Security
Effective date: August 15, 2026 · Last updated: August 24, 2026
FinSight connects to your bank so it can show you your own data — nothing more. This page explains, in plain language, exactly what that means: what we can see, what we can never do, and how your data is protected along the way.
Read-only access
FinSight can never move money, make payments, or initiate transfers — on any account, ever.
We never see your bank login
Your username and password are entered directly into Plaid's secure interface, not ours.
Tokens encrypted at rest
The connection to your bank is stored as an AES-256-GCM encrypted token, not a plaintext credential.
Encrypted in transit
Every request — to your browser, to Plaid, to Stripe, to Anthropic — travels over TLS 1.2+.
Multi-factor authentication
Add an authenticator app or a passkey to your account from Settings → Security.
Delete anytime
Disconnecting a bank or deleting your account revokes our access immediately — it isn't a support ticket.
1. How bank connections work
FinSight uses Plaid, a regulated financial data network used by thousands of apps, to connect to your bank. When you click "Connect Bank," a Plaid window opens and you sign in to your bank inside that window — never inside FinSight.
Your bank username and password go directly to your bank through Plaid's interface. FinSight never sees them, never asks for them, and never stores them. What we receive back from Plaid is a secure access token that lets us request your account balances and transaction history — nothing else.
2. Read-only, always
FinSight cannot move your money. It cannot initiate a payment, a transfer, or a withdrawal on any connected account, under any circumstance. The Plaid products FinSight uses (balances, transactions, identity) are read access only — there is no code path in the application that can write to your bank account.
3. Encryption
- At rest — the Plaid access token for each connected institution is encrypted with AES-256-GCM before it is written to the database. The encryption key is stored as a server-side secret, separate from the database itself, and is never present in application code or version control.
- In transit — all traffic between your browser and FinSight, and between FinSight and every third party it talks to (Plaid, Stripe, Anthropic, Clerk, Resend), is encrypted with TLS 1.2 or higher.
- Database — the underlying Postgres database is encrypted at rest by our hosting provider (Neon, built on AWS) independent of the application-level token encryption above.
4. Account access & multi-factor authentication
Signing in to FinSight is handled by Clerk, a dedicated authentication provider — FinSight never stores your FinSight password either. You can strengthen your account from Settings → Security by enrolling an authenticator app (TOTP) or a passkey for multi-factor authentication, and from there you can also review active sessions and sign out of devices you don't recognize.
Every dashboard and API route requires a valid session. Admin-only routes additionally check your account role on the server for every single request — a role can never be spoofed from the browser.
Sessions expire automatically after 12 hours, regardless of activity — you'll be asked to sign in again rather than stay indefinitely signed in on a shared or unattended device.
5. Disconnecting a bank & deleting your account
You can disconnect any connected bank from the Accounts page at any time. Doing so revokes FinSight's Plaid access token for that institution immediately — it is not a request that waits on a support team.
Deleting your account (Settings → Danger Zone) revokes every Plaid connection you have, cancels any active subscription, and deletes your financial data, budgets, goals, and chat history along with your login. See our Privacy Policy for the full data-retention timeline.
6. Application security practices
- Every API input is validated against a strict schema before it is processed.
- Every endpoint is rate-limited via Upstash Redis to prevent abuse — login attempts, bank-connection attempts, and general API traffic each have their own limit.
- Webhooks from Plaid, Stripe, and Clerk are all cryptographically verified — FinSight rejects any webhook whose signature doesn't match before processing it.
- Raw transaction data and access tokens are never written to application logs.
- Every admin action is written to an append-only audit log (who, what, when, from where) — admin access to a user's account is traceable after the fact, not invisible.
- Dependencies are scanned automatically (Dependabot) and audited regularly for known vulnerabilities.
7. Billing security
Subscription payments are handled by Stripe, a PCI DSS Level 1 certified payment processor. Your card number, expiration date, and CVV are entered directly into Stripe's interface and never pass through FinSight's servers — we store only a Stripe customer ID and your current subscription status, which is enough to know what features to unlock, not enough to charge you outside of what you've authorized.
Frequently asked
Can FinSight move my money?
No. FinSight only requests Plaid's read-only products (balances, transactions, identity) — there is no code path anywhere in the app that can initiate a payment, transfer, or withdrawal on a connected account.
Does FinSight store my bank login?
No. Your bank username, password, and any MFA code are entered directly into Plaid's interface, not FinSight's. We only ever receive an encrypted access token that lets us request your balances and transactions.
What financial data does FinSight store?
Account balances, transaction history, and whatever you create yourself — budgets, goals, debts you're tracking, and chat messages to the AI assistant. Never your bank credentials, and never your full card number (Stripe holds that, not us).
Who can access my data?
You, by default — every query is scoped to your account. FinSight's admin panel can be used to look at account-level details for support and incident response, and every admin action is logged; see our Access Controls Policy for the full model.
8. Reporting a security concern
No system is perfectly secure. If you believe you've found a vulnerability, please email us at info@finsight.it.com with details — we take these reports seriously and will respond promptly.
For the full legal detail behind these practices, see our Privacy Policy and Terms of Service.