Data & Security

Last updated October 22, 2026. Draft — pending legal review.

Household separation

Every record belongs to one household, and the database itself refuses to return it to anyone who isn't a member.

You log in to your bank inside Plaid's window. Cashflow never sees or stores your bank password.
Access is read-only: balances and transactions. Cashflow cannot move money.
The bank access key is encrypted before it's stored, stays on our servers and is never sent to your browser.
Only household owners, signed in with two-step verification, can connect or disconnect a bank.
Updates from Plaid are checked against Plaid's digital signature before they're accepted.

Passwords found in known data breaches are rejected, and changing a password requires the current one. Two-step sign-in is available to everyone.

Owners can see when banks were connected, disconnected and synced on the Household page.

Disconnecting a bank revokes access at Plaid immediately, with an option to delete its synced transactions. Owners can delete the whole household.