Is Plaid Safe? What It Sees, What It Shares, and How To Delete It

You're setting up Venmo, linking a budgeting app, or funding a new brokerage account, and a screen appears asking for your bank username and password. It isn't your bank's website. It says Plaid.

So is Plaid safe? For most people, yes. Plaid encrypts your data, and in many cases the app you're connecting never sees your bank password at all. Privacy is the harder question, because Plaid can see far more than most apps actually need.

Here's what Plaid collects, who gets it, and how to see and delete what it's holding.

What is Plaid?

When an app needs to reach your bank account, it usually doesn't build that connection itself. It hands you off to Plaid, a Fintech company, which does the connecting.

Most people have probably never signed up for Plaid on purpose and have only come across it mid-signup somewhere else. Plaid says it connects to more than 12,000 financial institutions across the U.S., Canada, the UK, and Europe, powers more than 7,000 apps, and that one in two U.S. adults has connected an account through it. Those are the company's own numbers, not independently audited ones.

The apps are the ones you'd expect: payment apps, budgeting tools, brokerages, lenders, and crypto exchanges. Popular examples include:

• Chime
• Acorns
• Rocket Money
• Copilot
• Wave
• Wise
• Venmo
• SoFi

Is Plaid safe to use?

Plaid is very secure. The company says it protects data with AES-256 encryption and TLS, requires multi-factor authentication in its systems, monitors its API continuously, and submits to outside security testing.

Two things matter more than the certifications.

First, where your bank password goes. With many large banks, Plaid uses a bank-hosted login, so you authenticate with your bank directly, and Plaid receives a token instead of your credentials. For smaller institutions that don't support it, you enter your username and password on the Plaid screen. Plaid's privacy policy confirms it collects login data "when required by the provider of your account," which tells you the credential-based method is still in use. The token method is meaningfully safer. You don't get to pick it, though. Your bank does.

Second, safe and private aren't the same. Plaid protects your data competently, but it also collects a lot of it, which we cover below.

What Plaid can see

What Plaid pulls depends on which products the app requests. Plaid publishes the breakdown by product:

Plaid product	What it can access
Auth	Account and routing numbers
Balance	Current and available balances
Identity	Name, email address, phone number, and mailing address held by your bank
Transactions	Up to 24 months of categorized transaction history
Liabilities	Credit card, mortgage, and student loan data, including balances, due dates, and interest rates
Investments	Retirement, brokerage, education savings, and health savings account data
Income	Income and employment data
Assets	A point-in-time view of balances, transaction history, and account holder identity

Plaid can also collect your Social Security number, date of birth, security questions and answers, and one-time passcodes, plus device data like your IP address, device location, and browser information.

Then there's the detail almost nobody mentions. Plaid's policy states that the data collected "may include data from all accounts (e.g., checking, savings, credit card, and joint accounts) accessible through a single set of account credentials." One login can expose every account behind it, including a spouse's joint account, even when the app asks about only one.

Plaid also says it derives new information from what it collects, such as your annual income and geolocation.

What Plaid shares and who gets it

Plaid's data page says the company doesn't sell or rent your personal information to outside companies, and the privacy policy says Plaid doesn't share data with non-affiliated third parties except as permitted by law.

The list of who can receive your data is still long. Per the policy, it includes the app's developer, your financial institutions, payment providers, service providers and contractors, fraud prevention and identity verification vendors, cloud and software vendors, professional advisers, other Plaid group companies, and law enforcement when compelled.

Two uses are worth reading closely, because they go beyond running the app you signed up for. Plaid lists developing new products among its purposes, "including to develop, train, test, and deploy artificial intelligence ('AI') systems." It also lists developing insights from your transaction data and from which accounts you've connected to which apps, to share with your banks and connected apps.

So while Plaid isn't selling your data, it also isn't only powering the app you wanted.

Plaid risks

• The 2022 privacy settlement. In In re Plaid Inc. Privacy Litigation, a federal judge in the Northern District of California granted final approval on July 20, 2022, to a $58 million settlement. The plaintiffs alleged Plaid used consumers' bank login credentials to collect more financial data than the apps needed. Beyond the payment, Plaid agreed to change its interface design, disclose more to consumers, and delete transaction data for people whose apps hadn't requested it.
• The 2026 data exposure, which wasn't a hack. In a May 11, 2026 filing with the New Hampshire Attorney General, Plaid disclosed a technical issue affecting connections made after December 25, 2024. When mobile carriers recycle disconnected phone numbers and reassign them, some Plaid accounts tied to those numbers were mismatched, and the new owner could see profile information belonging to the number's previous owner. Depending on the service, that could include name, date of birth, address, driver's license number, and Social Security number. Plaid stated that bank login credentials were not exposed, that the cause was a technical issue rather than a malicious actor, and that it removed the incorrectly connected accounts. Notices went out April 27, 2026, with two years of identity protection offered.
• Fake Plaid screens. Because you've been trained to type bank credentials into a screen that isn't your bank, phishing pages that copy the Plaid interface work well. Plaid emails connection confirmations from noreply@plaid.com. If one arrives for a connection you didn't make, that's your signal.

What to do if you've already linked accounts through Plaid

Review what you've connected

Go to my.plaid.com and set up Plaid Portal by verifying your phone number and email and creating a password. The dashboard shows which financial accounts you've connected to which apps, and the types of data shared with each. The portal is available to U.S. users.

Sign up with your phone number to create an account.

Once you verify your number, Plaid prompts you to create an account.

Then verify your email to finish creating your Plaid Portal account and manage your connected apps and financial accounts.

Disconnect the apps you don't use

The portal lets you terminate the connection between an app and your financial accounts. Work through the list and cut anything you've stopped using, along with anything you connected once for a single transfer.

Delete the data Plaid still holds

The portal can also delete associated data from Plaid's systems. You can submit a formal request through Plaid's data request form instead.

Plaid says its systems are designed to delete your data automatically when a developer removes your connection, but it lists exceptions: another active connection through Plaid, data needed to provide a service you requested, legal retention requirements, fraud prevention and support needs, and data that's been aggregated or anonymized so it can't be reidentified.

Deleting from Plaid also doesn't touch what the app already received. That's a separate request to the app.

Protect the accounts behind the connection

Cleanup handles what's already out there. Monitoring handles what happens next, especially if your Social Security number or account numbers were exposed in a breach. A password manager keeps a unique password on every account, multi-factor authentication blocks most account takeovers, and a data removal service pulls your personal details off broker and people-search sites.

How to link a bank account more safely next time

• Pick the bank login flow when it's offered. If Plaid redirects you to your own bank's page, use it. Your credentials stay with your bank.
• Check whether the app allows manual entry. Some let you enter an account and routing number directly, which shares far less than a full connection.
• Connect one app at a time, and only when you're actually going to use it.
• Verify the screen. Reach Plaid through the app you're signing up for, not through a link in an email or text.
• Revoke as you go. When you stop using an app, disconnect it in Portal rather than just deleting it from your phone.

Bottom line

Is Plaid safe? On security, it's about as solid as this category gets, and using it is generally safer than emailing a bank statement or handing your credentials to a small app directly.

The real question is scope. Plaid can pull two years of transactions, every account behind a single login, and identity details most apps never needed, and its own policy allows using that data to build insights and train AI systems.

So use it, then clean up after it. Open the Plaid Portal, disconnect the apps you've stopped using, and delete the data behind them. It takes about 10 minutes, and it's the difference between a connection you chose and a dozen you forgot about.

FAQs