no credential that a transfer endpoint would accept. That is a different kind of assurance from a policy document, because it does not depend on anyone keeping a promise.

An app that holds auth has your account and routing numbers, which is what is needed to set up an ACH debit. That may be entirely legitimate: it is how a budgeting app that also pays your bills, or a neobank, or anything that moves money has to work. But it is a materially larger amount of trust, and it is worth knowing which one you are giving.

Most apps do not tell you plainly. You can usually see it in the consent screen during linking, and you can always ask support directly. "Which Plaid products does your app request?" is a specific question, and a vague answer to a specific question is itself an answer.

Five questions worth asking any money app

1. What can it do, not what does it promise? Read-only is a property of the token. Ask for the list of permissions rather than the reassurance.

2. What happens when I delete my account? The useful follow-up is whether the bank connection is revoked at the aggregator too, or only forgotten locally. Those are very different. An app that deletes its own copy but leaves the token live has not disconnected you.

3. How does it make money? If the answer is not "subscriptions", your transaction history is part of the business model. That is not automatically sinister, and plenty of free apps are honest about it, but free apps in this category have historically monetized through lead generation and partner offers, which requires knowing a lot about you.

4. Who else holds the data? At minimum: the app, the aggregator, and their infrastructure providers. Each is a separate place your history exists. More parties is more surface.

5. Does it use OAuth with my bank? For most large US banks, linking now goes through the bank's own login page and no credential ever reaches the aggregator. For smaller institutions, older credential-based methods may still be in use. If your bank supports the OAuth path, that is a meaningfully better connection.

The risks that remain, honestly

Nothing above makes this risk-free, and I would rather say so than sell you a clean story.

Your transaction history is genuinely sensitive, and it is copied. Where you shop, where you travel, what you pay for medically, who you send money to. Even with read-only access, that data now exists somewhere other than your bank. That is the real cost of any of these apps, and no permission model removes it.

More parties means more exposure. Your app, your aggregator, and every service either of them depends on. A breach at any of them is a breach of you. This is an argument for connecting fewer apps rather than for connecting none.

Your bank's terms are worth reading. Some agreements have historically included language about liability when account access is shared with third parties. In the US, consumer protections for unauthorized electronic transfers are generally strong, but I am not a lawyer and your agreement is the document that governs you. The OAuth path, where no credential is shared at all, sidesteps most of this by construction.

Connections break, and quietly. Re-authentication expires, banks re-issue account identifiers, and an app working from stale data can be confidently wrong. That is not a security risk, but it is a correctness one, and an app that does not tell you when it has gone stale is not being straight with you.

What Ralphy does, specifically

I would rather be checkable than reassuring, so here is the actual configuration.

Ralphy requests one Plaid product: transactions. Not auth, so it never receives your account or routing numbers. Not transfer or payment_initiation, so there is no endpoint it could call to move money even if someone stole everything we have. The one additional permission it ever asks for is liabilities, which reads credit card due dates, minimums and APRs so the forecast can price them, and it is read-only too.

Your credentials never reach Ralphy. You sign in with your bank through Plaid, and Ralphy receives a token.

Disconnecting actually disconnects. Removing a bank calls Plaid's item/remove, which ends Ralphy's access at the source rather than just forgetting it locally. Deleting your account deletes your data, and it is not archived or kept in anonymized form.

Subscriptions are the only revenue. $3.99 a month. No ads, no data sold, no partner kickbacks. There is nothing else for your history to be worth to us.

Ralphy still holds your transaction history, because it cannot forecast your money without it, and that remains the honest cost. What I can tell you is exactly what it is used for, that nothing leaves for a third party, and that the number it produces shows its own working so you are never asked to take any of it on faith.

There is a fuller list of the things Ralphy structurally cannot do on the home page, and the privacy policy is written in plain sentences rather than in the usual fog.

---

If you would rather not connect anything at all: the arithmetic is simple enough to do on paper, and there is a browser demo that runs on sample data with no account and no bank.