What Plaid Sees — and What It Doesn’t

When you connect a bank through Plaid, it collects the data the app you're using has requested: account names, types, and balances; transaction history (date, amount, merchant, and category); and, depending on the app, account and routing numbers, investment holdings, or loan details. It does not see your bank password when you log in through your bank's own OAuth page, it cannot move money on its own, and it doesn't receive data the app never asked for. The scope is set per connection — a budgeting app gets transactions, a payment app gets account numbers, and neither automatically gets the other's data.

That's the short version. The longer version matters, because "Plaid sees my bank account" can mean very different things depending on which app you linked, how your bank connects, and what permissions you granted. Let's take it apart piece by piece.

What data does Plaid actually collect?

Plaid organizes access into products, and an app requests only the products it needs. The main categories look like this:

• Account information: the accounts you chose to share, their names ("Everyday Checking"), types (checking, savings, credit card, brokerage), and current and available balances.
• Transactions: for each shared account, the transaction date, amount, merchant name or description, pending status, and a category guess. History depth varies by bank, often up to about two years.
• Identity: the name, address, phone, and email your bank has on file — used by some apps to confirm the account belongs to you.
• Account and routing numbers: requested by apps that set up transfers or direct deposit, not by read-only trackers.
• Investments and liabilities: holdings, positions, and loan balances, if the app tracks net worth or debt.

The key point is that this list is a menu, not a bundle. A net worth tracker that requests balances, transactions, investments, and liabilities gets those — and does not get your routing number. If you want to understand the plumbing behind this, how Plaid works when you link a bank walks through the whole handshake.

Does Plaid see my bank password?

Increasingly, no — and at major banks, almost never. Most large US institutions now use OAuth: when you link, you're redirected to your bank's own login page, you sign in there, and the bank hands Plaid a token scoped to the accounts you approved. Your password never leaves the bank's site. This is the connection style worth insisting on, and it's the core of why OAuth connections are safer than screen scraping.

Some smaller banks and credit unions still use credential-based connections, where you type your username and password into Plaid's interface. In that flow, Plaid does handle your credentials — it encrypts and stores them to keep the connection alive, and the app you linked never sees them. It's a real difference in trust model, though, and one reason connection methods are worth checking before you link.

What Plaid never sees

A few things stay out of the pipe entirely, regardless of the app:

• Your bank password, at any OAuth-connected institution.
• Accounts you didn't share. Banks that support account selection let you expose your checking account and keep your savings invisible to the connection.
• Your card's full number, PIN, or CVV — transaction data describes purchases, it doesn't include the credentials to make new ones.
• The ability to move money on its own. Data access and payment authorization are separate permissions, and a read-only connection has no transfer capability at all. We dug into this in can Plaid move my money?
• Data for apps you didn't authorize. Each app's connection is separate; linking your bank to one budgeting app doesn't expose it to any other Plaid-powered app.

A worked example: linking a checking account to a spending tracker

Say you link a checking account with a $3,214.87 balance to a read-only spending tracker. Here's the shape of what flows through Plaid: the account's name, type, and mask (the last four digits, like ••4823); the current and available balance; and a transaction feed — "Trader Joe's, −$62.41, posted Aug 18," "Paycheck, +$2,450.00, Aug 15," "Netflix, −$15.49, pending." If the tracker requested identity, it also gets the name and email your bank has on file.

What doesn't flow: your debit card number, your password (you logged in on the bank's page), your savings account (you unchecked it during linking), and any way to initiate a withdrawal. The tracker can tell you that you spent $412 on restaurants last month; it cannot spend $412 on anything.

Who ends up with the data — Plaid, or the app?

Both, in different roles. Plaid is the pipe: it retrieves data from your bank, holds connection state, and passes the requested data to the app. The app is where the data lives and gets used — categorized, charted, analyzed. This means two separate privacy questions are worth asking. First, do you trust Plaid as infrastructure? Its security model, regulatory posture, and data practices are covered in our plain-English review of whether Plaid is safe. Second — and usually more important — do you trust the specific app on the other end? Plaid's data use is fairly uniform; apps vary enormously in what they do with transaction data, whether they sell aggregated insights, and how they handle deletion.

Read the app's privacy policy for three things: whether data is sold or shared with third parties for marketing, whether you can delete your data on demand, and whether access is read-only. Seven Financial, for example, requests read-only balances, transactions, investments, and liabilities — enough to compute net worth and honest spending totals — and lets you delete everything in-app instantly.

How to see and control what you've shared

You don't have to take any of this on faith. Plaid maintains a consumer portal (my.plaid.com) where you can see every app connected through Plaid with your credentials, what data each one accesses, and disconnect any of them. Many banks also show third-party access in their own security settings, where you can revoke an OAuth grant directly at the source — often the cleaner kill switch, since it cuts the connection at the bank rather than asking the middleman.

1. Check your bank's security or "connected apps" settings for a list of active third-party connections.
2. Check the Plaid portal for the app-by-app view of what's shared.
3. Revoke anything you don't recognize or no longer use — the full walkthrough is in how to revoke an app's access to your bank account.
4. For apps you keep, request data deletion inside the app too; revoking access stops new data but doesn't erase what was already synced.

One honest caveat: revoking a connection removes access going forward. Data an app already pulled is governed by that app's retention policy, which is exactly why the privacy-policy check before linking matters more than the cleanup after.

The bottom line

Plaid collects the financial data an app requests — balances, transactions, and account details for the accounts you chose — and nothing beyond that scope. At OAuth banks it never touches your password, and no read-only connection can move a cent. The real variable isn't Plaid; it's the app on the other end. Pick apps that request only what they need, say plainly that access is read-only, and let you delete your data — and audit your connections once or twice a year so old grants don't outlive the apps you actually use.