Security
Last updated August 3, 2026
CashCaptain works by reading your transactions, so you should know exactly how that data is handled. This page explains it in plain language. Each section has a technical breakdown if you want the specifics.
The three things most people ask first:
How connecting a bank works
When you link a bank, you sign in through Plaid, a company that specializes in connecting financial apps to banks. Plaid also powers connections for apps like Venmo and SoFi. Your username and password go to Plaid or to your bank's own sign-in page. They are never sent to CashCaptain and we cannot retrieve them.
After you sign in, Plaid gives CashCaptain an access key for that bank. The key lets our servers ask Plaid for your balances and transactions. It is not your password, it only works for reading data, and it cannot move money. Disconnect the bank and the key is revoked and stops working.
Technical details
- Bank sign-in: linking uses Plaid Link. Credentials are entered on Plaid's screens or your bank's own OAuth page and never touch our servers.
- Access token: Plaid issues a per-institution access token. We encrypt it with AES-256-GCM before it is written to our database. It is never sent to the browser and never written to logs.
- Read-only products: we use Plaid's read products (transactions, balances, liabilities, investments). We have not integrated any Plaid product that can initiate payments or transfers.
- Revocation: disconnecting a bank calls Plaid's item-removal endpoint, which invalidates the key at Plaid. We then delete it and that bank's cached data on our side.
- Plaid's own security: Plaid holds SOC 2 Type II and ISO 27001 certifications. See plaid.com/safety.
What we store, and how each piece is protected
It helps to be specific about what CashCaptain actually has.
Your bank username and password
We do not have these. They are entered with Plaid, so there is nothing for us to store or leak.
The bank access key
The key Plaid gives us for reading your data. It is stored encrypted, so even a stolen copy of our database would not contain a usable key.
Your transactions, balances, and account names
The data the app exists to show you. It lives in our database, tied to your account alone: you must be signed in, and the server only ever returns your own records. It is stored on encrypted disks and travels over HTTPS only.
Your CashCaptain password
Stored only as a bcrypt hash. We cannot read it, and it never appears anywhere in plain text.
Technical details
- Token encryption: Plaid access tokens are encrypted with AES-256-GCM. The encryption key lives only in the server environment, never in the codebase.
- Passwords: hashed with bcrypt at cost factor 12. The hash never leaves the server.
- Access control: every query is scoped server-side to the signed-in user's account. Requests for records you do not own return not-found.
- Storage and transport: the database sits on an encrypted volume. HTTPS is enforced with HSTS, so browsers refuse to load the site over plain HTTP.
- Hardening headers: responses deny frame embedding (clickjacking protection), disable MIME sniffing, and restrict referrer information.
Signing in
Your session is a random token in a secure cookie. Repeated failed sign-ins are throttled. Password reset links work once and expire quickly. Linking a new bank asks you to re-verify with a code first. Changing your password signs out every device.
Technical details
- Sessions: 256-bit random tokens. The server stores only a SHA-256 hash of the token, so database contents cannot be replayed as logins. Cookies are httpOnly, Secure, and SameSite.
- Throttling: sign-in, sign-up, and password-reset endpoints are rate-limited.
- Resets: reset tokens are hashed at rest, single-use, and short-lived. A password change invalidates every active session.
- Step-up checks: linking a bank requires a fresh one-time code by text or email.
What we do with your data
Your data is used to run the app for you: your dashboard, spending breakdowns, budgets, and alerts you turn on. We do not sell it and we do not share it with advertisers. It goes to service providers only where needed to operate the service, such as Plaid for bank connectivity and our text and email providers for messages you asked for. The full detail, including every provider we use, is in our Privacy Policy.
Disconnecting and deleting
Remove a bank in Settings and its access key is revoked at Plaid immediately, and we delete that bank's data from our side. Delete your account and we revoke every bank connection, then erase your accounts, transactions, budgets, and settings. Deletion asks for your password first.
Technical details
- Bank unlink: calls Plaid's item-removal endpoint, then deletes the connection and its accounts and transactions from our database.
- Account deletion: requires your password, revokes every linked institution at Plaid, then deletes your user record and everything attached to it. Timelines are in the Data Retention Policy.