Security

• Access is read-only. Apps can see balances and transactions; they cannot move money.
• Apps never receive your bank login. They get a separate Access URL that you can revoke at any time.
• Access URL secrets and session tokens are stored only as hashes; passwords use scrypt.
• Setup Tokens work once and expire after 24 hours.
• Request limits protect against runaway or abusive apps.