Earnist connects to your bank read-only. We can see transactions. We cannot touch a dollar. Here is exactly how it works — plain English, no marketing.
When you link a bank or card through Plaid, Earnist gets read access to transactions only. There is no code path — none — through which Earnist can move money, initiate transfers, or change your bank settings. You can revoke the connection any time from Settings, which calls Plaid's item/remove endpoint and deletes the stored token immediately.
The username and password for your bank are entered inside Plaid's own secure window — Earnist never sees them, never receives them, never stores them. What comes back to Earnist is a Plaid-issued access token, which we then encrypt at rest before storing.
TLS 1.2+ enforced for all external traffic. Passwords bcrypt-hashed with per-password salt. Plaid access tokens encrypted at the application layer with Fernet (AES-128 CBC + HMAC-SHA256) using a runtime-injected key. All third-party API calls (Plaid, Stripe, Anthropic) run over HTTPS.
Plaid transaction webhooks are verified with the Plaid-Verification ES256 JWT (JWK fetched and cached from Plaid, freshness enforced at 5 minutes, request body compared with constant-time SHA-256). Production rejects unsigned webhooks; sandbox passes them with observability logging. Stripe webhooks are signature-verified the same way.
Export everything as JSON from Settings → Data → Download all my data. Delete your account from the same page: we revoke every linked Plaid Item upstream, purge 12 collections of your data, and write a hashed-email audit row to comply with data-protection recordkeeping. Everything else is gone within 24 hours; encrypted backups age out on a 30-day rolling window.
Every authenticated database query is scoped by the requesting user's ID. It is not possible for one user to read or write another user's records — the enforcement is at the query, not just the UI. Administrative endpoints require both an authenticated session AND an email in an allow-list.
The things below are documented gaps or design decisions. We publish them because trust is built on precision, not on marketing language. If any of these is a dealbreaker for you, please don't sign up — but do let us know so we can prioritize.
If you've found a security issue in Earnist, we'd rather hear about it directly than read about it later. Email us at the address below with as much detail as you can share — we respond to every credible report within one business day, and we won't take legal action against good-faith researchers who follow reasonable disclosure norms.
security@earnist.app