Is Plaid Safe? What Customers and Stores Should Know

Short answer: yes, Plaid is generally safe to use for linking a bank account, with the same caveats as any service that holds financial data. On Plaid's own pages, checked 26 October 2026, it says it encrypts data with AES-256 and TLS, does not share your bank username and password with the apps you use, and does not sell or rent your personal information. Its Trust Center lists SOC 2 Type 2, ISO 27001 and ISO 27701. Plaid did pay $58 million in 2022 to settle a privacy class action, and changed how it handles data as part of that settlement. You can review and revoke every connection at my.plaid.com.

This guide goes deeper than the short answer in How Plaid works. It is written for two readers: a customer deciding whether to click "Connect your bank", and a store owner deciding whether to offer it.

Is Plaid safe? The evidence at a glance#

What Plaid is, and why it appears in so many apps#

Plaid sits between an app and your bank. When an app wants to verify your account, take a bank payment or read your balance, it opens Plaid Link, Plaid's own login window. Plaid's docs describe Link as "the client-side component that your users will interact with in order to link their accounts to Plaid", and say it "handles all aspects of the login and authentication experience."

That is why people search "is Plaid legit" after seeing an unfamiliar window: the app they trust handed the bank step to a company they may not have heard of. That is normal, and it is the point of the design. The app never handles your bank login.

How Plaid protects your bank login#

There are two ways the login happens, and both keep your password away from the app:

1. OAuth banks. For banks that support it, Link "manages the OAuth handoff flow, bringing the user to their institution to log in", then returns you to the app. You type your password on your bank's own site or app.
2. Other banks. You enter your login inside Plaid Link. Plaid's privacy policy says it collects "login data when required by the provider of your account, like your username and password." Plaid says it does not share that username and password with your apps.

Plaid also says its own systems require multi-factor authentication "for added security to help protect your data in our systems", and that its program is "designed to meet or exceed industry standards", audited by security researchers and financial institutions.

What data does an app or store get?#

Only what the app asks for and you agree to. Plaid says it collects data "to power the services you've chosen and, when requested, securely share it with the app you're using."

Plaid's End User Privacy Policy, effective 8 December 2025, lists the kinds of data it can collect depending on the product the app uses:

A checkout that only takes a bank payment does not need your transaction history. If an app asks for more than its purpose needs, that is a fair reason to stop and ask why.

Some banks add a layer of protection here. Plaid's Auth docs say Chase, PNC and US Bank return a tokenized account number instead of the real one, that it works only for ACH and RTP payments, and that at Chase and PNC it stops working if you revoke access.

Does Plaid sell your data?#

Plaid's consumer page says: "We don't sell or rent your personal information to outside companies." The privacy policy is more detailed. Its US privacy notice says Plaid shares data with nonaffiliates for their marketing only "with your consent or at your direction", and it lists "the developer of the app you are using" as a recipient. The policy also says, "We retain your data only as long as it is needed."

In plain terms: the app you connected gets the data you agreed to share, and what that app does with it is governed by the app's own privacy policy, not Plaid's. Read both.

The 2022 Plaid class action settlement#

This is the most common reason people ask if Plaid is safe, especially on Reddit, so here is what the court record says.

• Case: Cottle v. Plaid Inc., United States District Court, Northern District of California, Case No. 20-cv-03056-DMR. Five class actions were consolidated in July 2020.
• Allegation: that Plaid "uses consumers' banking login credentials to harvest and sell detailed financial data without their consent."
• Outcome: U.S. District Judge Donna M. Ryu granted final approval of a $58 million settlement on 20 July 2022.
• Class: people in the United States whose financial accounts Plaid accessed with their login credentials, from 1 January 2013 to 19 November 2021.
• Changes Plaid agreed to: delete Transactions data for users who did not connect to an app that requested it; delete data for users where Plaid no longer has valid means to authenticate with the bank; put a prominent link to Plaid Portal on its homepage; add disclosures to the standard Link flow; minimize the data it stores; and expand its End User Privacy Policy.

A settlement resolves the claims without a trial. What matters for safety today is that the changes the court described (less data stored, more disclosure, a user portal) are things you can check yourself, and Plaid Portal is the place to do it.

How to see and revoke what you have shared#

Plaid says: "Visit Plaid Portal to view the data types you've shared through Plaid and control ongoing access to that data." It also says, "To disconnect your financial accounts from apps, or to delete your data from Plaid's systems, visit Plaid Portal."

Steps for a customer:

1. Go to my.plaid.com and create a Plaid Portal account (Plaid asks you to verify your phone number and email address).
2. Review each app and the data types it receives.
3. Disconnect any app you no longer use.
4. Use the delete option if you want Plaid to remove your data.

Plaid's privacy policy adds that its systems "are designed to automatically delete your personal data" when an app removes your connection, subject to certain exceptions.

Real risks, and how to reduce them#

No service is risk-free. These are the honest ones:

For store owners: what your site does and does not see#

If you add Plaid to a WordPress store with BankBridge, this is the data picture, from our Data handling and security doc:

Your responsibilities are real: keep the Plaid secret and access tokens out of the browser and logs, use HTTPS, and remove a connection with /item/remove when a customer asks. The WooCommerce doc explains how the payment routes work.

Customers trust a bank login more when the store explains it. The rest of this guide is about doing that well, and about why a bank login is safer for you than typed account numbers.

How to explain Plaid at checkout#

A short, factual line next to the "Pay by bank" button answers most of the worry before it starts. Keep it to what Plaid and your setup actually do:

Pay securely from your bank. You log in to your bank through Plaid, a service used by thousands of financial apps. We never see your bank username or password. We receive only the account you choose, to process this payment. You can disconnect at any time at my.plaid.com.

Tips that help:

• Name Plaid before the window opens, so it is not a surprise.
• Say what you receive and why, for example "the account you choose, to process this payment."
• Link your privacy policy, and make sure it mentions Plaid.
• Do not overstate. Avoid words like "bank-level security" unless you can source them. Stick to what Plaid publishes.
• Offer another way to pay. Some customers will prefer a card, and that is fine.

For the full verification picture, including Nacha's account validation rule, see bank account verification for WordPress. If you are comparing Plaid with other bank-login providers, see Plaid alternatives.

Is Plaid safe compared with typing your account number?#

For both sides, a bank login is usually safer than typed numbers. The customer does not hand their full account and routing number to a website form, and the store gets a verified account instead of numbers that might be mistyped or belong to someone else. Typed numbers are also what lead to the "no account" and "invalid account" returns explained in ACH return codes.

How BankBridge uses Plaid on your store#

BankBridge is a WordPress plugin that opens Plaid Link inside WooCommerce checkout, MemberPress signups and Elementor layouts. Customers log in to their bank in Plaid's window, so your site never sees their bank password, and receives tokens from Plaid instead. Before a bank payment, BankBridge can use Plaid Balance, Plaid Identity and Plaid Signal to check funds, ownership and return risk. You bring your own Plaid account, and Plaid bills its fees to you directly.

Plans start at $79 a month for one site ($149 for five, $299 for unlimited). See how the bank login looks to a customer in Plaid's Sandbox on the live demo, then pick a plan.

This guide is general information, not legal, security or financial advice. Facts are from Plaid's public pages and the court record, checked 26 October 2026, and may change. Plaid is a trademark of Plaid Inc.; BankBridge is an independent plugin and is not affiliated with or endorsed by Plaid.