Security & trust
Finall shows your accounts in one place — it never touches your money. Here is exactly how your data is protected, in plain English, plus free independent tools you can use to check these claims yourself.
The promises
When you link a bank, you sign in on your bank's own page through Plaid — the same network used by Venmo and American Express. Finall never sees, sends, or stores your bank credentials.
The access tokens Plaid issues are sealed with AES-256-GCM — the encryption standard banks and governments use — before they touch the database, and all traffic runs over TLS.
Finall can see balances and transactions but cannot move money, pay bills, or change anything at your bank. Even if someone got into your dashboard, there is no "send money" button to press.
Sign-in is protected by rate-limited, server-side sessions. Every sensitive action lands in an audit log you can read, and you can disconnect any institution at any time.
Don't take our word for it
These are independent, public security scanners. Finall cannot influence their results — anyone, including you, can run them against this site at any time.
Data practices
Stored, encrypted
Never stored, never sold
Responsible disclosure
We follow the industry-standard security.txt (RFC 9116) convention so researchers always know how to reach us. Please report issues privately to security@finallai.com — we aim to acknowledge reports within 72 hours.