Your data is yours. Agents can’t move it.

Isolation

Every financial row is stored for one owner. Each public read and write resolves that owner in one place, and a coverage check keeps the functions on that path. An anonymous caller gets an empty read. A write without an owner throws. A signed-in user, an API key, and an OAuth token all act as that one user, and only that user.

No money movement

Fineants requests read-only products from Plaid. There is no tool that sends money, starts a transfer or ACH, trades, or writes back to a bank. Marking a bill paid records the cycle in your ledger. Linking a crypto transfer records lots. Neither one moves funds.

Tokens and keys

Plaid access tokens are encrypted before they are stored, decrypted only on the server, and never sent to the browser or to an agent. API keys are stored as a SHA-256 hash. The secret is shown when you create the key. Revoke it in Settings and it stops authenticating.

Web protections

• Pages cannot be framed. The browser is told to deny frames.
• Responses set a nosniff content type and a trimmed referrer.
• A Content-Security-Policy is sent in report-only mode while it is checked against Plaid, sign-in, and the app.

Demo mode

Demo mode is a setting you turn on when you want to share your screen. The app shows sample accounts, and buttons in the app stay on that view. Agents connected through MCP keep reading and writing the real records.

Deletion

Disconnecting an institution removes it at Plaid and deletes its accounts from Fineants. Revoking a key stops that key immediately. There is not yet a self-serve way to delete a whole account. Ask the operator, and see the data retention note.

Report a vulnerability

If you find a security issue, describe it from the contact on the privacy page. Please include the page or request involved, and avoid sending account numbers, keys, or bank tokens. A machine-readable pointer lives at /.well-known/security.txt.