Is Plaid safe? What happens when you connect your bank to an app

What Plaid is and why apps use it

Plaid is a company that sits between your bank and the apps you use. When an app shows a button like "Connect your bank", it often opens Plaid's connection window. You pick your bank, sign in, choose which accounts to share, and Plaid passes the data you agreed to share to the app.

Apps use Plaid so they do not have to build and maintain a separate connection to every bank. For you, the practical upshot is that the sign-in happens inside Plaid's window or on your bank's own website rather than in a form the app controls.

Plaid's consumer page states that it does not share the username and password for your financial institution with your apps. Once you give permission, Plaid moves the financial data you chose to share from your bank to the app.

How the sign-in works: three connection types

Plaid connects to banks in different ways, and the connection type decides where your password goes. Plaid's help center describes three types and says that in every case your credentials are not shared with the app you are connecting.

Plaid's developer documentation says OAuth support is required in all Plaid integrations that connect to financial institutions in the US. With OAuth, you sign in on your bank's own website or app, approve the data sharing there, and return to finish. The bank then gives Plaid access through a secure token rather than your password.

You cannot always choose the type, since it depends on what your bank supports. If your bank sends you to its own login page during the connection, you are using OAuth.

Read-only access vs payment access

Connecting through Plaid does not give every app the same powers. Each app requests specific kinds of data, and that decides what it can do. A spending tracker typically needs transactions and balances, which let it read your activity. Plaid's documentation says its transaction data includes the date, amount, category, merchant, and location of each purchase.

Payment apps usually request more. Plaid's Auth product gives an app your account and routing numbers so it can initiate credits or debits through ACH, the network behind direct deposit and most bank-to-bank transfers. That is expected for an app that pays bills or funds an investment account, and a reason to ask questions when a budgeting app wants it.

Pay attention to what the app says it needs during setup. If the requested access does not match what the app does, stop and look for one that asks for less.

How to review and revoke Plaid connections

You can see and cut off Plaid connections yourself. Plaid runs Plaid Portal at my.plaid.com, where you can view the apps you have connected, see the types of data you have shared with each one, disconnect them, and ask Plaid to delete your data from its systems.

Some banks also list connected apps in their own security or privacy settings, which gives you a second place to check and remove access.

1. Open Plaid Portal

   Go to my.plaid.com and verify your identity when prompted. You will see a list of apps you have connected through Plaid.

2. Review each connection

   Look at every app listed, which accounts it can reach, and what types of data it receives. Anything you do not recognize or no longer use is a candidate to remove.

3. Disconnect what you do not need

   Remove the connection for apps you have stopped using. Disconnecting stops new data from flowing to that app through Plaid without affecting your other connections.

4. Delete your data inside the app too

   Disconnecting does not erase what the app already stored. If you want that data gone, delete your account in the app itself or contact the app directly.

5. Ask Plaid to delete its copy

   Plaid Portal also lets you request deletion of your data from Plaid's systems once you no longer use any connected apps.

Red flags when an app asks for your bank

A legitimate connection flow and a scam can look similar at a glance. These signs mean you should stop and check before going any further.

If you already connected an app that shows these signs, disconnect it in Plaid Portal, change your bank password, and watch your statements for activity you do not recognize.

• Your bank password is requested outside Plaid's window or your bank's site. A chat message, an email, or a plain form inside an app should never ask for it.
• The link arrived unprompted. A text or email asking you to "verify" or "reconnect" your bank is a classic phishing setup. Open the app yourself instead of tapping the link.
• The app wants more than its job requires. A budgeting tool asking for account and routing numbers deserves a clear explanation.
• There is no clear way to disconnect or delete your data. You should be able to do both without waiting on support.
• The privacy policy is vague. Look for plain answers about whether data is sold and how long it is kept.
• Pressure and urgency. Legitimate apps do not threaten to close your account if you skip connecting in the next hour.

What Sprout can and cannot do with your connection

Sprout AI uses Plaid to connect eligible banks, credit unions, and card issuers in the United States and Canada. Plaid runs the sign-in, and Sprout never sees or stores your bank password. You choose which accounts to connect and can disconnect any of them at any time.

The connection is read-only. Sprout reads transactions and balances to answer questions like where your money went or which subscriptions renew next. It cannot move money, make transfers, pay bills, change your accounts, or place trades. When you ask a question, Sprout's AI provider receives only your question and the records needed to answer it.

Sprout does not sell personal data. To remove everything, go to More, then Delete account, which erases your connected banks, transactions, and conversations, and you can also remove the connection in Plaid Portal. Our security page and privacy policy have the full details.