Reference
Data handling and security
What a Plaid integration stores on WordPress, how access tokens work, PCI DSS vs bank data, Nacha account number rules, and how to delete connections.
Last updated by the PluginLoom team
With Plaid, your WordPress site never receives a user's bank username or password. Users log in inside Plaid Link, and your site receives tokens from Plaid. The most sensitive thing your site holds is the access_token, which Plaid says must be stored persistently and securely.
What does the user share, and with whom?#
The user logs in to their bank inside Plaid Link, and Plaid shares the data they permit with your site. Plaid says it protects data with AES-256 encryption and TLS, and that people can see and manage what they have shared through the Plaid Portal (How Plaid handles data (opens in a new tab)).
What does a Plaid integration keep on my server?#
| Data | What it is | Sensitivity |
|---|---|---|
client_id and secret | Your Plaid API keys | High. Server only |
access_token | Permanent key to one user's connected bank (an Item) | High. Server only |
item_id | ID of that connection | Low. Safe to log |
Account id, mask, name, type | Which account the user picked, last 4 digits | Low to medium |
Processor token or Stripe btok_ | One-time token passed to your processor | Medium; use once |
link_session_id, request_id | IDs for support tickets | Low. Safe to log |
| Product data | Balances, identity fields, transactions, as requested | Depends on product |
Plaid tokens say which environment they belong to, for example access-sandbox-... or public-production-... (Plaid errors (opens in a new tab)).
Does my site need to store account numbers?#
Usually not. If you use a Plaid processor partner, Plaid's Auth partnerships docs (opens in a new tab) say the partner model frees you "from having to securely store sensitive bank account information." With Plaid Transfer, Plaid moves the money for you. You only need raw account and routing numbers from /auth/get if you send them to a processor yourself.
If you do store account numbers, Nacha's data security rule requires non-consumer Originators with 2 million or more ACH entries a year to render account numbers unreadable when stored electronically, for example by encryption or tokenization (Nacha rule (opens in a new tab)).
Some banks return a tokenized account number instead of the real one. Plaid says Chase, PNC and US Bank do this today, and that these numbers only work for ACH and RTP (Auth docs (opens in a new tab)).
Does PCI DSS apply?#
PCI DSS is the card industry's standard. The PCI Security Standards Council says it is designed to "protect payment account data" (PCI SSC (opens in a new tab)), meaning payment card data. Bank account connections through Plaid are not card payments, so PCI DSS does not cover them in the same way. Your card gateway, and ACH rules from Nacha, still apply to the payments you take. This is general information, not legal or compliance advice.
How do I remove a user's bank connection?#
Call /item/remove for that Item. Plaid says this invalidates the access_token and any processor or bank account tokens made from it (Items API (opens in a new tab)). Do this when:
- A user disconnects their bank or closes their account.
- You get a
USER_PERMISSION_REVOKEDwebhook. - You stop offering a feature that used the connection.
For Transactions, Liabilities and Investments, removing the Item is also how you stop Plaid's monthly billing for it.
What should I do to keep it secure?#
- Use HTTPS on every page. Plaid requires it for Production redirect URIs.
- Keep your Plaid
secretand access tokens out of the browser, logs, and page caches. - Limit WordPress administrator accounts and use strong logins.
- Turn on two-factor authentication in the Plaid Dashboard (Plaid account security (opens in a new tab)).
- Rotate your Plaid secret if you suspect it leaked.
- Verify webhook signatures (webhooks doc).
- Keep WordPress, PHP, your theme and all plugins up to date.
- Tell users what you collect and why in your privacy policy.
Sources#
Checked October 23, 2026.
- Plaid, How we handle data (opens in a new tab)
- Plaid, Items API (opens in a new tab)
- Plaid, Auth (opens in a new tab)
- Plaid, Auth partnerships (opens in a new tab)
- Plaid, Account security (opens in a new tab)
- Plaid, Invalid input errors (opens in a new tab)
- Nacha, Supplementing Data Security Requirements (opens in a new tab)
- PCI Security Standards Council, PCI DSS (opens in a new tab)
Plaid is a trademark of Plaid Inc. BankBridge is an independent plugin and is not affiliated with or endorsed by Plaid.
Was this page helpful?