Security

Bank connections by Plaid

• We never see your bank password. You sign in to your bank through Plaid, in Plaid's window or on your bank's own site, and Plaid gives Openbox Money access to your accounts.
• The connection reads balances, transactions, investments and loan details. Openbox Money can't make payments or move money.
• You can disconnect any bank at any time in the app, which ends Openbox Money's access through Plaid.

Your sign-in

• Two-step sign-in is required before connecting a bank, and it's checked again when the connection is made. The second step is a passkey or a code from an authenticator app.
• You can sign in with a passkey, your Google account, or an email and password.

Your data

• Bank access tokens and identifying details like merchant and account names are encrypted before they're stored. Other details, such as your email address, amounts, balances, dates, categories and investment holdings, aren't encrypted this way, so totals and budgets can be worked out.
• The keys that unlock the encrypted details are kept outside the database, so a copy of the database alone doesn't reveal them.
• Each household's data is walled off at the database level, and automated tests check that one household can't see another's.
• Everything travels over HTTPS.
• If nobody in your household uses Openbox Money for 60 days, it disconnects your banks and deletes their access keys. Your history stays, and you reconnect when you're back.

What we don't do

• We don't sell your data, share it for advertising, or use it for lending decisions.
• The site loads no advertising or tracking scripts. How pages are used is measured by Openbox Money itself.
• Your transactions aren't sent to AI services. If you choose to use your own AI assistant, you decide what to share with it.

Found a problem?

If you think you've found a security problem, email support@openboxmoney.com with what you saw and how to reproduce it. Please don't access other people's data or disrupt the service while you check.