Your money stays yours.

Fylo connects to your bank through Plaid, the same connection layer used by many of the finance apps you already know. When you link an account, you enter your bank login with Plaid, never with Fylo. Your password goes to your bank, not to us. In return, Fylo receives a read-only token — a key that lets us read your transactions and balances, and nothing else. We never see, receive, or store your bank password.

Here is the whole of it, both sides.

Your connection to Fylo is encrypted in transit (HTTPS/TLS).

You connect an account when you want to, and you can disconnect any account at any time. You can delete your data. Nothing about the connection is permanent except your ability to end it.

Gmail is off by default. If you turn it on, Fylo reads your inbox only to detect bills — the receipts and statements that tell your forecast a payment is coming. It is opt-in, scoped to that one job, and you can revoke it at any time.

You do not have to take any of this on faith. Fylo is open source, so anyone can read exactly what the code does with your data. And if you would rather not use our servers at all, you can run the whole thing yourself with Docker. Inspectable code is the strongest guarantee we can offer.

Read every line on GitHub →

Fylo is new. We are not a bank, and we are not yet audited by a third party. That means our security rests on the design above — read-only access, no stored passwords, encrypted connections, and code you can read — rather than on a certificate we do not have yet. We would rather tell you that plainly than imply otherwise.

If you find a security issue, please tell us. We would rather hear it from you than read about it later.

Get in touch →