This article is the detail behind Is my financial data secure?. That one answers the question; this one shows the machinery, including the retention periods, which are the part people most often want in writing.
Connections, by how they work
Automatic sync, United States and Canada. Handled by Plaid. You authenticate with
your bank inside Plaid’s own window, so your bank credentials go to Plaid and never to
Finthy. Finthy holds a token scoped to read that one connection. Access is read-only:
balances and transactions come in, and nothing can go out. You can review or revoke
Finthy’s access yourself at my.plaid.com.
Manual accounts, everywhere else. You create the accounts and add transactions, or import a statement. No bank credential exists, so none can leak.
Statement and file imports. A file you upload is read by AI to pull the transactions out of it. PDFs and images are sent as they are; spreadsheets are converted to CSV on our servers first and only the CSV is sent. What Finthy keeps afterwards is the extracted transactions, not the file. A failed upload is the exception: it is held briefly, with restricted permissions, so the failure can be diagnosed, and then deleted.
The Chrome extension for Mexico reads transactions from your bank’s own website, in your browser, for Citibanamex, HSBC México and Banorte. You sign in at your bank rather than in Finthy, so your bank password never reaches us, and you start every sync yourself. What the extension sends on is the transactions it read, nothing else. Other Mexican banks work by statement import or manual entry.
Encryption and access
- In transit: TLS 1.3 on everything, between you and Finthy and between Finthy and our providers.
- At rest: financial data encrypted with AES-256.
- Internal access: on a need-to-know basis. Admin actions are recorded in an audit log: sign-ins, impersonation, and changes to users, institutions and categories.
Our Security page on finthy.com carries the infrastructure detail and the certifications our providers hold, since Finthy runs on audited infrastructure rather than holding those certifications itself.
What leaves Finthy, and to whom
Nothing goes anywhere for advertising, and nothing is sold. These are the processors and what each one receives:
| Who | What they get | Why |
|---|---|---|
| Plaid | Your bank authorisation, then balances and transactions | Automatic sync in the US and Canada |
| Anthropic | The statement you uploaded, or the slice of your data a Finthy AI question needs | Extracting transactions; answering your questions |
| Stripe | Your payment details, entered on Stripe’s own form | Web subscriptions |
| Apple or Google | Your purchase, if you subscribed in an app store | App store subscriptions |
| Our email provider | Your email address and the message | Sending the email you asked for |
Anthropic does not use your data to train models. That is a term of our contract, not a setting we chose and could change quietly.
How long things are kept
| Data | Kept for |
|---|---|
| Your account and its data | As long as the account is active |
| A deleted account | Scheduled for 7 days, then permanently removed |
| An inactive account | Deleted after 2 years without activity, with 30 days’ notice first |
| Raw provider data from your bank | 365 days |
| Parsed import data | 90 days |
| Uploaded PDFs and images | Deleted after processing, within 24 hours |
| Finthy AI conversations | 90 days after the conversation’s last message |
| Changes made by connected apps | 12 months |
| Consent records | 7 years, as proof of consent |
| Marketing data | Removed as soon as you opt out |
Two of these surprise people. Raw provider data is the untouched copy of what Plaid sent, kept so a sync problem can be traced; the transactions you see are separate and stay as long as your account does. And a deleted account is not deleted instantly, which is deliberate: the 7-day window is what lets you undo a deletion, including one you did not make.
The controls on your account
- Password, minimum 8 characters, stored as a one-way hash.
- Two-factor authentication, with 10 single-use backup codes.
- Passkeys, up to 20, using your device unlock or a hardware security key.
- Sign-in locking after 10 wrong passwords in 15 minutes.
- Sessions that expire. An unused sign-in expires on its own, sooner if you did not ask to be remembered, and every session ends for good some weeks after you first signed in and asks for your password again. An active session is extended quietly, so you are not signed out while you are working.
- A password change, a 2FA change or regenerated backup codes sign out every other session and disconnect anything under Connected apps.
- Email notification on a password change and on any passkey added or removed.
- Connected apps lists every AI assistant or app you have allowed, with a Disconnect button for each.
Your rights, and how to use them
- Export: see Exporting your financial data.
- Deletion: see Deleting your Finthy account, which lists exactly what is deleted and what is kept.
- A formal data request: Finthy has a request process for the access and deletion rights your local law gives you, and requests are tracked rather than handled ad hoc. You will get an acknowledgement when one is received.
- Which law applies: the privacy policy covers GDPR, LGPD in Brazil and CCPA in California, with the region-specific rights spelled out.
Reporting a problem
Security reports, including vulnerability reports, go to [email protected]. Account
problems go to ordinary support, which is faster for those: see Getting help and support.