How Plaid works, and why we chose it

If you've connected a bank account to a financial app in the last five years, there's a good chance Plaid was involved. It's the dominant financial data infrastructure layer in the US, used by Venmo, Robinhood, Coinbase, and thousands of smaller apps including ours. Most users never see the Plaid brand; they just see a bank selection screen that appears briefly before they're connected.

Understanding what Plaid actually does matters, because "connecting your bank account" covers a wide range of things technically, and the specifics have real privacy implications.

The connection flow, step by step

Here is what happens when you click "Connect Bank Account" in Sheetful or the Prismfolio web app:

1. Our app calls the Plaid API to create a Link token, a short-lived, single-use token that opens Plaid's UI component.
2. Plaid Link opens in your browser as a modal. At this point, you are interacting with Plaid's interface, not ours.
3. You select your bank and enter your credentials directly into Plaid's form. Those credentials travel to Plaid's servers over TLS. They never pass through our servers. We never see them.
4. Plaid authenticates with your bank. If your bank supports OAuth (Chase, Wells Fargo, and others do), Plaid redirects you to your bank's own login page instead.
5. Once authenticated, Plaid returns a public_token to our app. We exchange that for a persistent access_token, an encrypted string, not your credentials, stored on our servers.
6. We use that access_token in subsequent API calls to fetch transaction data or account balances.

Your bank password exists at Plaid, and at your bank. It does not exist at Vault & Compass.

What "read-only" means technically

The access_token we receive is scoped to specific Plaid products, in our case, Transactions and Investments. It cannot initiate transfers. It cannot change account settings. It cannot access accounts we didn't request during the connection flow.

Plaid encrypts stored credentials at rest using AES-256-GCM. In transit, all data moves over TLS 1.2 or higher. Plaid is SOC 2 Type II certified and undergoes regular third-party security audits.

Why this is better than the old way

Before Plaid and similar services, financial apps used screen scraping. They asked for your username and password, logged into your bank as you, and parsed the HTML of your account pages. This was fragile, insecure, and a violation of most banks' terms of service.

Plaid's model is better in every dimension. The app never holds credentials. Banks that support OAuth never even pass credentials through Plaid. The token can be revoked at any time, either in the app or through Plaid's own portal at my.plaid.com.

Why we chose it for a privacy-first product

The alternative to Plaid for bank connectivity would be to build direct bank integrations, a multi-year engineering project for any small team, and one that would still result in handling credentials directly.

Plaid is the infrastructure that lets a small team offer bank connectivity without becoming a security liability to users. For Sheetful, the only data we store is transaction records and the access token needed to fetch them. We don't store your bank login. We don't sell your financial data. The Plaid connection is a read pipeline, not a surveillance system.

You can disconnect at any time. Sheetful deletes its copy of your access token immediately; Prismfolio keeps only an encrypted copy until Plaid confirms the connection is removed, which normally takes seconds.