Security & trust
Finall shows your accounts in one place — it never touches your money. Here is exactly how your data is protected, in plain English, plus free independent tools you can use to check these claims yourself.
The promises
When you link a bank, you sign in on your bank's own page through Plaid — the same network used by Venmo and American Express. Finall never sees, sends, or stores your bank credentials.
The access tokens Plaid issues are sealed with AES-256-GCM — the encryption standard banks and governments use — before they touch the database, and all traffic runs over TLS.
Finall can see balances and transactions but cannot move money, pay bills, or change anything at your bank. Even if someone got into your dashboard, there is no "send money" button to press.
Sign-in is protected by rate-limited, server-side sessions. Every sensitive action lands in an audit log you can read, and you can disconnect any institution at any time.
Don't take our word for it
These are independent, public security scanners. Finall cannot influence their results — anyone, including you, can run them against this site at any time.
Data practices
Stored, encrypted
Never stored, never sold
Private beta
For a small number of households, Finall can optionally connect to Gmail on a strictly read-onlybasis to find statement, payment-due, and loyalty-balance emails from a fixed list of banks and travel programs. We only ever read message headers and Gmail's own short preview snippet — never the email body — and we extract only a handful of fields (an account's last 4 digits, a card's product name, an amount, a points balance). The email itself is never stored. Disconnecting at any time deletes the connection token and everything ever extracted from it. This feature is off by default and only enabled per household.
Responsible disclosure
We follow the industry-standard security.txt (RFC 9116) convention so researchers always know how to reach us. Please report issues privately to security@finallai.com — we aim to acknowledge reports within 72 hours.