You are being asked to connect a bank account. Here is what protects it.
All traffic runs over TLS. Your password is stored only as a bcrypt hash, and we never store your bank login at all.
Account connections are established through Plaid. The access we receive is read-only — transactions and balances can be read, money cannot be moved.
Every database query for user-owned records is scoped to the signed-in account at the data layer, so one account cannot read another's data even if a request is tampered with.
Automated dependency and security audits run in CI. Access to production is limited and logged.
If you believe you have found a security issue, email security@financebrainai.com. Please include steps to reproduce. We will acknowledge your report and will not pursue action against good-faith research.
See also our Privacy Policy and Terms of Service.