The short answer: Finthy can read, and only read. A connection to your bank lets Finthy see balances and transactions. It cannot move money, make a payment, change anything at the bank, or act on your behalf. There is no feature that does any of those things, so there is nothing to misuse.
The longer answer is below, because “is it secure” is really several questions.
Where your bank login goes
In the United States and Canada, where accounts sync automatically, you sign in to your
bank inside a window run by Plaid, our bank data provider. Your bank username and
password are typed into Plaid, not into Finthy, and Finthy never receives them. What Finthy
gets back is a token that can be used to read that account and nothing else. You can see
and revoke Finthy’s access from your side at any time at my.plaid.com, independently of
anything you do in Finthy.
In Mexico, our own Chrome extension can read transactions for Citibanamex, HSBC México and Banorte. You sign in at your bank, on your bank’s own site, and you start each sync. The extension reads the page you are already looking at, so your bank password does not reach Finthy here either.
Everywhere else, there is no bank login at all. You add the accounts yourself and enter transactions or import a statement, so there is no credential in the picture to protect. See Which countries and banks Finthy supports.
Either way, the thing most people are actually worried about, a company holding their online banking password, does not happen. Finthy has no field to put it in.
What Finthy stores about you
- Your account details: name, email address, and preferences such as language, timezone and display currency.
- Your financial data: the accounts you added or connected, their balances, your transactions, and anything you built on top of them such as budgets, categories and calendar events.
- A one-way hash of your password, never the password. Nobody at Finthy can read it, and support will never ask you for it.
- Technical records needed to run the service and investigate problems, such as sign-in times and error reports.
Data is encrypted in transit with TLS 1.3, and financial data is encrypted at rest with AES-256.
Who else sees it
Finthy does not sell your personal or financial information, and it is not shared for advertising. A small number of companies process parts of it so the product can work:
- Plaid, for bank connections in the US and Canada.
- Anthropic, which runs the AI model, in two places: extracting transactions from a statement you upload, and answering your questions in Finthy AI. Under our contract your data is not used to train AI models. See What Finthy AI stores, and what it sends.
- Stripe, for subscription payments on the web. Finthy never sees your full card number.
- The services that deliver our email and run our help centre and error reporting.
Each of these is named in our privacy policy with what it does. Nobody else gets your data unless the law requires it.
How your account is protected
- A password, minimum 8 characters, stored only as a hash.
- Two-factor authentication, which you can turn on so a stolen password is not enough.
- Passkeys, which replace the password with your device unlock, fingerprint, face or a hardware key, and cannot be phished.
- Sign-in locking, so guessing at your password gets shut down after ten wrong tries.
- Automatic sign-out everywhere when your password changes, 2FA changes, or your backup codes are regenerated, so changing your password really does lock other people out.
- Email alerts on the changes that matter: a password change, and any passkey added or removed.
Most of the remaining risk sits on your side of the line, which is why those controls exist. Use a password you have not used anywhere else and turn on 2FA, or add a passkey. See Your password and Setting up two-factor authentication (2FA).
What you can do with your data
- Export it. Your transactions, accounts and more, in a file you keep. See Exporting your financial data.
- Delete it. Deleting your account schedules it for 7 days, so an accidental or malicious deletion can still be cancelled, and then the data is permanently removed. See Deleting your Finthy account.
- Request it formally. If you want the complete copy or the deletion that your local law entitles you to, Finthy has a data request process rather than an email you hope someone reads.
- Disconnect a bank whenever you like, which stops the sync and leaves the transactions already in your space under your control.
If something looks wrong
Write to us at [email protected] if you have found a security problem or believe
something is wrong with how data is handled. That address goes to the people who can act on
it, and it is also where to report a vulnerability. For anything about your own account,
ordinary support is faster: see Getting help and support.
If you got an email about a password change or a new passkey that was not you, treat it as urgent: change your password from a device you trust, which signs out every other session, then write to us.
Where the formal detail lives
This article is the practical summary. Two pages on finthy.com carry the full version, and they are the ones to quote: the Security page for infrastructure, certifications and our providers’ audits, and the Privacy Policy for exactly what is collected, how long each kind of data is kept, and your rights by region.