Is Plaid Safe? A Canadian Guide to Linking Your Bank

Plaid is safe to use, and if you’re deciding whether to link your bank to an app, that’s the short answer. It has been running since 2013, sits behind more than 9,000 fintech apps, gets audited by outside security firms, and has never reported a breach of its core systems. The app you connect never receives your banking password.

One thing does work differently here than in the American articles you’ll find on this question, and it’s worth a minute of your time. So here’s what actually happens when you connect a Canadian account, what a connection can and can’t do once it’s live, and how to shut one off.

What is Plaid, and what does it do?

Plaid is a bank-connection service. When an app asks to link your account, Plaid handles the sign-in and hands back only the account information you approved. It holds no money, issues no accounts, and isn’t a bank. More than 9,000 fintech apps (opens in a new tab) are built on it, across more than 10,000 institutions (opens in a new tab) in Canada and the United States.

You’ve probably used it already

Canada was Plaid’s first market outside the US, back in 2018, and coverage now runs from the Big Six through Desjardins, Tangerine, Simplii and most credit unions. If you’ve used a Canadian budgeting app, a robo-advisor, or a bank-verification step when signing up for something, you’ve likely already connected through Plaid without noticing.

That ubiquity is part of the answer on safety. This isn’t a small operator handling your connection. It’s infrastructure that Canadian banks have negotiated directly with.

What Plaid does to protect the data

Plaid encrypts data with AES-256 in storage and TLS in transit, requires multi-factor authentication on its own systems, and runs continuous monitoring, all set out in its data handling documentation (opens in a new tab). It’s also SOC 2 Type II certified, meaning an outside auditor tested the controls in practice rather than reading a checklist.

What a connection can and can’t do

This is the part most people are actually asking about, and it’s the most reassuring thing on this page. A read-only data connection, which is what savings and budgeting apps use, is a window. Your balance and transactions travel out to the app. Nothing travels back the other way, so there’s no mechanism to move, withdraw, or charge anything.

Read-only means no instruction can reach your bank

It helps to think of it as a statement you’ve given someone permission to look at. They can see the number. They have no way to act on the account, because the connection carries data in one direction and payment instructions aren’t part of it.

Plaid does also sell payment products, which is how some apps set up a transfer or a direct debit. That’s a different permission, and you approve it separately. The consent screen you see before connecting spells out what a given app is asking for, and it’s worth reading rather than tapping through.

Why you still type your password in Canada

Because Canadian banks haven’t launched the alternative yet. In the UK and EU that’s universal, and in the US it’s how many banks work, especially the larger ones: you sign in on your bank’s own page and Plaid gets an access token instead of a password. Plaid’s own OAuth documentation (opens in a new tab) says plainly that those connections “are not currently used by financial institutions in Canada.”

So when you link a Canadian account, you enter your credentials in Plaid’s window and Plaid uses them to fetch your data. The app on the other end still never receives them, which is the protection that matters most day to day.

The FCAC has long cautioned (opens in a new tab) Canadians about disclosing banking credentials to third parties, and bank agreements put the responsibility on you when you do. That’s a fair reason to be choosy rather than anxious: go through an established service you’ve picked deliberately, keep the number of live connections small, and walk away from any app that wants your bank login typed into its own form.

The banks are actively closing this gap

RBC and Plaid signed a data access agreement in June 2022 (opens in a new tab) covering more than 14 million RBC clients, moving their connections onto a direct, sanctioned API rather than a bot reading account pages. Other large institutions have signed similar deals.

A major Canadian bank choosing to work with Plaid directly is a meaningful signal about how it views the company. The remaining step, the password-free sign-in, is what open banking will deliver.

What data does Plaid collect, and does it sell it?

Plaid doesn’t sell or rent your financial data, and its business model is charging the apps rather than monetizing you. It collects what the connected app requested, which can include balances, transaction history, and account-holder details, plus technical data like IP addresses for fraud detection.

The 2022 settlement, and what it changed

Worth knowing, because it’s the one real mark on the record and it ended in users’ favour. A US class action alleged Plaid collected more financial data than apps actually needed. Plaid denied the allegations and any wrongdoing, and settled for $58 million in 2022 (opens in a new tab).

What the settlement required is the useful part: delete data already collected, store less going forward, improve the login window, and build Plaid Portal so people can see and cancel their own connections. The class covered US residents only, so no Canadian received a payout, but those product changes apply to everyone. The company that exists today is the one that came out of that.

How do you disconnect an app from your bank?

Whenever you want, and it takes about a minute. Start inside the app that holds the connection, since a well-built one lets you unlink right in its settings and that’s the cleanest cut. Plaid Portal at my.plaid.com also lists connections made through Plaid and lets you cancel them and delete stored data.

Two things worth knowing

Disconnecting stops future sharing. It doesn’t retrieve what the app already collected, so if you want that gone as well, ask the app to delete it. Most privacy policies commit to a process for exactly this.

And once you’ve stopped using a connection for good, change your bank password. That one comes from RBC’s own Electronic Access Agreement (opens in a new tab), which asks customers to do it after ending an aggregation service. It costs two minutes and it’s good hygiene whether or not you ever expect to need it.

What changes when open banking arrives?

Canada’s answer is consumer-driven banking, which became law in March 2026. Once it’s running, your bank will send approved data straight to an accredited app over a regulated connection, your consent will expire and need renewing, and no password will change hands at all. The Bank of Canada will supervise it and keep a public registry of accredited providers.

That’s the last rough edge being smoothed out, and it’s arriving. We wrote a fuller account of where open banking in Canada actually stands if you want the timeline.

How Lodavo fits in

Lodavo is a free savings app that rewards you for saving: the more you set aside at the bank you already use, the more free tickets you earn in a weekly draw, with a guaranteed prize of at least $100 every week and up to $10,000 on the line.

The connection runs through Plaid in read-only mode, so you can track your savings each week and collect your tickets, and Lodavo never sees or stores your banking login. You can unlink it from inside the app any time you like. If you want the longer version, we wrote a whole piece on whether Lodavo is safe and legit, and the details also live on our security page.

The short version

Plaid is a sound choice for what it does. It’s audited, it’s never reported a breach of its core systems, Canadian banks work with it directly, and a read-only connection has no way to touch your money. The one Canadian quirk is that you still enter your login in Plaid’s window, and open banking is already on its way to retiring even that.

So connect deliberately rather than nervously: pick apps you’d vouch for, keep an eye on what’s still linked, and unlink what you’ve stopped using.

Ready to make saving something you look forward to? Download Lodavo free on the Apple App Store (opens in a new tab) or Google Play Store (opens in a new tab) and start earning tickets for this week’s draw.

Terms and conditions apply. No purchase necessary (alternate method of entry available). Skill-testing question required. Open to legal residents of Canada who are the age of majority. Odds depend on the number of eligible entries received. Full rules and odds at our contest rules.