How bank connections are secured

When you connect a bank, you sign in to it through Plaid, and Pennyweight keeps an encrypted access token for that connection. This page covers what Pennyweight asks Plaid for, how that token is stored, and what disconnecting removes.

For how your passphrase and sessions protect the rest of your data, read What Pennyweight can and can't see first.

Your bank sign-in happens in Plaid's window

You sign in to your bank inside Plaid's own window, opened from the Connect your bank page. On a phone, Plaid hosts the whole flow on its site and sends you back when you're done. See connect a bank from your phone.

When you finish, Pennyweight receives a one-time token from Plaid. Pennyweight's servers exchange it with Plaid for an access token. Your bank username and password are never sent to Pennyweight.

What Pennyweight asks Plaid for

Every new connection asks for your transactions, with up to about two years of history as your bank provides it. It also collects your consent for two more kinds of data: card and loan details, and investment details. Consent alone doesn't turn them on. You choose them per bank in Settings, along with recurring bills and income. See Turn on card, investment and recurring details.

None of these is a payment or transfer product. See Your AI can't move money.

How the access token is stored

Pennyweight keeps two encrypted copies of each connection's access token.

• Encrypted with your workspace key. This copy is tied to that one connection's record, so it can't be moved to another. It opens only inside a session, for example when you sync, reconnect or disconnect.
• Encrypted with AWS Key Management Service (KMS). This copy is labeled with a fixed purpose and with that one connection. KMS checks both labels before it decrypts. The background bank job's permissions let it decrypt only copies with that purpose label. Unlike the first copy, Pennyweight's servers can use this one without your session. The background job uses it to fetch new transactions while you're away. They join your ledger at your next web or AI session. The same job uses it to remove your bank connections at Plaid when you delete your Pennyweight account, and it refuses that step for an account that isn't being deleted.

Two-factor on every bank step

Pennyweight's servers require two-factor authentication before they will:

• connect a bank;
• reconnect a bank that needs it;
• disconnect a bank;
• turn on extra details for a bank.

How to do it

1. To connect, open Connect your bank in the web app. Your AI can give you a link to the same page. See Connect a US bank or card.
2. To disconnect, go to Settings → Accounts, open the bank's ⋯ menu, choose Disconnect — keep history, then confirm with Disconnect. See Disconnect a bank vs delete an account.

When you disconnect, Pennyweight:

• deletes the KMS copy of the access token right away;
• asks Plaid to remove the connection;
• stops syncing that bank;
• keeps its accounts and transactions, which you can still view and export.

If Plaid can't be reached, the disconnect still completes in Pennyweight. The copy encrypted with your workspace key stays with the disconnected connection's record.

What you'll see

The Connect your bank page lists "Read-only access. We can look, never move money." Without two-factor, it shows Two-factor authentication required instead of opening Plaid.

The disconnect confirmation reads "Syncing stops and the Plaid login is removed." It adds that your accounts and their transactions stay viewable and exportable, and that balances freeze at the last sync.

Good to know

• Bank linking is US-only. Every connection is limited to US banks. Outside the US, use the page's Outside the US? Add manually link. See Use Pennyweight without a bank link.
• Turning off two-factor doesn't touch your banks. It revokes your AI connections, but bank connections and data stay as they are.
• Reconnecting doesn't add history. Re-authorizing a connection keeps the history window it started with. See Reconnect a bank.